Who controls the personal email of public body employees on the public body’s email system? Under public sector information and privacy legislation all records, including email, that are in the custody of or under the control of the public body are subject to provisions granting access rights to the public. This issue has been highlighted by a series of orders from provincial Information and Privacy Commissioners considering the status of email files of faculty members at Canadian universities who were involved in grant approval decisions of the Social Sciences and Humanities Research Council (SSHRC). Most recently, the Alberta Court of Queens Bench over-turned a decision of an adjudicator delegated by the Alberta Commissioner who had found that the email communications between a faculty member at the University of Alberta and the SSHRC were under the control of the University and were therefore subject to the access provisions in the Alberta Freedom of Information and Protection of Privacy Act.
The adjudicator found that the University of Alberta had custody or control over the email because the email would have “passed through its servers” and because the faculty member’s services to the SSHRC was part of the faculty member’s responsibilities to the University, thereby providing the University with authority to deal with the email. The adjudicator relied on earlier decisions of the Ontario Commissioner involving emails between faculty members at Wilfred Laurier University and the University of Ottawa and SSHRC in support of her conclusion that the email was in the custody of or under the control of the University of Alberta and therefore subject to FIPPA.
The Court found that the adjudicator’s decision was unreasonable on three inter-related grounds. The first and over-riding error identified by the Court was the failure of the adjudicator to consider the purpose of FIPPA in her interpretation of custody and control and her application of the potential relevant factors to the facts. The adjudicator failed to consider what factors in determining custody and control were relevant to assessing the connection between disclosure of the email and facilitating democracy or government accountability and transparency. The Court found that the adjudicator’s uncritical application of factors related to the University’s right to “deal with the records” in the absence of any consideration of whether those factors related to the democratic purpose of FIPPA was unreasonable.
The Court also found that the adjudicator should have recognized that the SSHRC is subject to federal access and privacy legislation and, unlike the University, exerted specific control over the email. The Court commented that it was inappropriate to find that records are under the control of different organizations subject to separate legislative regimes. Lastly, the adjudicator failed to apply relevant factors established in previous cases to determine custody and control and relied on irrelevant factors. The adjudicator turned a question of the University’s “right to possess the record” into the ‘”right to deal with the records”. The Court found that a public body’s routine back-up of records on a server or monitoring email in “extraordinary circumstances of breaches of ethics or law” is not equivalent to a right to possess a record. The right of a public body to possess a record includes at the least a right to access and use the record for its own use.
The Court relied on the Ontario Divisional Court decision in City of Ottawa v Ontario (IPC), which found that personal email on the City’s email server was not in the custody or under the control of the City for the purposes of access under the Municipal Freedom of Information and Protection of Privacy Act. The Court then concluded that the University of Alberta did not have possession of the email correspondence between its faculty members and SSHRC , likening the personal email to personal possessions: “Employees may keep private items at the place of work without them falling within the employer’s possession and custody”.
