Office of the Information and Privacy Commissioner
Province of British Columbia
Order No. 121-1996
September 3, 1996
INQUIRY RE: A decision by the Ministry of Agriculture, Fisheries and Food
to refuse access to computer backup tapes containing deleted e-mail
Fourth Floor
1675 Douglas Street
Victoria, B.C. V8V 1X4
Telephone: 604-387-5629
Facsimile: 604-387-1696
Web Site: http://www.cafe.net/gvc/foi
1. Description of the review
As Information and Privacy Commissioner, I conducted a written inquiry at the
Office of the Information and Privacy Commissioner on May 22, 1996 under
section 56 of the Freedom of Information and Protection of Privacy Act
(the Act). This inquiry arose out of a request for a review of a decision of
the Ministry of Agriculture, Fisheries and Food (the Ministry) to deny the
applicant access to records on the basis of section 6(2) of the Act.
This inquiry will also consider the issues raised by the applicant's complaint
that the Ministry failed to retain any relevant electronic mail backup tapes
when it received the applicant's initial request for records. He asserts that
this failure compromised his efforts to obtain evidence that the Ministry
discriminated against him and jeopardized his right to ensure the accuracy of
his personal information.
2. Documentation of the inquiry process
On October 12, 1995 the applicant submitted a request to the Ministry for all
records in the then British Columbia Systems Corporation (BCSC)'s backup tapes
for all deleted information originated from, and received by, four named
individuals on various topics. On November 1, 1995 the Ministry replied that
it was unable to provide access to the requested records on the basis of
section 6(2) of the Act. The Ministry stated that re-creating the deleted
electronic files went beyond the technical capabilities of its normal hardware
and software. The Ministry also stated that creating the records would
unreasonably interfere with its operations. On November 10, 1995 the applicant
requested a review of the Ministry's decision.
On February 13, 1996 the applicant also submitted a complaint to my Office
regarding the Ministry's failure to "pull" appropriate records from a normal
retention and disposal schedule in response to his request for records under
the Act before the records were allegedly destroyed.
3. Issues under review at the inquiry and the burden of proof
The issues under review in this inquiry are whether the Ministry is required
to recreate electronic files from backup tapes under section 6(2) of the Act
and whether the Ministry was obliged to retain the backup tapes in response to
the applicant's request for records. Section 6 of the Act reads as follows:
Duty to assist applicants
6(1) The head of a public body must make every reasonable effort to assist
applicants and to respond without delay to each applicant openly, accurately
and completely.
(2) Moreover, the head of a public body must create a record for an applicant
if
(b) creating the record would not unreasonably interfere with the operations of
the public body.
Section 57 does not establish the burden of proof in this case, which is about
the application of section 6. In Order No. 105-1996, May 27, 1996 at page 2, I
stated: "Section 57 of the Act, which establishes the burden of proof on
parties in an inquiry, is silent with respect to the duty to assist under
section 6 of the Act. Since public bodies are in a better position to address
the issue of creating a record, the burden of proof for this inquiry will be on
the Ministries." In the present case, the Ministry has argued that section 57
does not apply and also that it is "procedurally unfair to place the onus
solely on the public body," suggesting that the onus should be on both parties.
I adopt my reasoning from Order No. 105-1996 and conclude that the Ministry has
the burden of proving that it complied with its duty to assist under
section 6.
The Act also does not refer to the burden of proof regarding complaints
reviewed under section 52. This particular complaint concerns an alleged
failure of the public body in its duty to assist the applicant, similar to the
issues raised in the request for review. Thus it is appropriate, in my view,
that the initial burden of proof be on the Ministry to respond to the
complaint, since it is in the best position to address the issue raised by the
applicant.
4. The applicant's case
The applicant originally asked for all deleted information in BCSC's backup
tapes originating from and received by four named individuals and dealing with
the following topics: the applicant; another named individual; harassment;
discrimination; classification; reclassification; appeal; job description;
performance planning and review; Ombudsman; Human Rights.
