Dernières décisions

The Information and Privacy Commissioner/Ontario received two related complaints under the
Municipal Freedom of Information and Protection of Privacy Act (the Act). The complainants are the same in both cases and are parents whose son had been a student with the Toronto District School Board (the TDSB).

After their son had ceased as a student with the TDSB, the complainants applied to enrol their son in a school within the Toronto Catholic District School Board (the TCDSB). While the request for admission was being considered, the receiving school’s Vice-Principal contacted his counterpart at the son’s former school to obtain information in order to verify the son’s academic status and to assess whether the receiving school could meet his program needs. This contact was made by telephone.

The bases for the complaints are that a) the TCDSB should not have sought information about the son from the TDSB without the written consent of the parents and b) the TDSB should not have provided information about the son to the TCDSB without the parents’ written consent. The complainants maintain that these actions were contrary to the privacy provisions of the
Act.

Decisions in Privacy Complaint Nos. MC-030029-1 and MC-030029-2 have not been published

Decisions in Privacy Complaint Nos. MC-030028-1 and MC-030043-1 have not been published

An article appeared in a Toronto newspaper about a web site that provides school bus schedule information. Although designed to help with school bus scheduling in York Region, the article suggested it was “giving out kids’ info” and “stirred up fears about children’s safety”. As a result of privacy concerns and the related safety issues raised by the article, the IPC initiated a privacy investigation under the Act with respect to the information being disclosed on this web site. The investigation found that the web site and related phone system disclosed personal information, and that these disclosures are not authorized by section 32 of the Act. In addition, these disclosures have the potential to seriously threaten the safety of students. The IPC recommended both be dismantled.

An article appeared in a Toronto newspaper about a web site that provides school bus schedule information. Although designed to help with school bus scheduling in York Region, the article suggested it was “giving out kids’ info” and “stirred up fears about children’s safety”. As a result of privacy concerns and related safety issues raised by the article, the IPC initiated a privacy investigation under the Act with respect to the information being disclosed on this web site. The investigation found that the web site and related phone system disclose personal information, and that these disclosures are not authorized by section 32 of the Act. In addition, these disclosures have the potential to seriously threaten the safety of students. The IPC recommended both be dismantled.

The appellant wrote to the Leamington Police Services Board (the Police) seeking access under the
Municipal Freedom of Information and Protection of Privacy Act (the Act) to records relating to criminal charges brought against him. The Police failed to respond to the request within the 30 day period required by the Act, and the appellant appealed this “deemed refusal” to this office. During the mediation stage of the deemed refusal appeal, the Police wrote to the requester advising that they were providing partial access to the requested records, and enclosing an index of records. The Police claimed the application of the exemptions at sections 8 (law enforcement) and 14 (personal privacy) as the basis for withholding records in whole or in part. In particular, the Police cited sections 8(1)(g) and 8(2)(a), as well as sections 14(1)(f), 14(3)(a) and 14(3)(b). As a result of this decision, the deemed refusal appeal was closed.

The Office of the Public Guardian and Trustee (OPGT) notified the Office of the Information and Privacy Commissioner/Ontario (the IPC) of an incident involving misdirected faxes. Specifically, the Toronto Community Housing Corporation (TCHC) received a fax sent by the OPGT, and others, intended for the Ministry of Community and Social Services, now the Ministry of Community, Family and Children's Services (the Ministry).

The OPGT advised that it had faxed a special needs application to the Ministry's Ontario Disability Support Program (the ODSP). The fax was sent to the number provided by the ODSP Special Needs office. However, the next day, the TCHC telephoned the OPGT to advise that it had received this faxed document and as well as a number of similar documents intended for the ODSP.

In total, there were five faxes sent by various sources during the course of the day that were intended for the ODSP but which were received by TCHC instead. As mentioned above, one of these faxes was sent by the OPGT. The remainder consisted of a fax sent by a Ministry employee from a different location; faxes sent by two ODSP clients; and a fax sent by a private company. The following is a brief description of each of these faxes:

1. Fax sent by the OPGT consisted of a special needs application form and included an ODSP client's name, date of birth, OPGT file number, and the need for replacement glasses (1 page).

2. Fax sent by a Ministry employee consisted of a cover page with an ODSP client's name on it (1 page), a financial statement of entitlements for the client (2 pages), and a memo advising of re-admittance of the client to a mental health centre (1 page).

3. Fax sent by an ODSP client consisted of the client's earnings statement, description of her current medication, and timelines for back-to-work possibilities (2 pages).

