Decisions

Implementation of a student survey.

• Section 2(1) (personal information) – the information collected through the survey qualifies as personal information.

• Section 28(2) (collection) – the collection of the personal information is in accordance with section 28(2) of the Act.

• Section 29(2) (notice) – the Notice of Collection satisfies the requirements under section 29(2) of the Act.

• Section 31 (use) – the Board’s contemplated uses of personal information are in accordance with section 31 of the Act.

• Section 32 (disclosure) – the Board’s contemplated disclosure of the personal information is in accordance with section 32 of the Act.

• Section 3(1) of Regulation 823 (security) – the Board has reasonable measures in place to prevent unauthorized access to records.

Recommendations:

• None

• Disclosure of confidential report containing complainant’s personal information

• Section 2(1) (personal information) - the report contained personal information.

• Section 32 (disclosure) - the personal information was not disclosed in accordance with the Act.

• Section 3(1) Regulation 823 (security) - the City had reasonable measures in place to prevent unauthorized access to the records.

Recommendations:

• None

• Collection of new customer information from a hydro utility.

• Section 2(1) (personal information) - the information qualifies as personal information.

• Section 28(2) (collection) - the collection of the personal information was not in accordance with the Act.

• Section 31 (use) - the use of the personal information was not in accordance with the Act.

• Section 30(4) (disposal) - the City has properly disposed of the personal information in question.

Recommendations:

• None

• Video Surveillance in the Mississauga Civic Centre

• Section 2(1) (personal information) - the information qualifies as personal information.

• Section 28(2) (collection) - the personal information was collected in accordance with the Act.

• Section 29(1) (notice) - the City has provided notice of collection as required under the Act.

• Section 31 (use) - the City's use of the personal information was in accordance with the Act.

• Section 32 (disclosure) - the disclosure of the personal information was in accordance with the Act.

• Section 3(1) of O.R. 823 (security) - the City had adequate security measures in place.

• Section 5 of O.R. 823 (retention) - the City had satisfactory retention policies in place.

Recommendations:

• none

• Telephone survey of residents of the Township of Wainfleet.

• Section 2(1) (personal information) - the information qualifies as personal information.

• Section 28(2) (collection) - the personal information was collected in accordance with the Act.

• Section 29(2) (notice) - the notice requirement was only partially satisfied.

• Section 3(1) of O.R. 823 (security) - the Region did not have adequate security measures in place.

• Recommendation: In future, the Region should ensure that language is included in purchase authorization documents or contracts providing that all personal information is dealt with in accordance with the Act.

• Fraudulent driver's licence address changes on the ServiceOntario website.

• Section 2(1) (personal information) The records contained personal information.

• Section 42 (disclosure) The disclosure of the personal information was not in accordance with the Act.

• Section 4(1) of O.R. 460 (Security) MGS did not have reasonable security measures in place.

• Recommendations:

1. Continue to develop long-term solutions for online authentication.

2. Develop measures to better detect and report on suspicious changes of address.

• Disclosure of complainants' address by a by-law enforcement officer

• Section 2(1) (definition of personal information) - the address was the complainants' personal information

• Section 32 (disclosure) - the disclosure was in accordance with the Act.

• Information contained in a Report of the Integrity Commissioner for the City of Vaughan

• Section 2(1) (definition of personal information) - the Report contained personal information.

• Section 32 (disclosure) - the disclosure of the personal information was in accordance with the Act.

• E-mails sent to a list of recipients providing information about events.

• Section 2(1) (definition of personal information) - the e-mails contained some personal information.

• Section 38(2) (collection) - the records were not collected under the Act.

• Section 39(2) (notice) - the University was not required to provide Notice of Collection.

• Section 41(1)(b) - the use of the personal information was in accordance with the Act.

• Letters and public meeting documentation posted on City’s website.

• Section 2(1) (definition of personal information) - the information in the public meeting documentation, and in letters A and B, qualifies as personal information.

• Section 32 (disclosure) - the disclosure of the complainant’s identity in the public meeting documentation was in accordance with the Act.

• Section 32 (disclosure) - the disclosure of letter B to the external auditor and on the City’s website was in accordance with the Act.

• Unauthorized access to customer billing records

• Section 2(1) (definition of personal information) - the records in question contained personal information.

• Section 32 (disclosure) - the disclosure of the personal information was not in accordance with the Act.

• Section 3(1) of Regulation 823 (security) - there were not adequate security measures in place at the time of the breach.

Recommendations:

1. Hydro should implement measures to enhance security at the e-bill account creation stage.

2. Hydro should take measures to prevent, limit, and to detect the ability of employees to access lists of all Hydro customers.

3. Hydro should implement robust access controls.

4. Hydro should implement additional mechanisms to detect and limit unusual online account activities.

5. Hydro should repair the software coding that allowed for the unauthorized override of password protections.

6. Hydro should provide a quarterly report to the IPC regarding system enhancements designed to protect customer privacy.

• Posting of a lawn sign in front of a residence indicting that the residence had been the subject of a search warrant for drugs.

• Section 2(1) (definition of personal information) - the information in question was personal information.

• Section 32 (disclosure) - the disclosure of the personal information was not in accordance with the Act.

Recommendation:

• Cease the practice of posting lawn signs in front of homes indicating that those homes have been the subject of a search warrant for drugs.

Unshredded documents set aside for disposal found at courthouse.

The records are subject to the Act.

Section 65(5.2)/52(2.1) (records relating to a prosecution) – does not apply.

Section 2(1) (definition of personal information) – the records contain personal information

Section 37/27 (record available to the general public) – not applicable; the records are subject to the privacy provisions of the Acts.

Section 40(4)/30(4) (disposal of personal information) – some of the disposal methods were not in accordance with the Act.

Recommended that the City of Toronto:

1. Draft a comprehensive policy on records and information destruction.

2. Provide staff training on the policy.

3. Ensure that new staff orientation includes training on privacy protection and the secure destruction of records

4. Ensure that either secure bins or paper shredders are located in all Old City Hall Offices.

5. Ensure that a certificate of destruction is provided by service providers once destruction has taken place.

• Access and correction request relating to records retained by Police concerning the appellant

• 2(1) “personal information” – records contain personal information of appellant and others

• Sections 28(2) and 29(1) (collection) - complied with

• Section 30 (use and retention) - complied with

• Section 32 (disclosure) not complied with

• Section 31 (use) partly complied with

• Recommendation to develop a police reference check program that complies with O. Reg 265/98 and the Charter. Further recommendation to assess the complainant’s police reference check situation

• Complaint concerning Board's video surveillance of employee which captured image of employee's spouse. 

• Section 52(3) (labour relations and employment) applies to exclude the records in question from the application of the Act.

• No recommendations