WxT Language switcher

Decision pursuant to 6.1, 2026 OIC 33

Date of decision: March 24, 2026

Summary

An institution submitted an application seeking the Information Commissioner’s approval to decline to act on an access request under subsection 6.1(1) of the Access to Information Act. In the institution’s opinion, the access request is an abuse of the right to make a request.

The Commissioner finds that the institution did not establish that the access request at issue is an abuse of the right to make a request.

The application is denied.

Application

Under subsection 6.1(1) of the Access to Information Act, the head of a government institution may seek the Information Commissioner’s written approval to decline to act on an access request if, in the head of the institution’s opinion, the request is one or more of the following:

  • Vexatious;
  • Made in bad faith;
  • An abuse of the right to make a request for access to records.

Institutions may not decline to act on access requests for the sole reason that the requested information was already proactively published under Part 2 of the Act (subsection 6.1(1.1)).

The institution bears the burden of establishing that the access request meets one or more of the requirements under subsection 6.1(1).

If the institution establishes that one or more of the requirements of subsection 6.1(1) apply, the Commissioner must exercise her discretionary power to either grant or refuse the application.

In exercising her discretion, the Commissioner will consider all relevant factors and circumstances, including:

  • The quasi-constitutional nature of the right of access;
  • The public interest in the records sought;
  • Whether the institution met its obligations under subsection 4(2.1) to make every reasonable effort to assist a requester in connection with their request.

Access request at issue

On October 2, 2025, the institution sought the Commissioner’s approval to decline to act on an access request it had received on August 27, 2025. The access request is the following:

Please consider this a request for: 1. All Managers’ Microsoft Teams or other instant messages sent during the noted timeframe. Please exclude personal information and release all otherwise severable material. 2. Any official Microsoft Teams usage and/or retention policies or guidelines. Please contact me if you require any clarification. Timeframe: May 26, 2025 to present day. (Date Range for Record Search: From 5/26/2025 To 8/27/2025).

The institution claimed that the access request is an abuse of the right to make a request.

Is the access request an abuse of the right to make a request?

The Act provides requesters with a right to access information under a government institution’s control—a right that should not be abused.

The Commissioner considers an abuse to have occurred when an access request exceeds the limits of the legitimate exercise of that right. When determining whether a request is abusive, she focuses on the scope, nature and cumulative effect of the request, including the following:

  • Whether the request is repetitive or overly broad;
  • Whether the request was made with a purpose other than obtaining documents or information;
  • Whether acting on the request would overburden the institution and/or obstruct the institution’s ability to respond to other access requests (and, therefore, affect other requesters’ right of access) or both.

The Commissioner may also consider the institution’s efforts, if any, to help the requester determine what information they want and/or narrow the scope of their request. She may also consider the requester’s responses to such efforts, including the extent to which they have demonstrated a willingness to work with the institution.

The institution argued that the access request at issue is an abuse of the right to make a request because it would overburden it.

The institution explained that to better understand the potential scope and impact of the request, it conducted a preliminary “eDiscovery exercise”. The eDiscovery exercise was only able to capture personal chat exchanges between August 17-27 due to the institution’s records retention and disposition policy. As for group chats, channels and meeting chats, the institution explained that its eDiscovery exercise included messages for the full timeframe originally requested. This exercise revealed that 3.32 gigabytes (GB) of data would have to be processed, which is equivalent, according to the institution, to an estimated number of pages ranging from approximately 712,000 to 1.78 million, depending on the amount of non-text content such as images, GIFs, and emojis. The institution further claimed that at a standard review rate of 1,000 pages per month, it would take a single full-time employee between 59 and 148 years to process the dataset.

The institution also explained that Teams chats are not automatically separated during the extraction process, which means identifying and excluding them requires manual review. Each item must be individually assessed by the Access to Information and Privacy (ATIP) officer to determine its relevance to the request. This involves a careful examination of both content and context to ensure that only responsive records are considered for potential disclosure.

Additionally, the institution claimed that because employees may use Teams to exchange personal and/or informal messages, the samples examined involved a mix of personal and professional conversations. This, the institution claimed, makes the processing of the request more complex.

The institution also stated that the request targets managerial communications which include personal or sensitive information in regard to ATIP staff who cannot process requests involving their own personal information (per the Directive on Conflict of Interest). This also adds an element of complexity to the request and would require employees who are not experienced in processing access requests to work on this request with the risks that this entails.

According to the institution, the volume of the request is not only operationally impossible to process based on its current resources, but would also severely disrupt its ability to fulfill its statutory obligations under the Act. With only two full-time employees in the ATIP unit, dedicating resources to this request would delay responses to other requests, increase the risk of non-compliance with legislated timelines, and compromise the institution’s duty to assist other requesters. The institution explained that in the 2023–2024 fiscal year its ATIP office processed 67,459 pages in response to formal and informal Access to Information and Privacy requests. The scope and estimated volume of the current request far exceed the typical demands placed on the institution’s ATIP unit.