4. Fax sent by another ODSP client consisted of his name, his wife's name and a reassessment decision regarding the status of his disability (1 page).

5. Fax sent by a private company pertained to the amount of rent paid by two ODSP clients, and contained the address and date of birth of one of the clients (2 pages).

As a result, three privacy complaints were initiated by the IPC involving the OPGT, the Ministry and the TCHC.

...

The Office of the Public Guardian and Trustee (OPGT) notified the Office of the Information and Privacy Commissioner/Ontario (the IPC) of an incident involving misdirected faxes. Specifically, the Toronto Community Housing Corporation (TCHC) received a fax sent by the OPGT, and others, intended for the Ministry of Community and Social Services, now the Ministry of Community, Family and Children's Services (the Ministry).

The OPGT advised that it had faxed a special needs application to the Ministry's Ontario Disability Support Program (the ODSP). The fax was sent to the number provided by the ODSP Special Needs office. However, the next day, the TCHC telephoned the OPGT to advise that it had received this faxed document and as well as a number of similar documents intended for the ODSP.

In total, there were five faxes sent by various sources during the course of the day that were intended for the ODSP but which were received by TCHC instead. As mentioned above, one of these faxes was sent by the OPGT. The remainder consisted of a fax sent by a Ministry employee from a different location; faxes sent by two ODSP clients; and a fax sent by a private company. The following is a brief description of each of these faxes:

1. Fax sent by the OPGT consisted of a special needs application form and included an ODSP client's name, date of birth, OPGT file number, and the need for replacement glasses (1 page).

2. Fax sent by a Ministry employee consisted of a cover page with an ODSP client's name on it (1 page), a financial statement of entitlements for the client (2 pages), and a memo advising of re-admittance of the client to a mental health centre (1 page).

3. Fax sent by an ODSP client consisted of the client's earnings statement, description of her current medication, and timelines for back-to-work possibilities (2 pages).

4. Fax sent by another ODSP client consisted of his name, his wife's name and a reassessment decision regarding the status of his disability (1 page).

5. Fax sent by a private company pertained to the amount of rent paid by two ODSP clients, and contained the address and date of birth of one of the clients (2 pages).

As a result, three privacy complaints were initiated by the IPC involving the OPGT, the Ministry and the TCHC.

The Workplace Safety and Insurance Board (the WSIB) notified the Office of the Information and Privacy Commissioner/Ontario (the IPC) about a breach of the Freedom of Information and Protection of Privacy Act the Act). The WSIB advised the IPC that a client (client #1) who had requested access to his own WSIB claim file had also received documentation from another individual's claim file (client #2). As a result, a privacy investigation was initiated by the IPC.
In a follow-up letter to this office dated November 15, 2001, the WSIB's FOI Coordinator explained that, in May 2001, the WSIB had sent client #1 a copy of his own claim file, but had inadvertently attached a copy of an unrelated file belonging to client #2. Upon notifying an adjudicator of this incident, client #1 was advised that the documents were confidential and must be returned to the WSIB immediately, and that a WSIB investigator would be sent to retrieve the entire package. Client #1 advised that he would prefer to return the package to the WSIB's office on the following day, and subsequently met with the access manager who reviewed the entire file and removed all documentation relating to client #2.
Approximately six months later, client #1 advised the adjudicator that he had kept a copy of the documents relating to client #2. At this time, the adjudicator contacted the FOI Coordinator who then initiated an internal investigation and notified the IPC.