In his original request for review, the applicant emphasized that he sought
records already created that in his view were in fact available and stored on
backup tapes. In his view, there was no need to create or recreate records,
since they already existed. The applicant also rejected the Ministry's
reliance on section 6(2) of the Act to deny his request, because BCSC has the
technical and computer expertise "to effectively access requested records
through utilizing its electronic word search programs of its mainframe
computers." He also rejected the Ministry's argument about the costs of such
recovery, because he asked for limited information on the basis of specific
search criteria and he had not received any cost estimates for such access to
his own personal information under section 75 of the Act. It is his view that
the requested search would not unreasonably interfere with the operations of
the Ministry.
In the applicant's view, the "Ministry unreasonably denied my right to access
records within the meaning, spirit and intent of the Act." He seeks a strong
message to the Ministry that the failure to preserve requested records should
not be permitted to happen again. (Reply Submission of the Applicant, p. 10)
5. The Ministry's case
The Ministry argues that it has acted properly and with respect to both the
spirit of the Act and my Orders in handling this request. However, because
this applicant requested deleted e-mail, it questions my jurisdiction and
authority to review the matter. (Submission of the Ministry, paragraphs 5.2,
5.4) I discuss this jurisdictional issue below. I have also dealt separately
with the applicant's complaint.
6. The intervenors' cases
The B.C. Civil Liberties Association (BCCLA) urged me not to disturb the
decision of the Ministry in this case, on the basis of my Order No. 73-1995,
December 21, 1995, but encouraged me to participate with other appropriate
bodies "in developing guidelines to aid those public bodies which provide
e-mail facilities in distinguishing institutional documents from private
communications." Its view is that the distinction between public documents and
private communications is far from clear. I discuss this matter further
below.
The BCCLA is also concerned that the applicant's request does not clearly seek
only information associated with this applicant on the series of topics he is
concerned with: "Otherwise, it is, on its face and in plain language, a
request for access to records that could well have absolutely nothing to do
with [the applicant's] case, but could have serious consequences for the
privacy of both the subjects and those discussed by them in connection with the
list of topics."
The Chief Information Officer for the province also intervened in this inquiry
in support of the Ministry's several positions, as did the Commissioner for the
Public Service Employee Relations Commission (PSERC). Both asserted that
deleted e-mail is not a record under the Act, and that therefore the subject
matter of this review is beyond my jurisdiction. I have discussed below
several other points made by PSERC.
7. Discussion
My jurisdiction in this matter
The Ministry makes the interesting argument that there is no record in dispute
in this inquiry, because no record exists and, it argues, I can only deal with
"what are records under the Act." (Submission of the Ministry, paragraph 4.1)
Its point is that the former "records" were deleted in electronic form. My
view is that I do have jurisdiction over the disposition of what may have been
records under the Act at the time of a request for them. Moreover, the
Ministry itself admitted in its main submission that the requested record may
indeed have existed on a backup tape of deleted electronic mail held by BCSC.
(Submission of the Ministry, paragraph 4.3) In fact, the Ministry responded to
the applicant on November 1, 1995 by saying that it could not create the
record, relying on section 6(2) not to have to do so. I have jurisdiction to
determine whether a public body has complied with its duties under section 6.
I wish to deal directly with the Ministry's contention that the request for
access in this inquiry is for information that is not a record. The applicant
asked for backup tapes that the Ministry states "are not a record in the
custody or under the control of the Public Body. Deleted information is not a
record." (Submission of the Ministry, paragraph 5.4) In Order No. 73-1995,
December 21, 1995, p. 5, I generally accepted the premise that deleted e-mail
is no longer a record under the Act on the basis that specific information
cannot be easily recovered from a "disaster recovery" backup system. The point
in the present inquiry is not that the record does not exist today, but that it
likely did exist at one point in time. I have jurisdiction to determine
whether, in this case, the deleted e-mail was a record at the time of the
original request and whether it was accessible in its deleted form.
