UBC-controlled threat-assessment records fall under public-sector access law, adjudicator rules

Records created by a private contractor for a University of British Columbia threat assessment were under the university’s control and governed by B.C.’s public-sector access law, a privacy adjudicator has ruled. The contractor therefore did not have to provide access through a request under the province’s private-sector privacy statute.

The ruling did not leave the requester without an access route. In Order P26-17, 2026 BCIPC 105, issued September 29, 2026, adjudicator Rene Kimmett found that UBC’s initial statement that it could not obtain records held solely by the contractor was wrong. Public bodies must assess whether they control records held by outside organizations and obtain responsive records they control to answer an access request.

Two statutes, one access route

The individual had asked Protect International Risk and Safety Services Inc. for personal information relating to an assessment it conducted on UBC’s behalf. Protect International said it had created the records as the university’s agent and directed the applicant to make a request to UBC under the Freedom of Information and Protection of Privacy Act, or FIPPA.

The applicant followed that direction but also sought review of Protect International’s refusal. Mediation did not resolve the dispute. UBC was invited to participate in the inquiry and did not file a submission, although it supplied evidence that Protect International included with its submissions.

The threshold question was which statute applied. Section 3(2)(d) of the Personal Information Protection Act, or PIPA, excludes personal information to which FIPPA applies. FIPPA, in turn, applies to records in the custody or under the control of a public body, subject to its statutory limits. This avoids overlapping application of the two laws to the same information.

Protect International bore the burden of establishing that exclusion. Kimmett found that it had raised the issue, was best placed to provide the relevant evidence and should fairly be required to support its position. Once she found FIPPA applied, there was no need to decide whether Protect International controlled the records under PIPA’s own access framework.

Control depended on more than the missing contract

The university’s lawyer provided affidavit evidence that UBC had retained and paid Protect International under a contract to provide threat-assessment support services. The applicant objected that neither the company nor the lawyer had produced the contract or identified a term allowing UBC to direct disclosure of the company’s file.

Kimmett agreed that the contract, or an explanation of whether it addressed control, would have been useful. But a contractual term was only one consideration, not a conclusive answer to whether the university controlled the records.

The non-exhaustive control factors include who created a record and in what capacity, statutory or contractual authority, physical possession, reliance on the record, integration with the public body’s other records, authority over its use and disposal, and its connection to the public body’s functions. Not every factor matters in every case, and control need not be exclusive.

Here, Kimmett accepted that Protect International created or compiled the responsive records while performing its contracted services for UBC. FIPPA’s definition of employee includes a service provider retained under contract to perform services for a public body. The company therefore fell within that definition for FIPPA purposes—a conclusion about this statute, not a general employment-status ruling.

There was also evidence of actual delivery. Kimmett accepted that Protect International gave UBC the assessment report as required by the contract and, when asked, supplied copies of the records in its possession responsive to the applicant’s request. That established UBC’s physical possession and satisfied her that it could regulate the records’ use and that they were integrated with its other records.

Those findings supported the conclusion that FIPPA governed the requested information. Protect International’s successful argument concerned the applicable access statute; it was not a finding that outsourcing placed the records beyond access law.

Public bodies must obtain records they control

The applicant had asked UBC to facilitate access to personal information held by Protect International. Evidence showed that UBC initially responded that it could not collect records held solely by the company. Kimmett found that answer incorrect because the requested records were under UBC’s control for FIPPA purposes.

She explained that a public body receiving a request involving records held by a private organization must consider control even if neither the applicant nor the organization raises it. Where the organization holds responsive records under the public body’s control, the public body must direct it to send those records so the public body can respond openly, accurately and completely.

For private organizations, Kimmett said the appropriate response is to explain their view that FIPPA applies and direct the requester to the relevant public body. Connecting the requester with that body and explaining the basis for the referral would also be helpful.

The applicant told the inquiry that the requested records had not been received from UBC. Kimmett said the applicant could complain to the OIPC or request a review if UBC had not responded or if its response was unsatisfactory.

The conclusion was confined to the statutory route: Protect International was not required to provide the requested personal information under PIPA. The order did not direct automatic, unredacted disclosure by UBC or determine the substance of the threat assessment. Nor does it establish that the applicant has since received the records.