SUMMARY OF COMMISSIONER-INITIATED COMPLAINT: The Office of the Information and Privacy Commissioner (the "IPC") received a telephone call from the London Police Service ("London Police") regarding a possible disclosure of personal information. More particularly, London Police advised the IPC that it had accidentally released to a requester, a copy of a document containing the personal information of individuals other than the requester. On the basis of this telephone call, the IPC initiated an investigation under the Municipal Freedom of Information and Protection of Privacy Act (the Act). DISCUSSION: During the investigation, the following information was obtained as a result of discussions with the London Police's Freedom of Information Coordinator ("FOI Co-ordinator") and written materials provided to our office. Background London Police had received a request under the Act for a copy of an occurrence report. The individual requesting the report (the "requester") indicated to London Police that he was only interested in the information in the report that pertained to him and that he was not interested in information pertaining to other individuals. As a result, London Police decided to release to the requester a severed version of the report, deleting the personal information of individuals other than the requester. Having prepared the severed version of the report, London Police subsequently notified the requester that his records package was ready and that he could come by any time during office hours to pick up the package. London Police's procedures require that the Freedom of Information Analyst (the "FOI Analyst") place the records being released to a requester in an envelope together with the decision letter, and then place the envelope in the bottom shelf of the filing cabinet. The procedures also require that the person retrieving the package from the filing cabinet check the contents of the package to ensure that what is being released is in fact the severed copy. In this case, when the requester attended at London Police's office to pick up his package, it was lunch hour and both the FOI Co-ordinator and FOI Analyst were out of the office. An individual from the Records Department, who fills in at reception when the usual back up person is not available, was handling the reception desk. When the receptionist went to retrieve the package from the filing cabinet, she found the requester's file containing both the severed and unsevered report, but no records package for the requester. The receptionist tried to contact the FOI Analyst at home, but could not reach her. She also tried to contact the individual who usually fills in at reception, but could not reach her either. The receptionist ultimately decided to prepare the records package herself, rather than ask the requester to wait or return later. She placed both the unsevered and severed copy of the occurrence report in an envelope, which she then gave to the requester. The FOI Analyst and Co-ordinator learned of the error when they returned to the office about an hour later. Steps Taken by London Police Upon learning of the error, the FOI Co-ordinator immediately instructed the FOI Analyst to call the requester and advise that they would be sending a police officer to the requester's residence to retrieve the package. Upon receiving the call, the requester volunteered to personally return the package. About 30 minutes later, the requester attended at London Police's office and returned the package. The FOI Co-ordinator also contacted the IPC that same day to advise of the incident. In a follow up conversation the next day, the IPC suggested that the FOI Co-ordinator specifically ask the requester whether he had viewed or had copied the unsevered document and whether he would be willing to swear an affidavit. The FOI Co-ordinator later called the requester, who advised her that he had neither viewed nor copied the documents and further indicated that he was willing to swear an affidavit to that effect. The requester did later swear an affidavit, stating that during the time the documents were in his possession and prior to returning them to London Police, they remained in his personal automobile and that he did not have the opportunity to view them. London Police indicated that based on this affidavit, no personal information had been disclosed to the requester and no benefit would be served in notifying the individuals whose information had been contained in the report. In addition to the above steps, the FOI Co-ordinator obtained reports from

SUMMARY OF COMPLAINT: The complainant owned property in the Municipality of Bayham (the Municipality) and was allegedly in arrears of property taxes. The Municipality initiated formal proceedings to collect the arrears owing. The complainant claims that in December of 2000 she became aware that a Final Notice of Registration of Tax Arrears Certificate (final notice) and Tax Arrears Certificate - Document General (certificate) was sent to a law firm that had formerly acted for the complainant and her husband. The final notice and certificate (which I will refer to collectively as the "notice") contained information pertaining to the property, including the address, a legal description of the property, the assessment roll number and the amount allegedly owing in tax arrears. The notices do not contain the complainant's name. Upon further inquiry, the complainant discovered that the Municipality had sent out notices to 13 addressees. The addressees consisted of parties that the Municipality believed had an interest in the property including the complainant, the complainant's spouse, mortgagees, mortgage guarantors and various law firms. Of these, the complainant contends that only five had any interest in the identified property, and would thereby be entitled to receive such notices under section 11(1) of the Municipal Tax Sales Act (MTSA) . The complainant alleges that her personal information was inappropriately disclosed to the remaining eight addressees, contrary to the Act. Of the eight, six addressees were various law firms that have represented interested parties and the remaining two addressees consisted of a corporation that allegedly no longer had an interest in the property, and the law firm that represented them. The mediator and the Municipality corresponded on a number of occasions in regard to the complaint. It was acknowledged that the Municipality did in fact send the 13 notices alleged by the complainant. The Municipality had hired an outside consultant to handle its tax sales. This consultant sought and obtained a legal opinion in regard to the legality of sending the notices to persons other than those who have an interest in the property - namely solicitors who prepared documents registered on title. The Municipality indicated that the legal opinion advised that, although the Municipality is not required to do so, it would be a good practice to notify these other parties given that a common objection to property tax sales is the allegation of no notice being provided to the interested parties. Despite the legal opinion, the Municipality agreed that it would alter its policy, and would now send notices only to those who had an interest in the property. Notices would be sent to lawyers listed on the registered documents only if the interested parties' addresses were unknown. The Municipality's position in regard to the privacy complaint is threefold. Firstly, the Municipality contends that the information contained in the Notices does not meet the definition of "personal information" as set out in the Act . The Municipality claims that none of the notices contained the name of the complainant except those that contained the complainant's name as addressee (i.e. notices sent to her directly, or sent to her in "care of" a law firm). Therefore, the Municipality asserts that the information in the notices is information about the property. They claim the notices do not disclose a financial transaction involving the individual complainant since the individual's name did not appear in conjunction with the other personal information. Secondly, the Municipality claims that the information is generally available to the public for a fee. They rely on section 415(1) of the Municipal Act which states that the Municipal Treasurer is obligated "on demand" to give a written certified statement of the arrears due on any land to any person. The Municipality also notes that MTSA proceedings are open to the public. The Municipality asserts that there is nothing confidential about these records and that the records are truly available to the general public. Thirdly, it is the Municipality's position that the MTSA does not prohibit the sending of the Notices to the solicitors, and that it may, in fact, be a prudent practice. The Municipality claims that the Notices were sent to the solicitors in good faith to ensure that those parties with an interest in the property did in fact receive notice. It is the Municipality's agent's normal practice to conduct a search of title for the purpose of identifying all registered interests against title and then proceeds to issue Notices to all interested parties at every address, including their solicitor's address as shown in the most recent addition of the Ontario Lawyer's Phone Book. The Municipality's arguments raise the possible application of section 27 of the Act , which indicates that the privacy rules in Part II of the Act do not apply to informat

