Toronto was entitled to release portions of a WhatsApp conversation involving its mayor and other Ontario mayors, an Ontario privacy adjudicator ruled, rejecting an advocacy organization’s effort to keep the entire transcript out of reach of access-to-information law.
In Order MO-4832, issued August 26, 2026, Information and Privacy Commissioner adjudicator Chris Anzenberger found that the messages at issue concerned municipal business and were within the city’s custody or control. He also rejected the organization’s claim that the third-party business-information exemption protected them.
The decision upheld the city’s original partial-access decisions. It did not require publication of every word in the 101-page transcript.
City wanted to disclose, chat organizer objected
Three access requests concerned the WhatsApp group chat. The city identified a transcript and decided to disclose parts of it, withholding other information under exemptions in the Municipal Freedom of Information and Protection of Privacy Act.
None of the three requesters challenged those withheld portions. Instead, the advocacy organization that administered the chat appealed, arguing that the whole record should be withheld.
The organization said the mayor was participating as one of its directors, not in a municipal role, and that the conversation concerned its internal governance. It maintained that its own control of the group placed the messages outside the city’s access obligations.
The city disagreed. Its position was that the mayor had provided the record in connection with her responsibilities as the city’s chief executive officer.
Municipal business does not cease to be municipal business in a group chat
The Act applies to records in an institution’s custody or under its control. Either relationship can be sufficient; both need not be established.
Anzenberger examined the messages’ content and their connection to the mayor’s statutory municipal functions. He did not decide that everything a mayor does is necessarily municipal business. Rather, the messages in dispute concerned municipal governance and the mayor’s work in that capacity.
The city’s possession was more than incidental. The messages were on a city device, related to a core municipal function and had been provided to the city for its access response. The organization had not established that it could restrict the city’s use of them.
The city had severed portions that did not relate to Toronto’s affairs. That did not undermine its custody or control over the portions that did relate to the municipality.
Nor did applying the Act to a WhatsApp exchange expand the law’s scope, the adjudicator found. For access purposes, the conversation functioned much like a chain of emails.
Encryption was not enough to establish confidentiality
The third-party business-information exemption requires information of a protected kind, supplied in confidence, with a reasonable expectation of specified harm from disclosure. All parts of that test must be met.
The adjudicator questioned the claim that the organization had “supplied” every message simply because it administered the chat. Messages from other members were not automatically information supplied by the organization, although its own staff’s messages could qualify.
In any event, the confidentiality requirement failed. The organization had not established an express or objectively reasonable implicit expectation that the messages would remain confidential in the city’s hands.
Restricted group membership and WhatsApp encryption did not, on their own, establish that expectation. An organization’s internal information-handling policies also did not automatically bind another institution receiving its messages.
The city had consulted other group members, who agreed to disclosure subject to applicable exemptions. Anzenberger treated that as further evidence against an expectation of confidentiality, without needing to resolve the separate dispute over whose formal consent the Act required.
Because the confidentiality requirement was not met, he did not decide whether the information was of a protected business type or whether the claimed harms would result.
He dismissed the appeal and ordered disclosure in accordance with the city’s original access decisions between September 28 and October 2, 2026. The ruling therefore preserves the distinction between the portions the city agreed to release and the redactions that were not challenged.
