Toronto Police Services Board (Re), 2000 CanLII 21018

ORDER MO-1381

Appeal MA-000206-1

Toronto Police Services Board

NATURE OF THE APPEAL:

The Toronto Police Services Board (the Police) received a request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) from a member of the media for information contained in two specified databases operated by the Police. The requester made it clear that he did not want access to any personal information, and went on to state:

Initially, we would like a list of the fields contained in each database. We would also welcome a chance to speak with analysts familiar with the programs. From there, we could determine which fields we seek to access and which ones we do not want.

The request can be divided into two parts.

The first part is for a list of the field names contained in the two databases: the Repository Integrating Criminal Information computer database (RICI), and the Criminal Information Processing System (CIPS). The second part is for the actual data contained in certain of these fields. The appellant intended to review the list of field names provided in response to the first part of the request in order to identify which fields were of interest.

The Police denied access to all information responsive to both parts of the request on the basis of the following exemption claims contained in the Act:

• sections 10(1)(a) and (b) (third party information) for RICI; and
• sections 11(a), (b), (c) and (d) (economic and other interests of the Police) for both RICI and CIPS databases

These exemption claims apply to the listing of field names in both databases as well as the actual data contained in the databases.

The requester (now the appellant) appealed the decision of the Police, and also raised the possible application of the public interest override contained in section 16 of the Act.

Because the appellant did not receive the list of field names, he has been unable to identify the scope of the second part. I have decided to initially proceed only with the first part of the request, the list of field names. I sent a Notice of Inquiry to the Police and the company that sold RICI to the Police (the affected party) asking for representations on the application of the exemption claims to the list of fields contained in the two identified databases.

I received representations from both the Police and the affected party. I decided it was not necessary to seek representations from the appellant before issuing this order.

PRELIMINARY MATTERS:

CHARACTERIZATION OF THE RECORDS

The records provided to me by the Police regarding the CIPS database consist of 24 pages of screen layouts printed from the database. These records identify only the blank field names for each screen, and contain no data. Similarly, the records provided by the Police concerning the RICI database consist of three pages of blank screen layouts printed from this second database.

The appellant described the first part of his request as a "list of fields" in the two databases. He did not ask for screen layouts, and apparently sought the field names in order to fully understand the type of information stored in the databases and to refine the scope of the second part of his request. The records provided to this Office by the Police consist of hardcopy printouts of blank screen layouts generated by the two databases. Presumably, these layouts reflect all of the field names used in the two databases. However, it is important to note that, as with all electronic database systems, the contents of a database can be displayed and printed in a number of different ways, and the particular paper format chosen by the Police merely represents one way of displaying the field names.

In Order PO-1725, I examined the nature of information stored in a different type of database, an electronic calendar management system. I stated:

The nature of an electronic calendar management database permits users to manipulate entries in ways that organize and/or display them either individually or together with other entries related by a common characteristic identified by the user. A "record" could be anything from a single entry up to and including the entire database. That determination must be made on the basis of the nature of the specific request and the circumstances of a particular appeal. In Order P-1281, I determined that an entire relational database containing corporate registration data should be treated as a single "record" for the purpose of addressing the issues in that appeal. In the present appeals, because the entries are electronic, and are created and can be amended, classified or deleted one entry at a time, I find that each entry in its electronic format should be characterized as a separate "record". The individual printed pages of entries for each day - the form in which the material has been provided to me - merely represent a convenient way of organizing the entries in order to permit Cabinet Office to respond to the requests and to permit me to process these appeals.

Although the present appeal involves a different type of database, some of the reasoning in Order PO-1725 is also applicable here.

In my view, the "record" responsive to the first part of the appellant's request is a listing of the individual field names used in the RICI and CIPS databases. That is all of the information the appellant wants, and the format that he receives it in is not relevant for his purposes.