SUMMARY OF COMPLAINT: This investigation was initiated as a result of a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act ) that Prince Edward-Lennox and Addington Social Services (Social Services) had improperly disclosed the personal information of a client. Specifically, the complainant reported that a caseworker copied the Children's Aid Society on a letter the caseworker sent to her, which contained the complainant's personal information. DISCUSSION: The complainant receives money through the Ontario Works program and as a condition of receiving benefits, the complainant was asked to verify that her former spouse was not residing with her; however, the Social Services worker did not receive the verification prior to the May 25 cut-off date for processing recipients' ongoing direct bank deposits. On May 28, 2001 the caseworker wrote to the complainant, outlining the concerns around the possibility of her former spouse residing with her, suggested that the complainant had provided false information to Ontario Works and noted that her assistance would be delayed. She also indicated that because of a concern for the complainant's children, Social Services was obliged to advise the Children's Aid Society, which they did by way of a copy of this letter. The Social Services indicated to the Mediator that they provided this information to the Children's Aid Society in compliance with section 72 of the Child and Family Services Act , "duty to report child in need of protection". CONCLUSION: The Child and Family Services Act requires an individual who has reasonable grounds to suspect that a child is in need of protection, to report the suspicion and the information on which it is based to a Children's Aid Society. It is the complainant's lawyer's position that the caseworker disclosed personal information of the complainant beyond what was required by the legislation. The County does not dispute this. In fact, the Director of the Prince Edward-Lennox and Addington Social Services has provided a letter to the complainant's lawyer, with a copy to the Mediator, in which he acknowledges that "I agree that information provided to Family and Children's Services contained both necessary information as well as some extraneous information. I regret the inclusion of this extraneous information and staff have been advised in similar future cases, to develop a separate communique to other agencies such as Family and Children's Services". He also offered his apologies to the complainant. In discussions with the mediator, the Director has indicated that a different letter will be issued to the CAS in any future instance, ensuring that only relevant information is disclosed. I recommend that the Director continue to ensure that all social services staff are aware of how the principles of the Act apply to the collection and disclosure of personal information. The complaint file is now closed. Original signed by: Leslie McIntyre, Mediator November 5, 2001

order to make my report to the Legislature, I require information concerning questions of compliance which arise, as well as an adequate understanding of the institution's position on compliance necessary to make this a meaningful exercise. Accordingly, my Office has developed an investigation process by which information concer

