Tribunal Success Stories

Intake Resolutions

The IPC received complaints about a municipality’s switch from paper ballots to internet and telephone voting in the 2018 municipal election. The complainants believed it was a breach of their privacy for the municipality to share their personal information, without consent, with a third party hired to run the internet voting process. The complainants wished to be offered an alternative voting method. The IPC’s analyst determined that the municipality was authorized to disclose the information without consent because it was necessary to facilitate a municipal election, and the third party needed the information to perform its functions. The contract between the municipality and the third party contained provisions addressing the security and privacy of personal information, and the municipality committed to following the IPC’s guidance on additional measures in the future.

• • • • •

A doctor, whose clinic was attached to a pharmacy, abandoned his practice. While trying to locate the doctor, the IPC analyst negotiated with the pharmacy to keep 132 boxes of patient records secure until alternate storage arrangements were made. After learning that the doctor had died, the analyst investigated long-term options and arranged for a storage company to hold and administer the records, allowing the doctor’s former patients to regain access to their files.

• • • • •

A Ministry of Children, Community and Social Services employee accidentally attached a spreadsheet, identifying more than 43,000 clients of the Ontario Disability Support Program, in an email to more than 100 clients. The personal information included the name, client ID number, and email address of each individual. The IPC worked with the ministry to ensure that it took reasonable steps to notify those affected, contain the breach, and prevent a future occurrence. The ministry strengthened password and encryption requirements, developed a comprehensive privacy training plan, and implemented a portal for staff to communicate securely with clients.