The Police decided to provide the list of fields in a format that includes additional information, such as screen layout design and field sizes. However, the appellant did not ask for this additional information, and I find that any information other than the field names themselves falls outside the scope of the first part of the appellant's request. In responding to the appellant, the Police could have provided the listing of field names in whatever format was most convenient or appropriate in the circumstances. For example, the Police could have generated a printout of the field names in alphabetical order, or as a continuous listing of the names in order of their use on the various screens. If the screen layouts were the most convenient format, the Police could even have provided individual hardcopy printouts of the various screens, with all information other than a particular field name severed from each printed page. Although not obliged to do so, if more convenient, the Police could also have created a new word processing document listing the various field names in whatever order the Police felt appropriate.

It is clear from the wording of the appellant's request letter that his purpose in asking for the field names was to assist in identifying what data from the two databases he wanted to obtain from the Police. He was essentially asking the Police for assistance in this regard. The Police chose to respond to the first part of the appellant's request by producing a record that includes more information than was required and, in my view, the Police and the affected party are not entitled to rely on the existence of this additional information in order to support the application of either of the sections 10 or 11 exemption claims.

DISCUSSION:

THIRD PARTY INFORMATION

For the RICI database, which was developed by the affected party, the Police denied access under sections 10(1)(a) and (b) of the Act, which state as follows:

A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to,

(a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization;

(b) result in similar information no longer being supplied to the institution where it is in the public interest that similar information continue to be so supplied;

For a record to qualify for exemption under sections 10(1)(a) or (b) the Police and/or the affected party must satisfy each part of the following three-part test:

1. the record must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
2. the information must have been supplied to the Police in confidence, either implicitly or explicitly; and
3. the prospect of disclosure of the record must give rise to a reasonable expectation that one of the harms specified in (a) or (b) of subsection 10(1) will occur.

[Orders 36, M-29 and M-37]

Part One of the Test

Types of Information

The Police submit that the disclosure of the fields contained in the RICI database would reveal a trade secret. They state:

... the fields used in [RICI] are required to organize and input the data elements in the appropriate formats, as well as search and retrieve data from these databases.

They then identify the nature of the searches of the fields which can be done, and state:

The [Police] licences the software for the RICI system from [the affected party]. This software necessarily incorporates particular fields into its design and is considered a trade secret by [the affected party].

Furthermore, the Police refer to the confidentiality clauses in the agreements entered into between the Police and the affected party, which prohibits the disclosure of any portion of the software system "in any form whatsoever".

The Police go on to state:

If such fields were common knowledge within the industry, there would be no need for the requester to be asking for access to them ... Should the exact fields, the placement of them and the length of character for which they are designed become common knowledge, rival businesses might well be able to use that knowledge to design competing products.

... the RICI system is the subject of strenuous efforts to maintain its secrecy. The RICI system is not accessible throughout the institution; only certain members of the institution, working in specified situations, are authorized to use the system and only those individuals working in particular specified areas are allowed to view the finished products.

The affected party objects to disclosure on the following basis:

We must therefore strenuously object to the request for the revelation of information related to our software system and its primary components, being the data elements captured and retained within the system. These data elements form a core component of our proprietary product and cannot be compromised.

In Order M-29, former Commissioner Tom Wright considered the definition of "trade secret". He found that:

"trade secret" means information including but not limited to a formula, pattern, compilation, programme, method, technique, or process or information contained or embodied in a product, device or mechanism which

(i) is, or may be used in a trade or business,

(ii) is not generally known in that trade or business,

(iii) has economic value from not being generally known, and

(iv) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.

The arguments put forward by the Police and the affected party are premised on the particular format (ie. the screen layouts) in which the listing of fields was generated by the Police. As stated earlier, the additional information included by choosing this format (ie. the placement of the fields within the various screens, the character length for each field, etc.) is not within the scope of the first part of the appellant's request. It is not necessary for me to determine whether the field names, in combination with other information of this nature, would constitute a trade secret. However, having reviewed the various field names themselves, as long as they are listed in a manner that would convey no additional information, I am not persuaded that the field names themselves qualify as a trade secret. In my view, the majority of field names are relatively standard headings dictated by the requirements for policing which are generally known in the policing community, the database design industry, and by the general public.

For these reasons, I find that a listing of the various field names, in a format that discloses no other information concerning the design or development of the RICI database, does not qualify as a "trade secret" for the purposes of section 10(1) of the Act. I also find that none of the other types of information listed in section 10(1) apply to the various field names, and the first part of the section 10(1) exemption test has not been established.

