Many businesses are not aware of the risk of disclosure of information provided to Canadian federal, provincial and municipal governments under Access to Information legislation (ATI legislation) until they receive a notice of intended disclosure. We have developed the below summary of recommended measures to avoid organizational surprise, minimize exposure to formal third party notices, and ensure an effective response to a notice of intent to disclose.
On balance, disclosure risk reduction should be viewed as a basic cost of doing business with government. Given the pervasiveness of government involvement in the economy, virtually all businesses will have to confront this situation and respond to government notices of intended disclosures.
ATI Legislation Basics
ATI Legislation: Common Elements
- Federal and provincial ATI legislation are essentially the same.
- ATI legislation provides any resident with a "right of access" to certain government records, subject to defined exemptions. This right of access is most often used by competitors, unions, and consumer and public policy advocates for research purposes.
- Businesses have no right to know who has asked for information they provide to government.
- "Government institutions" covered by ATI legislation have been broadly defined to include commercial government corporations, regulatory organizations, and municipal governments. However, certain institutions are specifically exempted. As well, some institutions operate under special access and record protection legislation.
- ATI legislation applies to all written and machine readable "records" received or created by the government (including records created by the government from oral communication). A word of caution is in order in this respect: ATI legislation applies not only to actual documents provided by businesses to governments, but also to excerpts of these documents, as well as all information and opinions derived from these documents and any other communication with the government.
- While ATI legislation contains specific exemptions for business information, it also contains public interest overrides which allow for a refusal to disclose in cases such as product and environmental tests. While there has been a steady stream of new case law on sensitive business information, there is still very little guidance on public interest overrides. However, there are many good reasons why governments would be reluctant to use these overrides including the resultant chilling effect on the voluntary supply of information by businesses.
Federal Access to Information Act (ATIA)
- Section 20 of the ATIA sets out the exemptions for "third party information".
- Prior to releasing a record that may contain sensitive "third party information", the government must make reasonable efforts to notify the affected third party of its intention to disclose and allow the third party to make representations as to why the record should not be disclosed. Note, third parties will not receive a notification if the government has already decided to exempt the sensitive third party information, or if the government makes a mistake in identifying the information as "third party information" (a reason for being clear and aggressive in describing any sensitive third party information as such when it is first communicated to the government).
- If the government is not persuaded, it will issue a final notice of intent to disclose. Businesses are then left with the option of challenging this decision in court.
- Similar harm based exemption criteria (with the exception of claims of pure "confidentiality") apply to the business information of commercial Crown corporations.
- Note that special legislation may also affect disclosure of sensitive information; for example, the Privacy Act for personal information, the Statistics Act for returns under the Act, tax legislation, competition legislation, and product and other regulatory legislation.
Best Practices to Manage Risk of Disclosure
- Control and coordinate what information (in particular, what written documentation) is provided to the government. This can be assisted by adopting coordinated record keeping practices, and a general confidentiality/internal document access policy.
- Designate a central point of contact who will deal with notices and/or other communications with government.
- Staff training on the structure of Access to Information, Privacy and Personal Information Protection legislation.
- Consistent identification of sensitive information using ATI legislation exemption categories.
- Personal information may be subject to Privacy Act exemption – It is important to identify any personal information as such at the time it is provided to government, as third party appeal rights do not apply to this category of information.
- Public disclosure standards – These should be consistent throughout the organization, and recognize other disclosure obligations and limitations such as those under securities legislation. Information provided to government generally cannot be exempted from disclosure if it has already become public in some fashion.
- When in doubt, mark documents as "confidential". Remember, however, that what is deemed confidential within an organization may not necessarily be treated as confidential under ATI legislation, and caution, recent jurisprudence clearly indicates that the Courts do not accept third party information claims at face value, but carefully scrutinize the exemption claims and the underlying documents.
- Be aware of statutory and evolving case law standards.
- When providing information on behalf of another business, make sure that the other business knows of its possible exposure and what is needed to make a prompt and effective response to a notice of intent to disclose. Do the same when another business is providing information on your behalf. Note that the notice of intention to disclose will be sent to the party that provided the information, not the originator of the information which may have a greater commercial interest in non-disclosure. The parties designation of all information they exchange as "confidential" will not necessarily be sufficient to prevent disclosure under ATI legislation.
- Know whether the government entity receiving the information is subject to ATI legislation; and, if not, whether it may be sharing the information with entities that are.
Making an Effective Response Under the Federal ATIA
- Involving legal counsel at an early stage may be helpful. Counsel often respond to notices on behalf of clients. Among other things, this can force government departments to consult with their own counsel.
- Be aware of tight deadlines to respond (20 days). Extensions may be granted (for good reasons) at the discretion of the officer responsible.
- To the extent possible, treat the relevant government Access to Information coordinator as a potential ally, not a potential enemy.
- Reply to a notice of intent to disclose in writing (otherwise other appeal rights are not activated). Do not fall into the trap of accepting the suggestions of what could be exempted from the official who signed the notice – his or her managers and Department of Justice legal counsel may well have a different perspective.
- If possible, "redact" records to highlight objections: this makes it easier to get a decision in your favour.
- Provide reasons for non-disclosure to encourage the involvement of government counsel at an early stage. Go beyond merely reciting statute provisions.
- Do not undermine a claim for exemption from disclosure by overstretching it to include information that is obviously already public, such as information that has been published on your website or in company annual reports.
- Decide whether you are prepared to apply for judicial review in the early stages – this may influence the scope of objections to disclose.
- While appeal rights are restricted to third party information, you may wish to refer to other exemptions (such as those found under Privacy legislation) as this may cause the government to take a second look before disclosing any information.
- Address possible public interest overrides early on.
- Time lines to apply for judicial review after final notice of disclosure are tight (20 days).
- There may be room to "settle" between receiving the final notice of intention to disclose and commencing a judicial review, but some institutions may prefer to wait for court proceedings to be initiated.
- Even at the judicial review stage, remember that there are incentives for the government institution not to go all the way to a court decision (such as the risk of criticism or a bad result, the fact that judicial review holds up disclosure for several months, and the fact that litigation is far from cost free even for government departments). Institutions may be willing to settle.
- With a growing body of case law as guidance, judges are increasingly willing to disagree with business arguments, and to critically assess opinions on the effects of disclosure. Be prepared to substantiate any claim with strong arguments and good evidence.