Finally, the institution explained that it made multiple efforts to assist the requester in clarifying and narrowing the scope of the request. Initial outreach occurred on the day the request was received by telephone, followed by continued engagement through written correspondence and detailed responses to specific questions. The institution provided explanations regarding data availability, retention periods, and the operational impact of the request. The institution argued that, despite these efforts, the requester maintained a broad scope that remains unmanageable.

Discussion

The Commissioner will now consider whether the institution has established that the access request is an abuse of the right to make a request.

The requester argued that the estimate the institution has put forward is so voluminous that it defies all logic. According to the requester, the institution estimated that the narrowed request would yield between 712,000 to 1.78 million pages for the period from August 17-27. On the requester’s calculation, this would mean that 24 employees generated between 71,200 and 178,000 pages of content per day – equivalent to between 124 and 309 pages per employee per hour, around the clock.

The requester also argued that the institution overestimated the number of pages contained in a gigabyte. They claimed that according to estimates available online, 1 GB can hold roughly one of the following:

  • 15,000 pages with images, or
  • 64,000 Microsoft Word pages, or
  • 677,000 plain text pages.

The requester argued that providing plain text pages is not the norm, and therefore that the institution’s estimate that 1.43 gigabytes would total 712,564 pages is divorced from reality. They also provided Teams message data from other federal departments to further demonstrate this point.

The Commissioner agrees with the requester that the institution’s estimate is not credible, albeit for the reasons below.

First, the institution’s methodology for estimating the number of pages is inherently flawed. Even considering that the retrieved records include all group chats, channels, and meeting chats involving both managers and other employees over a three‑month period, the estimate remains implausible. Even if all roughly 178 employees of the institution were included in the data, the estimates imply that each employee generated on average 42 to 106 full pages of instant messages per day during the 3-month period. This is unrealistic. While the Commissioner has no reason to doubt that 3.32 GB of data would have to be retrieved, it does not reasonably follow that this data represents anywhere near 712,000 to 1.78 million pages of instant messaging content generated over the relevant period.

Second, the institution’s page‑count estimates—712,000 at the low end and 1.78 million at the high end—are specious, because they rely on the proportion of non‑textual content without accounting for the fact that the digital storage space required for different content types differs by orders of magnitude. GIFs (Graphics Interchange Format – a popular file format that supports both static and animated images, often looping continuously) and images require storage space in the kilobyte to megabyte range, whereas plain text is typically measured in bytes. Put differently, a single GIF or image can take 100 to 100,000 times more space than a plain‑text sentence. As a result, the institution’s low‑end estimate of 712,000 pages—derived from assuming that 60% of the 3.32 GB dataset is non‑textual content—would correspond to a very small number of actual non‑textual exchanges in Teams. The institution’s arbitrary, space‑based estimates are therefore unjustified and counterintuitive. The institution also previously advised the requester that the dataset includes attachments, which likewise consume far more space than text.

Third, the institution’s method for processing the request portrays the documents review task as far more complicated than it needs to be. Specifically, the institution indicated that it must manually review all retrieved records to exclude non-responsive content. This, the institution argues, requires a careful examination of both content and context to ensure that only responsive records are considered for potential disclosure under the Act.

In reality, the request concerns messages sent by 24 managers over a three‑month period. There are only ten days’ worth of personal chat logs and approximately three months of group chat content. Personal chats will, by their nature, contain many messages sent by managers. These can be manually reviewed to determine responsiveness and assess whether they may be disclosed under the Act. Group chats, meeting chats, and channels may also include manager messages, but a keyword search for each manager’s name is sufficient to identify potentially responsive content which can then be manually reviewed. The Commissioner sees no need to manually review all the retrieved records.

Fourth, the institution’s estimate of the number of years required to process the request is unreliable not only because it is based on an inflated page count, but also because it blindly relies on the number of records to be retrieved without considering how non-responsive records could be excluded.

In the context of an application under subsection 6.1(1), institutions can rely on the number of records that would have to be retrieved, rather than the number of responsive records (see e.g, 2024 OIC 78). Doing so allows institutions to take into consideration the work required to exclude non-responsive records from the retrieved records. However, while the work required to exclude non-responsive content is relevant, it does not always have a material impact on overall processing time. That is the case here: Teams messages appear in chronological order and clearly identify both the sender and the date, enabling a substantial portion of non‑responsive material to be screened out quickly.

Finally, regardless of the institution’s calculations or methodology, it is incongruous that retrieving and reviewing instant messages sent by 24 managers over a three‑month period would require a minimum of 59.4 years and up to 148.5 years.

Based on the above, the Commissioner is not satisfied that the request would overburden the institution. She concludes that the institution has not demonstrated that the access request at issue amounts to an abuse of the right to make a request.

Decision

The institution has not established that the access request met one or more of the requirements of subsection 6.1(1).

Therefore, the application is denied.

Date modified:
Submit a complaint