INTRODUCTION This report deals with two privacy investigations involving the Ministry of the Attorney General (the Ministry). Both stem from incidents involving the disclosure of personal information as a consequence of computer theft. In both instances the police were notified of the theft, but neither computer has been recovered. Both investigations remain ongoing. BACKGROUND Privacy Investigation #1 - PC-000026-1 On August 4, 2000, the Office of the Information and Privacy Commissioner (the IPC) received a letter from a Director from one Division of the Ministry regarding the theft of a portable computer containing litigation documents. The letter stated: On Thursday August 3, 2000 a portable computer containing information related to litigation conducted by counsel from [the Ministry] was stolen. The computer was locked in the trunk of the lawyer's automobile and was removed while the vehicle was in an underground parking area. The police have been notified and I am advised that efforts are underway to recover this stolen property. As the data on the computer includes some personal information, [the Deputy Attorney General] requested that I notify you of this matter. Also, please be advised that office policies with respect to the security of portable computers are under review and all staff will be reminded of their obligation to secure personal information. ... On the basis of this letter, the IPC initiated Privacy Investigation PC-000026-1, pursuant to the Freedom of Information and Protection of Privacy Act (the Act ). Privacy Investigation #2 - PC-010009-1 On February 21, 2001, the IPC received a letter from the Ministry's Assistant Deputy Attorney General, Criminal Law Division, which stated: On February 14, 2001, a laptop belonging to an Assistant Crown Attorney was stolen from the locked trunk of his car in Durham Region. It appears to have been stolen when he stopped at a Shopper's Drug Mart on his way home from work. I have been advised that there was personal information, and also information of a sensitive nature stored in the C drive of the computer. The computer was not password protected. There are inquiries being made regarding the extent to which the information was backed up so we can determine who ought to be notified of the incident. The Criminal Law Division is reviewing current practices regarding the transportation of files in an effort to enhance security measures. Crowns have recently been reminded not to leave laptops and files unattended. We will take immediate steps to ensure that all laptops in the Criminal Law Division are password protected in an effort to ensure that should such an unfortunate event occur in the future, the information stored on the computer would be inaccessible. ... As a result, the IPC initiated Privacy Investigation, PC-010009-1 under the Act . RESULTS OF THE INVESTIGATION The first two priorities when faced with a potential disclosure of personal information are: (1) to identify the scope of the potential disclosure and take steps to contain it; and (2) to identify those individuals whose personal information may have been disclosed and, barring exceptional circumstances, to notify those individuals accordingly. Although the circumstances which lead to Privacy Investigations #1 and #2 were very similar in nature, the approach taken by the Ministry in addressing these two priorities differed significantly. Privacy Investigation #1 - PC-000026-1 The Ministry initially advised the IPC that the stolen computer contained a very large number of documents relating to a specific litigation matter. No details were provided. The Ministry informed the IPC that the lawyer whose laptop was stolen was of the view that the only personal information contained in the electronic records stored on the computer consisted of the names and home telephone numbers of certain public servants. On August 9, 2000, the Director who authored the August 4, 2000 letter to the IPC sent an e-mail to her staff advising them of the stolen laptop and reminding them to "take laptops directly home from the office" and to "ensure that access to documents stored on the laptop is password protected." On August 28, 2000, the Ministry's Freedom of Information and Privacy Co-ordinator (the Co-ordinator) provided the Director with a copy of the IPC Practices entitled "Privacy and Confidentiality When Working Outside the Office" and asked her to distribute it to the staff of the branch. The IPC advised the Ministry that it required more information in order to determine whether the actions taken by the Ministry adequately addressed basic privacy concerns. Specifically, the IPC asked the Ministry to provide more information concerning: the type of records at issue; the scope and type of personal information at issue; and the identity of the individuals whose personal information was contained in the records. IPC staff offered to meet with the lawyer, but the Ministry declined. The Ministry provided a general description of the types of records at issue, but no further details concerning the particulars of the case or the individuals involved. The Ministry subsequently explained that the records contained privileged information that could not be divulged to the IPC, but that some remedial steps had been taken by the Ministry to prevent similar incidents in future. As an initial investigative step, the IPC decided to focus our efforts in the following two areas: ensuring that all public servants whose personal information was included in the records had been notified by the Ministry; and ensuring that a privacy expert from the Ministry personally reviewed the hard-copy version of each record contained on the stolen computer to confirm that no other personal information was contained in any of them. The Ministry promptly confirmed that the notifications relating to the first item had been sent by the lawyer during the week of September 7, 2000. As far as the second item was concerned, the Ministry took until December 22, 2000 to complete the review, almost 5 months after the theft of the computer had been reported. Further, although the review was apparently completed on December 22, 2000, the IPC was not advised of the results of the review until February 2, 2001. In response to persistent enquiries from the IPC, the Ministry finally confirmed that the review had been completed, and advised us for the first time at that point that additional personal information had been identified in the records. The Ministry informed the IPC that internal consultations were underway to address this situation. On February 22, 2001, the Deputy Attorney General wrote to the Commissioner outlining a number of steps the Ministry had taken to prevent similar situations from arising in future, which are discussed later in this report. As far as the specific records at issue in Privacy Investigation #1 were concerned, the Ministry stated: ... during the week of September 2, 2000, the public servants whose personal information was included in t