Investigation of the Department of National Defence’s refusal to disclose personal information of a deceased individual

Complaint under the Privacy Act (the “Act”)

February 28, 2024

Description

The representative made a personal information request for information about a deceased member on behalf of the executor of the estate. The Department of National Defence (DND) determined that the representative was not entitled to make a request under subsection 12(1) of the Privacy Act (the Act) for the purpose of administering the estate of the deceased under paragraph 10(b) of the Privacy Regulations (the Regulations) since he did not demonstrate a sufficient connection between the information being sought and the administration of the deceased’s estate. However, DND did not explicitly state this in any of its responses. DND processed the request informally and disclosed information in part under subparagraph 8(2)(m)(i) of the Act. After review, we found that the representative did not sufficiently articulate or substantiate the precise purposes of the estate and how the records in question would further those purposes, and that the complaint was not well-founded.

Takeaways

Individuals making a request on behalf of a deceased under paragraph 10(b) of the Regulations must demonstrate a sufficient connection between the information being sought and the administration of the deceased’s estate.
Where a request under subsection 12(1) of the Act is refused, section 16 provides that the government institution must indicate either that the information requested does not exist or the specific provision of the Act on which the refusal is based.
Government institutions may only proceed with treating a request informally upon receipt of written consent from the requester who has been informed that only formal requests are subject to the provisions of the Privacy Act, including legislative timelines and the right to complain.

Report of findings

Complaint

The complainant’s representative (the representative) alleged that the Department of National Defence (DND) improperly denied him access to personal information under the Privacy Act (the Act).

Investigation

Summary of the access request and institution’s responses

Our investigation confirmed that the representative made a personal information request for all records in relation to the investigation into the allegations made against a deceased member. The representative also sought all records pertaining to any actions taken by the deceased member’s chain of command as a consequence of these allegations. The representative explained that he brought the request on behalf of the executor for the estate of the deceased.
DND wrote to the representative and explained the right of access under the Act and the limitations under paragraph 10(b) of the Privacy Regulations (the Regulations). DND noted that the requested information could only be disclosed if it met either the criteria under paragraph 10(b) of the Regulations or subparagraph 8(2)(m)(i) of the Act. DND asked that the representative clarify the specific information being sought and how the information requested is related to the administration of the estate.
The representative explained that the complainant was seeking the information for two purposes relating to their role as executor for the estate of the deceased. Also, the representative submitted that while paragraph 10(b) of the Regulations does include the caveat that information will be disclosed “...only for the purpose of such administration...”, it does not define said purposes. Accordingly, he suggested that a large and liberal interpretation ought to be applied. Alternatively, the representative requested that DND consider releasing the information under paragraph 8(2)(m) of the Act.
DND determined that the representative was not entitled to make a request under subsection 12(1) of the Act for the purpose of administering the estate of the deceased under paragraph 10(b) of the Regulations since he did not demonstrate a sufficient connection between information being sought and the administration of the deceased’s estate. However, this was not explicitly stated in any of DND’s responses.
In this case, DND processed the request informally and agreed to disclose information under subparagraph 8(2)(m)(i) of the Act. Subparagraph 8(2)(m)(i) permits the disclosure of personal information where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure.
DND initially processed the representative’s personal information request under two separate files due to the information being sought.

File 1 – All records in relation to the investigation of the allegations made against a deceased member

DND responded to representative’s personal information request by informing him that the information he requested was part of an active investigation. As a result, DND withheld the information in its entirety since it consisted of information falling under section 22 of the Act (law enforcement and investigation).

File 2 – All records pertaining to any actions taken by the deceased member’s chain of command as a consequence of the allegations made against him

DND originally responded to the representative’s personal information request by informing him that all the information he requested would have been included in an investigation file, which was processed under file 1. DND stated that this file was still part of an active investigation and, as such, it withheld the information in its entirety since it consisted of information falling under section 22 of the Act (law enforcement and investigation).
Subsequent to the representative’s follow-up correspondence, DND wrote to the representative and acknowledged that the justification it cited in its letter for his request for file 2 was not related to his request for file 1. As a result, DND agreed to reexamine his request for file 2. It further confirmed that the information he requested under file 1 was no longer part of an active investigation and, as such, it agreed to reprocess that information under a third file: file 3.
After review, DND reconsidered its original position and provided the representative access to some information. It withheld other information since it consisted of information falling under sections 22 (law enforcement and investigation), 26 (information about another individual) and 27 (information subject to solicitor-client privilege) of the Act.

File 3 – All records in relation to the investigation of the allegations made against a deceased member

DND responded to the representative’s personal information request by providing access to some information but withholding other information since it consisted of information falling under paragraph 22(1)(a) (law enforcement and investigation), and sections 26 (information about another individual) and 27 (information subject to solicitor-client privilege) of the Act.