Thus I am unpersuaded by the Ministry's various arguments to the effect that I
do not have jurisdiction in this matter. Its position, and that of the
government intervenors, could encourage illicit or premature destruction of
electronic records in particular so that access to information requests under
the Act could not be satisfied.
Some matters of definition for electronic records
Confusion is occurring because of the different definitions that are in use
for the terms: "delete," "backup," and "archive."
Delete means to strike out, obliterate. In my opinion, "delete" means
there must be a conscious, legitimate act to remove a record from existence.
It does not mean simply pressing the delete key on one of the government's
e-mail systems. Such an action simply places your e-mail in a "Wastebasket"
folder, at least for some government systems. The intention of the wastebasket
is to allow you to "change your mind." In the plain English meaning of the
word "delete," the user has not in fact deleted the record. A knowledgeable
user will not only delete a record but also empty his or her wastebasket (or
equivalent terminology if such a service exists) to ensure that a record has
been thoroughly destroyed. An analogy can be drawn from the handling of paper
records. If a person throws something in his or her wastebasket, whether
physical or electronic, it is still there and it can be recovered during a
short period, perhaps a day or a week, until it is removed and destroyed.
Backup means the copying of an electronic record onto tape, or other
medium, for purposes of preservation. This word does not exist outside of the
computer systems arena. The intention of a backup tape is to restore a system
after a crash. If there is no easy way to recover an individual file, then it
is a backup. Custodians of records under the Act need to be able to answer the
following questions in order to determine the retrievability of a record that
may exist on a backup tape. Can one identify which tape an individual file is
on? Is it stored on the backup medium sequentially? Does recovery call for a
systems rebuild, or can the "backup" program deliver the file individually? Is
the backup medium reused according to a predetermined backup schedule, or is it
reused according to a document retention period?
Archive means a place for storing electronic records. The definition of
archive assumes that the intention is to keep a historic record of the
transactions associated with business so that one can refer to them at a later
date. These records would normally contain only the material one wished to
keep. A request for the letter that a user wrote to Bob Smith on
January 15, 1994 would be easy to find and deliverable by the archive
software that created it, if it has been consciously archived. It may be kept
forever or for a specific retention period based on the value of the document.
It would not be kept for a period dependent on a backup schedule designed to
ensure the complete system could be recovered in the event of a disaster, or
the random selection of tapes from a shelf.
The requirement to produce deleted electronic mail
The Ministry is on solid grounds when it interprets Order No. 73-1995 to the
effect that there is no legal obligation on a public body to restore deleted
e-mail "at least under normal circumstances," to quote the language of the
Order No. 73-1995, p. 7. (Submission of the Ministry, paragraph 5.6) At the
time of the applicant's request, the Ministry had no policy in place to provide
guidance about retrieving and holding backup tapes. Order No. 73-1995 had not
been released. Thus the Ministry did not present a specific rationale for why
it should not have sought to recover the deleted e-mail in the present case at
whatever point and in whatever place it may have existed for its specific
system of backup. The applicant pointed out the Ministry's lack of empirical
substantiation of its entire section 6(2) argument. (Reply Submission of the
Applicant, p. 4) Thus the Ministry did not advance evidence about the
backup system it used, but it did make assertions in its submissions. Counsel
stated that the Ministry's electronic mail operates on the VAX system, where
there is no way of determining if a user-deleted e-mail message is still on the
system or backup tape. It was submitted that retention of backup tapes would
have been "a great expense." These assertions should have been supported by
affidavit evidence. While I have reservations about the lack of evidence in
this case, I have concluded that the Ministry was not required to create a
record under section 6(2) in the circumstances of this case.
The applicant's complaint: the retrievability of deleted
e-mail
The applicant has basically complained that the Ministry failed to retain any
of the backup tapes for electronic mail in existence at the time of his
original request. When the Ministry was asked in January 1996 by my Office if
such backup tapes were available and could be retrieved, the answer was that
they were not available. (Submission of the Ministry, paragraph 5.11) I am
not comfortable with the Ministry's attempted reliance on Order No. 73-1995 for
confirmation of its initial inaction on this matter, since that Order was
released December 21, 1995, after the applicant made the initial request.