Part Two of the Test

Supplied in Confidence

To meet this aspect of the section 10(1) exemption, the parties must demonstrate that the information at issue was supplied to the Police, and that it was supplied in confidence. Previous orders of the Commissioner have found that in order to determine that a record was supplied in confidence, either explicitly or implicitly, it must be demonstrated that an expectation of confidentiality existed and that it had a reasonable basis (Order M-169).

The Police refer to the confidentiality clauses set out in the agreement entered into with the affected party as the basis for their position that the information was supplied by the affected party in confidence.

Based on the representations and documentation provided by the Police, I am satisfied that the field names were included in the database product supplied to the Police by the affected party, and that this product was supplied in confidence.

Therefore, the second part of the section 10(1) exemption test has been established.

Part Three: Harms

General

In order to meet the third part of the test, the parties resisting disclosure (in this case the Police and the affected party) must demonstrate that one or more of the harms enumerated in sections 10(1)(a) or (b) could reasonably be expected to result from the disclosure of the field names.

Previous orders have established the evidence which must be provided to satisfy the third part of the test. In Order PO-1747, Senior David Adjudicator Goodis stated:

The words "could reasonably be expected to" appear in the preamble of section 17(1) [the equivalent provision to section 10(1) contained in the provincial Freedom of Information and Protection of Privacy Act], as well as in several other exemptions under the Act dealing with a wide variety of anticipated "harms". In the case of most of these exemptions, in order to establish that the particular harm in question "could reasonably be expected" to result from disclosure of a record, the party with the burden of proof must provide "detailed and convincing" evidence to establish a "reasonable expectation of probable harm" [see Order P-373, two court decisions on judicial review of that order in Ontario (Workers Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner) (1998), 1998 CanLII 7154 (ON CA), 41 O.R. (3d) 464 at 476 (C.A.), reversing (1995), 1995 CanLII 10678 (ON CTGD), 23 O.R. (3d) 31 at 40 (Div. Ct.), and Ontario (Minister of Labour) v. Big Canoe, 1999 CanLII 19925 (ON CA), [1999] O.J. No. 4560 (C.A.), affirming (June 2, 1998), Toronto Doc. 28/98 (Div. Ct.)].

In this appeal, I must decide whether there is detailed and convincing evidence to support the conclusion that disclosing a listing of field names used in the RICI database could reasonably lead to either of the harms described in sections 10(1)(a) or (b).

Section 10(1)(a): Prejudice to Competitive Position

In support of its position that disclosure of a listing of field names could prejudice its competitive position, the affected party submits:

The request for details concerning the specific application and the nature of the information gathered and retained within the application would subject the company to a competitive disadvantage relative to its competitors in this marketplace. ... the law enforcement market is a very close knit community and any revelations with respect to our software would likely find its way into the hands of our competitors.

In the software industry, every company goes to great pains to protect its data from outside parties, even to the extent of choosing not to patent software as that would require revelations to the patent office which could potentially compromise the integrity of the software system. To reveal such information as the data fields and their primary components would place [the affected party] in a position that the commercial viability of the company could be impaired.

The Police submit:

The software and computer industry is extremely competitive and it is a reasonable expectation that if, for example, another business was to extrapolate, even from the fields incorporated into the product, the methodology and technology incorporated into the software, it is conceivable that such a business might then be able to use that knowledge to develop a competing product.

This is a product which is of vital use for policing purposes and, should other businesses learn and utilize the systems which [the affected party] has developed, would prove disadvantageous financially to [the affected party].

Section 10(1)(b): Information No Longer Supplied

The Police express concerns that similar information would no longer be supplied if information from the RICI database is disclosed. They refer to the types of confidentiality agreements made with third parties concerning the licensing of software, and state that "if transacting business with a municipal institution ... means that trade secrets become liable to disclosure through an access request, the impact would be immeasurable". The Police further submit that disclosing this type of information would affect all technology providers, who would be concerned about the confidentiality of any software systems supplied to institutions covered by the Act.