Scope of the investigation

The representative complained about the processing of the three related files. Our investigation considered whether the representative was entitled to make a request under the Act for the purpose of administering the estate of the deceased under paragraph 10(b) of the Regulations.

Analysis

Application

In arriving at our findings, we considered sections 3 and 12 of the Act, and paragraph 10(b) of the Regulations.
Section 3 of the Act defines “personal information” as information about an identifiable individual that is recorded in any form but, for the purposes of sections 7, 8, and 26 of the Act, and section 19 of the Access to Information Act, does not include information about an individual who has been dead for more than twenty years.
Subsection 12(1) of the Act entitles an individual to request access to one’s own personal information under the control of a government institution.
Paragraph 10(b) of the Regulations allows for the rights or actions provided for under the Act and the Regulations to be exercised or performed on behalf of a deceased person by a person authorized by or pursuant to the law of Canada or a province to administer the estate of that person, but only for the purpose of such administration.

Was the complainant authorized to make a request on behalf of the deceased under paragraph 10(b) of the Regulations?

The Act provides individuals with a right of access to information about themselves under the control of a government institution. The Act prohibits a government institution from disclosing personal information about other individuals except in certain circumstances. Section 8 of the Act sets out the circumstances where personal information may be disclosed without the consent of the individual to whom it relates. Individuals who have been deceased for less than 20 years enjoy the same privacy protection as when they were living. Whether an individual is living or has been deceased for less than 20 years, the same prohibitions and exceptions in the Act apply.
Paragraph 10(b) of the Regulations allows for someone to “step into the shoes” of a deceased individual, and exercise the rights that would otherwise be provided to the deceased by the Act, under the following conditions:
1. The person must be the authorized administrator of the estate of the deceased; and
2. The right being exercised must only be for the purpose of administering the estate.
If individuals meet the requirements of this paragraph, then they are entitled to have the same access to the personal information of the deceased as the deceased would have had; their request for access to the personal information of the deceased will be treated as though the request came from the deceased person under subsection 12(1) of the Act.

Person authorized by or pursuant to the law of Canada or a province to administer the estate of a deceased person

To establish that someone is a person authorized by or pursuant to the law of Canada or a province to administer the estate of a deceased person, a requester should provide written evidence of their authority to deal with the estate of the deceased.
The complainant provided a copy of the certificate of death issued by the funeral director and a copy of the deceased’s last will and testament, appointing them the executor and trustee of his will.
In this case, DND did not dispute that the complainant should be recognized as the person authorized by or pursuant to the law of Canada or a province to administer the estate of the deceased. The complainant produced a copy of the deceased’s last will and testament reflecting that they are the executor to the estate of the deceased. Also, DND concurred that the complainant was authorized to administer the estate of the deceased in this case. Accordingly, we are satisfied that the complainant qualifies as a person authorized to administer the estate of the deceased for the purposes of paragraph 10(b) of the Regulations.