If an applicant requests "deleted" electronic records, then a public body
should preserve any records in place until the empirical and legal issues of
their retrievability are addressed. It may be, for example, that recovery, as
in the All-in-One e-Mail system, is as simple as retrieving the record from the
electronic wastebasket. This is an empirical matter, since the passage of a
day or a week destroys deleted e-mail to make it fully non-retrievable.
The applicant made his original request on October 12, 1995, which, upon
receipt and processing, should have preserved any extant records, if they
existed, whatever their format, provided this was technologically feasible.
The Ministry now seems to interpret its refusal letter to the applicant of
November 1, 1995 as at least implying that the records sought did not exist:
"Had the record existed the Public Body would not have claimed that it was
incapable of creating the record."
In the present inquiry, the records were kept on a VAX e-mail system
maintained by the former BCSC for the Ministry rather than the IBM system that
was in place in Order No. 73-1995. (Submission of the Ministry, paragraph
5.14) The Ministry states:
Under the VAX system there is no way of determining if a user-deleted
electronic mail message is still on the system or on a back-tape [sic].
It solely depends on when the mail is deleted. Under the VAX system, backup
tapes are maintained on a shorter schedule than under the IBM system. For
example, after 94 days any backup no longer exists. If any deleted electronic
mail did happen to be captured by a backup, after 94 days it would be gone.
(Submission of the Ministry, paragraph 5.15)
My concern is whether an applicant mounts a credible argument for the recovery
of
e-mail during the ninety-four day retention period under this particular
system. There is generally no obligation to retrieve specific information from
backup tapes. But as technology progresses, and depending on the systems
involved, there may be cases where an applicant can reasonably expect such a
search to be made. Similarly, a public body should establish whether the costs
of such recovery are reasonable and feasible under the standards of
section 6(2) of the Act; it has not done so to my satisfaction in the present case.
Clearly, cost can be a significant factor militating against an effort at
recovery.
The issue in this complaint is not whether the Ministry was under an
obligation to retain backup tapes of deleted electronic mail, but whether any
such records existed in an accessible format when the Ministry received the
applicant's original request, and whether the recovery of whatever the
applicant wanted was still feasible under the criteria set out in section 6(2).
(Submission of the Ministry, paragraph 5.18) The applicant cited the one-page
guidance on managing e-mail issued by the Ministry on May 16, 1996, which
states that "E-mail messages stored on the system are subject to FOI requests -
even if the information is considered transitory or of temporary usefulness.
As long as the information exists, FOI applies." (Reply Submission of the
Applicant, pp. 3, 4, and Exhibit B) I agree with the Ministry's statement on
this point.
The applicant has also relied on a draft action plan on e-mail, dated
September 19, 1995, from the then B.C. Archives and Records Services (BCARS).
It states clearly that a policy should allow access to backup tapes as records
under the Act, including deleted messages stored on backup tapes. For example,
"BCARS concluded that records could not be considered destroyed until they were
physically destroyed or, for electronic records, irretrievable." The applicant
concludes that the items he has quoted "clearly defined that the government has
ownership and responsibility of electronic records, included deleted e-mail
records." (Reply Submission of the Applicant, p. 5) The government's response
is that this draft policy did not become official policy. Ironically, the
applicant made a similar argument about other draft policy that the Ministry
relied on. (Reply Submission of the Applicant, p. 7; Reply Submission of the
Ministry, p. 2) This battle of draft policies primarily reflects the unsettled
state of law and practice in this domain under the Act. The operative point is
the need for government policy. But I agree that final policy is what
should guide a public body in these circumstances.