The affected party's representations do not address the section 10(1)(b) harm.

Analysis of the harms in sections 10(1)(a) and (b)

The representations of the parties are persuasive, but only to the extent that they relate to disclosures of information that would qualify as a trade secret or as proprietary information belonging to the affected party. However, as I have already determined, the information at issue in this appeal is limited to a listing of field names which, if provided in a format that does not convey or reveal additional information, does not constitute a trade secret.

Based on the representations provided by the Police and the affected party, I am not convinced that disclosing a listing of fields contained in the RICI database, in a format or manner that would disclose no other information, such as screen layouts, field size, etc., could "reasonably be expected to" prejudice the competitive position of the affected party. The representations of the parties focus primarily on harm associated with disclosure of details involving the database design, structure and the entire database system. In my view, it is possible to disclose a listing of field names, with nothing more, without impacting competitive interests that could very well be relevant considerations in the context of a broader disclosure of information. The appellant's request does not relate to the software itself, the screen layouts, reports generated from the database, etc., and, in my view, providing him with a list of field names could not reasonably be expected to impact these proprietary or competitive interests. The appellant merely wants information which would put him in a position to narrow the scope of his otherwise broad request and, in my view, providing him with a list of field names can accomplish this objective without creating a reasonable expectation of probable harm to the competitive position of the affected party or the future ability of the Police to receive similar information.

Therefore, I find that part three of the sections 10(1)(a) and (b) exemption claims has not been established.

Because all three parts of the test must be established, and parts one and three are both not present in the context of this appeal, I find that the listing of field names in the RICI database does not qualify for exemption under sections 10(1)(a) and (b)of the Act.

ECONOMIC OR OTHER INTERESTS

The Police also claim the application of the discretionary exemptions in sections 11(a), (b), (c) and (d) of the Act to the listing of field names contained in both the CIPS and the RICI databases. These sections state:

A head may refuse to disclose a record that contains,

(a) trade secrets or financial, commercial, scientific or technical information that belongs to an institution and has monetary value or potential monetary value;

(b) information obtained through research by an employee of an institution if the disclosure could reasonably be expected to deprive the employee of priority of publication;

(c) information whose disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution;

(d) information whose disclosure could reasonably be expected to be injurious to the financial interests of an institution;

In order to establish that the harms under sections 11(b), (c) and (d), the Police must provide "detailed and convincing" evidence to establish a "reasonable expectation of probable harm" (see quote from Order PO-1747, above).

The RICI database

Section 11(a)

The Police submit that the list of field names qualifies for exemption under section 11(a) of the Act because the information is a trade secret which is used by the Police and has monetary or potential monetary value.

As previously described, RICI is a product of [the affected party] and is used under license by the [Police] ... To release trade secrets of [the affected party] through an information request would jeopardize both the [Police's] access to such technology and the [Police's] investment in it.

Although the RICI database was developed and is owned by the affected party, the Police submit that it belongs to the Police because it is licensed to them through agreement with the affected party.

The Police also submit that the RICI database has monetary or potential monetary value. Their position is that:

The investment by the [Police], not only in licensing fees, but in the necessary hardware, training, and incidental costs related to the RICI system represent a substantial investment by the [Police].

Section 11(b)

The Police submit that the list of field names qualifies for exemption under section 11(b) because:

[The affected party's] development of RICI required both expertise and substantial research by [the Police] in order to assist in the design of a system which would meet the needs of [the Police] and, necessarily, the requirements of the Identification of Criminals Act and the Police Services Act.

Section 11(c)

The Police submit that the listing of field names qualifies for exemption under section 11(c) because disclosure of the names could cause the revocation of the Police's license to use that RICI database. The Police also state that disclosure of this type of information may result in reluctance on the part of other technology companies to sell or license their software to municipal institutions.

Section 11(d)

The Police submit that section 11(d) applies to the field names because, if disclosed, private industry would no longer be reasonably expected to licence their technology to municipal institutions. As well, the Police submit that it is reasonable to expect that if certain information is ordered disclosed, this would compromise the system, and would require the development of replacement technologies at great expense.