Relates only to the administration of the estate

To satisfy this part of the test, individuals must demonstrate that the request relates only to the administration of the estate. To meet this requirement, individuals must demonstrate that they are seeking access to the records for the sole purpose of administering the estate.
The Act does not define the phrase “only for the purpose of [the] administration [of the estate]” and the limited jurisprudence on paragraph 10(b) of the Regulations does not offer much direct guidance on this issue. However, insights can be gleaned from the Macdonald v. Department of National Defence^{Footnote 1} case and the Information and Privacy Commissioner of Ontario (the IPC) findings on the analogous provision, paragraph 54(a) of the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA).
Macdonald v. Department of National Defence involved a denial of records to the executors of a deceased employee’s estate. The court did not conduct a full analysis of paragraph 10(b) of the Regulations; however, it emphasized the intrusive nature of releasing such information, requiring a “good reason” and “specific statutory authority”. The cautious approach indicated a reluctance to disclose records without clear justification.
In Canadian Association of Elizabeth Fry Societies v. Canada^{Footnote 2}, the Court noted in paragraph 61 that paragraph 10(b) of the Regulations is “nearly similar” to paragraph 54(a) of MFIPPA.
The IPC has issued numerous findings that interpret 54(a), as well as the near-identical section 66(a) of the Freedom of Information and Protection of Privacy Act, and these, by extension, are helpful in interpreting paragraph 10(b) of the Regulations.
It is useful to compare paragraph 54(a) of MFIPPA and paragraph 10(b) of the Regulations. Paragraph 54(a) of MFIPPA states that “Any right […] may be exercised, a) if the individual is deceased, by the individual’s personal representative if exercise of the right or power relates to the administration of the individual’s estate”. Paragraph 10(b) of the Regulations allows estate administrators to exercise a deceased individuals’ rights “only for the purpose of such administration” (emphasis added). “Only for the purpose of” rather than “relates to” might suggest that paragraph 10(b) of the Regulations imposes stricter requirements than paragraph 54(a) of MFIPPA.
Just like the Court in MacDonald, the IPC has interpreted paragraph 54(a) of MFIPPA narrowly in view of the rights being balanced. In Order M‑1075, Assistant Commissioner Mitchinson noted that deceased individuals retain their right to personal privacy except for the administration of their estate, and therefore paragraph 54(a) of MFIPPA should be interpreted narrowly to include only that information which is required to wind up an estate.^{Footnote 3}
Notably, IPC findings have emphasized the need for the information being sought to support the administration of the estate: see orders MO-1256^{Footnote 4}, MO-1301^{Footnote 5}, MO-1315^{Footnote 6}, MO-1525^{Footnote 7}, and MO-2042^{Footnote 8}. IPC findings have also emphasized that the relationship between the sought information and the estate’s administration must be substantiated: see orders MO-1449^{Footnote 9} and MO-1803^{Footnote 10}.
In summary, several principles and themes can be identified:
1. The privacy interests of the deceased need to be considered when granting access.
2. The estate must demonstrate a valid purpose and requires specifying the purpose and how it is the business of the estate as opposed to a different party.
3. There should be a clear relationship between the purpose of the estate and the sought information. The estate must show how the records in question clearly pertain to the valid purposes of the estate.
4. Both the purpose of the estate and its relationship to the information being sought should be substantiated in order to justify the intrusion on the deceased’s privacy.
Accordingly, individuals making a request on behalf of the deceased under paragraph 10(b) of the Regulations must clearly specify and substantiate the purposes of the request, the validity of the purposes, and how the requested records would further the valid purposes.
In his submissions to DND, the representative explained that the complainant was seeking the information for two purposes relating to their role as executor for the estate of the deceased.
First, the representative reported that the complainant would be bringing a complaint of alleged misconduct, on behalf of the deceased’s estate, in relation to the investigation of the allegations made against the deceased. He noted that the deceased died prior to receiving disclosure in that matter. He submitted that the investigation report contains information regarding the conduct of that investigation and is directly relevant to the complaint that will be brought.
Second, the representative reported that the complainant would be participating in the Board of Inquiry into the deceased’s death. He submitted that the information in the investigation report as well as the administrative action taken by the deceased’s chain of command consequent to the investigation, is directly relevant to informing the complainant of the relevant events in order to participate in that process in a meaningful manner.
After review, DND determined that despite being given an opportunity to do so, the representative did not demonstrate a sufficient connection between the information in question and the administration of a deceased’s estate. DND is of the position that it acted in accordance with the provisions of the Act in responding to the request for access in the way that it did, and that the information in question is not necessary or relevant to the administration of the estate.
In our view, the representative did not offer sufficient evidence to demonstrate that the request relates “only for the purpose of [the] administration [of the estate]” for the second part of the test under paragraph 10(b) of the Regulations. As such, we find that the complainant is not entitled to “step into the shoes” of the deceased person and exercise the same right of access to the requested information under subsection 12(1) of the Act that would have been available to him.

Conclusion

After review, we consider that the representative did not sufficiently articulate or substantiate the precise purposes of the estate and how the records in question would further those purposes.
Accordingly, the complaint is not well-founded.

Other

As referenced earlier in this report, DND determined that the representative was not entitled to make a request under subsection 12(1) of the Act for the purpose of administering the estate of the deceased under paragraph 10(b) of the Regulations since he had not demonstrated a sufficient connection between information being sought and the administration of the deceased’s estate. As a result, DND processed the request informally and agreed to disclose information under subparagraph 8(2)(m)(i) of the Act. However, this was not explicitly stated in any of DND’s responses.
Where a request under subsection 12(1) of the Act is refused, section 16 of the Act provides that the government institution must indicate either that the information requested does not exist or the specific provision of the Act on which the refusal is based. That notice must also inform the requester of their right to complain to the Privacy Commissioner about the refusal.
In its responses, DND either referred to the representative’s Privacy Act request, referenced the 30‑day timelines for responding to requests, or gave the representative the right of complaint to the Privacy Commissioner. Also, in its response for file 1, DND did not indicate that it was releasing the information under section 8(2)(m) of the Act.
An informal request is a request for personal information made to the ATIP office of a government institution that is not made or processed under the Act. There are no deadlines for responding to informal requests and the requester has no statutory right of complaint to the Privacy Commissioner. Section 4.1.6 of the Directive on Personal Information Requests and Correction of Personal Information states that government institutions may only proceed with treating a request informally upon receipt of written consent from the requester who has been informed that only formal requests are subject to the provisions of the Act, including legislative timelines and the right to complain.
In light of the foregoing, we recommended that DND consider making the necessary changes to ensure compliance with the requirements of the Act.