The applicant has also relied on Section C.3.7, p. 5 of the Freedom of
Information and Protection of Privacy Act Policy and Procedures
Manual, prepared by the government, which states:
Public bodies do not dispose of any records relating to a request after it is
received, even if the records are scheduled for destruction under an approved
schedule. This includes any transitory records which may exist at the time the
request is transmitted.
His argument is that the Ministry's lack of action on his original request was
in direct violation of this requirement.
The retrievability of deleted records
With respect to the general issue of the retrievablity of deleted records, I
am persuaded by the evidence provided by the Ministry in an affidavit, but not
argued in its submissions, that the applicant's request would have required a
sizable search of six months of deleted electronic mail on backup tapes held by
BCSC, which was beyond its normal hardware, software and technical
capabilities. (Affidavit of Merv Scott, paragraph 3) However, the Ministry
made no attempt to ascertain the existence of backup tapes until January 25,
1996, when it learned that such tapes had most likely been written over.
(Affidavit of Merv Scott, paragraph 8) It asserts that it was acting in
accordance with draft government policy in not attempting to search for the
backup tapes at the time of the original request. In retrospect, I find this
regrettable, since a public body should discover whether responsive records
indeed exist in any format as soon as possible after an access request is
received.
In Order No. 73-1995, I accepted the "basic premise" that deleted e-mail is
not a record under the Act, when it can be located only on a backup system. My
qualification was, and is, the ease of recoverability of such a record from a
wastebasket facility or, less likely, a backup tape. In this case, we do not
know the whereabouts and retrievability of any "deleted" records at the time of
a request that asked specifically for them.
I am of the view that, in future, recordkeepers should ascertain whether
records exist in whatever form when an applicant specifically requests deleted
records and then establish whether section 6 of the Act requires them to
attempt recovery of such materials. The relative impact of what is at stake is
a relevant consideration here, as I pointed out in Order No. 73-1995, pp. 9,
10. If there is doubt about the possibility or necessity of retrieval of
records, they should be preserved until the matter has been resolved in
compliance with section 6.
The applicant's in camera submission
The Ministry objects to the fact that a small portion of the applicant's
submission was made in camera. (Reply Submission of the Ministry, p. 1)
Having reviewed the material in question, I find that the submission was made
appropriately in the circumstances of the sensitive personal information that
the applicant wished to share with me and not with the Ministry. I intend to
be as tolerant of in camera submissions by applicants as I have been of
those made by public bodies, even though I encourage all parties to use them
sparingly.
The mootness of the issue
As noted above, I would have liked to receive empirical data from the Ministry
as to whether an item in its "backup" system is recoverable in a relatively
easy manner. However, since the records originally requested do not now exist,
and may never have existed, I do not see the utility of obtaining such evidence
now. But other public bodies contemplating a section 6(2) argument are
reminded of this necessity.
The distinction between private communications and public
documents
As noted above, John Dixon, Secretary to the Board of Directors of the BCCLA,
raised some important issues about the need to examine archived voice-mail and
e-mail held by public and private institutions in terms of whether it is truly
public or private with respect to the Act, that is whether they are
institutional or private documents. He refers particularly to records
generated by employees of public bodies using modem communications from their
homes:
This is not to say that any and all e-mail communications within institutions
are private, or ought to be treated as private, or as not forming part of the
working documentation on the institution. It is, rather, to say that the
distinction between institutional documents and private communications
is, for now at least, fuzzy, and individuals ought, in this unresolved
environment, be able to protect their own--and others'-- privacy by deleting
e-mail they do not wish to be subject to access by a search of institutional
records.
I agree with the BCCLA's identification of the problem:
Protocols may need to be developed in order to ensure that the use of
electronic media of communication do not evolve in ways that undermine the
goals sought by access to information and privacy statutes and commissions...
Users of electronic media may need to be sensitized to the extent to which
their communications are accessible to others both in real time and as a result
of some future search.
The BCCLA urges me to take a lead in coordinating such efforts. I will attempt
to deal with aspects of these issues in Orders such as this one and also
encourage the Chief Information Officer of the province to continue his
coordinating activities in this regard. For this purpose, I will send the
BCCLA's submission directly to the Chief Information Officer.