Analysis of the application of section 11 to the RICI system

In my view, the Police have not provided the necessary detailed and convincing evidence to support the sections 11(b), (c) or (d) exemption claims as they apply to the listing of field names in the RICI database, nor have they established the requirements for exemption under section 11(a) of the Act for this information.

As far as section 11(a) is concerned, for the same reasons outlined in my discussion of section 10(1), I find that the names themselves, with no other information, do not qualify as a "trade secret". Also, the Police appear to acknowledge that the affected party continues to own the RICI database, and that the Police merely have a right to use it under the terms of the licensing agreement with the affected party.

I find that the representations in support of the section 11(b) claim are clearly not sufficiently detailed and convincing to establish the requirements of this exemption. The Police make no reference to any priority publication impacts, nor provide evidence that any employee of the Police has the right and/or intention to publish the field names contained in the RICI database.

As far as sections 11(c) and (d) are concerned, I am not persuaded that the arguments put forward by the Police are sufficient to establish the requirements of either exemption claim, as they relate solely to the field names themselves. The submissions concerning these two exemptions are speculative and lacking in detail. In addition, even if these speculative arguments could have relevance in the context of the database as a whole or aspects of the database that are proprietary in nature or might constitute a trade secret, they do not apply when considering disclosure of the field names themselves in a format that includes no other information. My discussion of the harms component of sections 10(1)(a) and (b) is also relevant to my findings under sections 11(c) and (d).

Therefore, I find that sections 11(a), (b), (c) and (d) of the Act do not apply to a listing of field names contained in the RICI database.

The CIPS database

Section 11(a)

The Police submit that the list of field names in this database qualifies for exemption under section 11(a) of the Act because the database was developed by the Police, and the system and methodology are a trade secret. The Police refer to the fact that the CIPS database was recently sold by the Police for profit to the Western Australian Police Service, and point to the fact that there are confidentiality clauses in their agreements which support the position that the information in the database is both a trade secret and belongs to the Police. The sale of the CIPS database is also relied on by the Police as proof of its monetary and potential monetary value: proof of its monetary value in that it was sold; and proof of its potential monetary value in that it could potentially be sold to other police agencies.

To quote the Police's submissions:

The databases and necessarily, by extrapolation, the fields inherent to them do not contain trade secrets, financial, scientific or technical information of the institution; that is, for example, the police budget and information pertaining to the science of fingerprinting are not entered into the system. However, the fields themselves are a necessary and vital component of these systems and are themselves trade secrets and technical information. ...

The CIPS system would be severely compromised - not only insofar as its use by the Toronto Police Service, but in regards to the commercial value which the system currently commands. Moreover, the knowledge that any system developed by a municipal institution was subject to release by the Information and Privacy Commissioner upon demand by any requester, would render all institutionally developed technology valueless.

Section 11(b)

The Police's submissions on section 11(b) state:

CIPS was researched, designed and developed by the [Police] specifically to meet the needs of police institutions in regards to the orderly collection, organization and retrieval of specific information. Not only are technical skill and expertise required in order to develop such a system, but also extensive experience in policing and detailed research into the requirements of such a system. Such research must not only include the practicalities of use and maintenance of the technology, but also police policies, directives and procedures, and the Police Services Act.

Sections 11(c) and (d)

The Police's representations on sections 11(c) and (d) are similar to those referred to above regarding the RICI database.

As far as section 11(c) is concerned, the Police submit:

CIPS has already proven to be a valuable, and saleable commodity. It can reasonably be expected that other police services world-wide might have an interest in the purchase of this system. The disclosure of it would definitely compromise the commercial appeal of this product.

The Police also make reference to the fact that the technology was sold to another police agency, and could be sold to other police services as well, in support of the section 11(d) exemption claim.

Analysis of the application of section 11 to the CIPS system

I accept that the CIPS database was designed and developed by the Police. Its monetary value is supported by the fact that the Police have sold the system to another Police force, and it is reasonable for the Police to hope for and anticipate other sales in the future. However, the issue before me in this appeal is not whether the database itself has monetary value or qualifies for exemption under section 11. Rather, I must determine whether a listing of field names contained in the database, in a format that would not disclose any additional information, would satisfy the requirements of any of the section 11 exemptions claimed by the Police.

