The Information and Privacy Commissioner of Newfoundland and Labrador has instructed Memorial University to reassess its refusal to disclose the employment contract of the Associate Vice-President of Harlow and Global Partnerships — a newly created position at its Harlow campus in the United Kingdom.
The university had withheld the contract in response to an access to information request, asserting it was not subject to provincial legislation due to its governance under UK law.
In Report A-2024-053 dated November 28, 2024, Acting Commissioner Jacqueline Lake Kavanagh found that Memorial University has custody or control of the record, despite the university’s claims to the contrary. The Commissioner recommended that the university conduct a line-by-line review of the employment contract and provide a new response to the applicant within 10 business days.
Background
An individual requested access to the employment contract for the Associate Vice-President of Harlow and Global Partnerships under the Access to Information and Protection of Privacy Act, 2015 (ATIPPA, 2015). This position replaced the former manager role at Harlow Campus, Memorial’s only campus outside Canada.
Memorial University refused access, citing section 40(1) of ATIPPA, 2015, which pertains to disclosure harmful to personal privacy. The university stated that the employee is not a public body employee and that the contract is between a third-party individual and MUN (UK) Ltd., a separate legal entity governed by UK law. Memorial asserted that, for these reasons, disclosure would be an unreasonable invasion of the employee’s personal privacy.
The applicant filed a complaint with the Office of the Information and Privacy Commissioner (OIPC). During the investigation, Memorial refused to provide the contract to the OIPC, maintaining that it did not have custody or control of the record and that UK law prohibits its disclosure.
University’s position
Memorial University argued that the employment contract is not subject to ATIPPA, 2015, as it is not for a public body employee. The university emphasized that MUN (UK) Ltd. is a separate legal entity incorporated in the UK and governed by UK laws. According to Memorial, while MUN (UK) Ltd. is affiliated with the university, it is ultimately owned, directed, and administered independently.
Memorial further contended that releasing the contract would violate UK privacy legislation, specifically the UK General Data Protection Regulations and the Data Protection Act, 2018. The university claimed that disclosing the contract could constitute an offence under UK law and result in reputational harm to both the employee and the Harlow Campus.
Additionally, Memorial asserted it only has “bare possession” of the contract, as the university’s president signed it in the capacity of Chair of MUN (UK) Ltd.’s Board of Directors—not as the university president. Therefore, the university argued it does not have custody or control over the record.
Commissioner’s analysis
The Commissioner examined the relationships between Memorial University, Harlow Campus, and MUN (UK) Ltd. The investigation revealed that Harlow Campus is deeply integrated with Memorial University, despite operational governance by MUN (UK) Ltd.
Key findings included:
Oversight and control: Memorial established MUN (UK) Ltd. in 2016 to operate Harlow Campus on its behalf. The Board of Directors for MUN (UK) Ltd. reports to Memorial’s Board of Regents, which is responsible for approving the campus’s budget and appointing the MUN (UK) Ltd. Board.
Financial integration: Memorial funds Harlow Campus through significant annual operating grants. The Auditor General’s Report noted that funds to support Harlow are expensed as a grant from Memorial.
Governance roles: The President of Memorial is designated as the Chair of MUN (UK) Ltd.’s Board of Directors. Other senior university officials serve as ex-officio directors.
Operational changes: In response to the Auditor General’s recommendations, Memorial created the Associate Vice-President position to replace the former manager role, aiming to ensure the campus’s financial sustainability.
“All of the circumstances surrounding the nature of the relationships between Memorial, MUN UK, and Harlow campus indicate that Harlow campus is inextricably linked to Memorial despite the day-to-day operations being governed by MUN UK,” the Commissioner stated.
Custody or control determination
Applying legal principles from prior cases, the Commissioner concluded that Memorial University has both custody and control of the employment contract. Factors influencing this decision included:
Possession: Memorial acknowledged physical possession of the contract.
Right to possess: The university has a right to possess the contract due to its governance role.
Use and reliance: The contract relates to a core function of the university—the operation of its campus—and Memorial relies on it for oversight.
Integration with university records: The contract is integrated with other records held by Memorial.
Authority over the record: Memorial has the authority to regulate the contract’s content, use, and disposal.
“These factors draw one to conclude that Memorial is entitled to and indeed holds both custody and control of the record,” the Commissioner wrote.
Privacy considerations
Regarding the university’s concerns under section 40 of ATIPPA, 2015, the Commissioner acknowledged that while UK laws prohibit disclosure without consent, the contract is under the jurisdiction of Newfoundland and Labrador’s legislation.
Memorial’s refusal to provide the contract to the OIPC hindered a detailed analysis of whether specific information within the contract should be withheld to protect personal privacy. A line-by-line review is necessary to determine what, if any, information should be exempt from disclosure.
Commissioner’s recommendation
The Commissioner recommended that Memorial University conduct a line-by-line review of the employment contract and provide a new response to the applicant within 10 business days.
“After a review of the submissions of the parties, the legislation, and the specific circumstances in this case, I have determined that Memorial has custody and control of the records the Complainant requested,” the Commissioner concluded.
Memorial University now has to decide whether to accept the Commissioner’s recommendations. Under section 49(1)(b) of ATIPPA, 2015, the university is required to notify the Commissioner and any relevant parties of its decision within 10 business days of receiving the report.
For more information, see Report A-2024-053.