The submission of PSERC made comparable points, although it appears to regard
some of them as settled rather than problematic. Thus I regard the following
statements as requiring further inquiry and deliberation in terms of
establishing government policy on deleted electronic records, including e-mail,
as my discussion above has indicated:
Retrieval of stored e-mail is costly because the record is not easily found.
Government has no statutory or other requirement to save or restore electronic
e-mail.
In practical terms, e-mail is considered to be on the communication continuum
between conversation and document. As the Employer, we presently respect our
employees' right to privacy on the telephone (i.e. we do not tape and record
phone conversations, for example).
We also wish to point out that the interpretation of `record' versus
`transitory document' will vary between public bodies as it is determined by
the nature of their business, and we believe it is vital to recognize those
differences.
...An e-mail which has been deleted at the end of the business day, is not
captured by a backup system. Once restored, the system will not know that a
record does not exist until what does exist has been determined. There is no
guarantee that deleted e-mail is even on the system especially if deleted prior
to a backup.
Conclusion
When a request for access is received, a public body has an obligation under
section 6 of the Act to locate any records, manual or electronic, that are
responsive to the request. For electronic records, this should include extant
data that have been deleted from a system but are still readily retrievable,
and records on archive or backup tapes that are also readily retrievable
without excessive efforts. I realize that the latter two categories may not be
very common in actual practice, given the current state of recovery software
and backup systems. But as I recognized in Order No. 73-1995, the pace of
technological change is breathtaking. Public bodies have an obligation to try
to ensure that applicants receive any records that they are entitled to when an
access request is actually received.
But I reiterate that unless a particular e-mail system in fact makes it
relatively easy to retrieve deleted records from a wastebasket or archived or
backup tapes, then there is no obligation on a public body to make the effort
under section 6 of the Act. See Order No. 73-1995.
Submission of the mediation record to an inquiry
The Ministry included in its submission excerpts from a letter from a
Portfolio Officer who attempted to mediate this request for review. The
applicant did not object to this but stated that he did not have the "legal
education nor experience" to assist in determining whether the referenced
letter from the Portfolio Officer should be reviewed by the Commissioner. He
also indicated that "all relevant evidence should at least be considered by the
Commissioner." I interpret his statements to mean that he would be content for
me to determine whether or not I should review this information. The policies
and procedures of my Office do not allow a party to include in a submission any
record generated by my Office during the mediation process, unless that party
has obtained the written consent of the other parties to do so. This policy is
based on the principle that mediation is a separate process which requires that
information passing among the parties and the mediator be kept confidential.
The rationale for this is, first, to ensure candour and the best opportunity
for settlement and, second, to ensure that I am not influenced in my decisions
in a subsequent inquiry by the opinions of my staff. Where the parties agree
that this information ought to go before the Commissioner, as in the present
case, the rationale for the policy no longer applies.
In this inquiry, while the applicant did not explicitly consent, he did
express the view that I should "maintain a level of administrative flexibility
in determining relevancy or admissibility of records." Thus I have considered
the entire submission of the Ministry in this case. However, I strongly
encourage all parties in an inquiry to comply with my Office's policy before
including any such material in a submission.
8. The complaint
I find that the Ministry failed to consider whether it could retain any of the
backup tapes in existence at the time of the applicant's request. Thus the
complaint has, in part, been substantiated. To ensure that these issues are
addressed at the time a future request for information is made, I request the
Ministry to develop appropriate policies for these
e-mail issues.
9.
Order
I find that the Ministry of Agriculture, Fisheries and Food was not required
to create a record under section 6(2) of the Act and thus was authorized to
refuse access to the records requested by the applicant.
Under section 58(2)(b) of the Act, I confirm the decision of the Ministry of
Agriculture, Fisheries and Food to refuse access to the records requested by
the applicant.
September 3, 1996
David H. Flaherty
Commissioner