As outlined previously in this order, the information responsive to part one of the appellant's request is restricted to a listing of the various field names used in the two databases. It does not include the screen layouts, the user interface, software design or any other aspect of the underlying technology of the database.

The Police make reference to Order P-1572 in support of their position that the field names qualify for exemption. In that appeal I determined that certain information contained in a computer database maintained by the Ministry of Consumer and Commercial Relations was subject to copyright protection and qualified for exemption under the Act, notwithstanding that the database could be accessed and reviewed by the public for a fee. Order P-1572 relies heavily on my findings in Order P-1281 which dealt with similar issues. The issues in these orders concerned whether information stored in databases, as well as the databases themselves, could "belong to" the Ministry.

In my view, the findings in these orders do not assist the Police in the present appeal. The database at issue in Order P-1281 was the Ontario Business Registration System (ONBIS), and the requester in that case was seeking access to the database itself as well as the data entered into the various fields in the database. In contrast to the CIPS and RICI databases at issue in this appeal, the field names in the ONBIS database, as well as the screen layouts for the system, were not at issue, because they were, for the most part, publicly available and widely used by registrants throughout the province. I was not required to consider the issue of whether a restricted listing of field names on their own would qualify for exemption.

Having considered the Police's representations, I am not persuaded that the disclosure of a listing of the field names, absent any additional information about the database itself, could reasonably be expected to result in the types of harms envisioned by sections 11(b), (c) and/or (d) of the Act. For the same reasons outlined with respect to the RICI database, I also find that a listing of the field names, considered in isolation of any other information concerning the database, is not a "trade secret" for the purpose of section 11(a).

Similar to my finding regarding the RICI database, I find that the representations in support of the section 11(b) claim are clearly not sufficiently detailed and convincing to establish the requirements of this exemption. The Police make no reference to any priority publication impacts, nor any evidence that any employee of the Police has the right and/or any intention to publish the field names contained in the RICI database.

As far as sections 11(c) and (d) are concerned, I am not persuaded that the arguments put forward by the Police are sufficient to establish the requirements of either exemption claim, as they relate solely to the field names themselves. The submissions concerning these two exemptions are speculative and lacking in detail. In addition, even if these speculative arguments could have relevance in the context of the database as a whole or aspects of the database that are proprietary in nature or might constitute a trade secret, they do not apply when considering disclosure of the field names themselves in a format that includes no other information. My discussion of the harm component of sections 10(1)(a) and (b) is also relevant to my findings under sections 11(c) and (d).

Therefore, I find that sections 11(a), (b), (c) and (d) of the Act do not apply to a listing of field names contained in the CIPS database.

Having found that neither section 10(1) nor sections 11(a), (b), (c) and (d) apply to a listing of field names in the two databases, it is not necessary for me to consider section 16 of the Act in the circumstances of this appeal.

In order to implement the findings in this order, the Police must disclose the field names contained in both databases to the appellant in a format that does not disclose or reveal any additional information relating to the content or design of either database. One method of doing so is to isolate individual field names by severing all other information from the printed screen layout printed. I have attached two sample records severed in this manner for each of the two databases. However, as indicated, that is not the only acceptable manner of disclosing the listing of field names, and I have no objection to the Police choosing an alternative method of disclosing this information if deemed by the Police to be more convenient or appropriate in the circumstances. My only caution to the Police is to ensure that whatever method is chosen, no information other than a listing of the various field names contained in the two databases be disclosed.

ORDER:

1. I order the Police to disclose a listing of all field names contained in the RICI and CIPS databases in a format that does not disclose nor reveal any additional information relating to the content or design of either database. This disclosure is to be made by sending a copy of the listing to the appellant by January 30, 2001 but not before January 24, 2001.

2. In order to verify compliance with this order, I reserve the right to require the Police to provide me with a copy of the listing disclosed to the appellant pursuant to Provision 1, only upon request.

Original Signed by: December 21, 2000 Tom Mitchinson Assistant Commissioner