Dernières décisions

An article appeared in a Toronto newspaper about a web site that provides school bus schedule information. Although designed to help with school bus scheduling in York Region, the article suggested it was “giving out kids’ info” and “stirred up fears about children’s safety”. As a result of privacy concerns and the related safety issues raised by the article, the IPC initiated a privacy investigation under the Act with respect to the information being disclosed on this web site. The investigation found that the web site and related phone system disclosed personal information, and that these disclosures are not authorized by section 32 of the Act. In addition, these disclosures have the potential to seriously threaten the safety of students. The IPC recommended both be dismantled.

An article appeared in a Toronto newspaper about a web site that provides school bus schedule information. Although designed to help with school bus scheduling in York Region, the article suggested it was “giving out kids’ info” and “stirred up fears about children’s safety”. As a result of privacy concerns and related safety issues raised by the article, the IPC initiated a privacy investigation under the Act with respect to the information being disclosed on this web site. The investigation found that the web site and related phone system disclose personal information, and that these disclosures are not authorized by section 32 of the Act. In addition, these disclosures have the potential to seriously threaten the safety of students. The IPC recommended both be dismantled.

The appellant wrote to the Leamington Police Services Board (the Police) seeking access under the
Municipal Freedom of Information and Protection of Privacy Act (the Act) to records relating to criminal charges brought against him. The Police failed to respond to the request within the 30 day period required by the Act, and the appellant appealed this “deemed refusal” to this office. During the mediation stage of the deemed refusal appeal, the Police wrote to the requester advising that they were providing partial access to the requested records, and enclosing an index of records. The Police claimed the application of the exemptions at sections 8 (law enforcement) and 14 (personal privacy) as the basis for withholding records in whole or in part. In particular, the Police cited sections 8(1)(g) and 8(2)(a), as well as sections 14(1)(f), 14(3)(a) and 14(3)(b). As a result of this decision, the deemed refusal appeal was closed.

The Office of the Public Guardian and Trustee (OPGT) notified the Office of the Information and Privacy Commissioner/Ontario (the IPC) of an incident involving misdirected faxes. Specifically, the Toronto Community Housing Corporation (TCHC) received a fax sent by the OPGT, and others, intended for the Ministry of Community and Social Services, now the Ministry of Community, Family and Children's Services (the Ministry).

The OPGT advised that it had faxed a special needs application to the Ministry's Ontario Disability Support Program (the ODSP). The fax was sent to the number provided by the ODSP Special Needs office. However, the next day, the TCHC telephoned the OPGT to advise that it had received this faxed document and as well as a number of similar documents intended for the ODSP.

In total, there were five faxes sent by various sources during the course of the day that were intended for the ODSP but which were received by TCHC instead. As mentioned above, one of these faxes was sent by the OPGT. The remainder consisted of a fax sent by a Ministry employee from a different location; faxes sent by two ODSP clients; and a fax sent by a private company. The following is a brief description of each of these faxes:

1. Fax sent by the OPGT consisted of a special needs application form and included an ODSP client's name, date of birth, OPGT file number, and the need for replacement glasses (1 page).

2. Fax sent by a Ministry employee consisted of a cover page with an ODSP client's name on it (1 page), a financial statement of entitlements for the client (2 pages), and a memo advising of re-admittance of the client to a mental health centre (1 page).

3. Fax sent by an ODSP client consisted of the client's earnings statement, description of her current medication, and timelines for back-to-work possibilities (2 pages).

4. Fax sent by another ODSP client consisted of his name, his wife's name and a reassessment decision regarding the status of his disability (1 page).

5. Fax sent by a private company pertained to the amount of rent paid by two ODSP clients, and contained the address and date of birth of one of the clients (2 pages).

As a result, three privacy complaints were initiated by the IPC involving the OPGT, the Ministry and the TCHC.

The Office of the Public Guardian and Trustee (OPGT) notified the Office of the Information and Privacy Commissioner/Ontario (the IPC) of an incident involving misdirected faxes. Specifically, the Toronto Community Housing Corporation (TCHC) received a fax sent by the OPGT, and others, intended for the Ministry of Community and Social Services, now the Ministry of Community, Family and Children's Services (the Ministry).

The OPGT advised that it had faxed a special needs application to the Ministry's Ontario Disability Support Program (the ODSP). The fax was sent to the number provided by the ODSP Special Needs office. However, the next day, the TCHC telephoned the OPGT to advise that it had received this faxed document and as well as a number of similar documents intended for the ODSP.

In total, there were five faxes sent by various sources during the course of the day that were intended for the ODSP but which were received by TCHC instead. As mentioned above, one of these faxes was sent by the OPGT. The remainder consisted of a fax sent by a Ministry employee from a different location; faxes sent by two ODSP clients; and a fax sent by a private company. The following is a brief description of each of these faxes:

1. Fax sent by the OPGT consisted of a special needs application form and included an ODSP client's name, date of birth, OPGT file number, and the need for replacement glasses (1 page).

2. Fax sent by a Ministry employee consisted of a cover page with an ODSP client's name on it (1 page), a financial statement of entitlements for the client (2 pages), and a memo advising of re-admittance of the client to a mental health centre (1 page).

3. Fax sent by an ODSP client consisted of the client's earnings statement, description of her current medication, and timelines for back-to-work possibilities (2 pages).

4. Fax sent by another ODSP client consisted of his name, his wife's name and a reassessment decision regarding the status of his disability (1 page).

5. Fax sent by a private company pertained to the amount of rent paid by two ODSP clients, and contained the address and date of birth of one of the clients (2 pages).

As a result, three privacy complaints were initiated by the IPC involving the OPGT, the Ministry and the TCHC.

...

The Workplace Safety and Insurance Board (the WSIB) notified the Office of the Information and Privacy Commissioner/Ontario (the IPC) about a breach of the Freedom of Information and Protection of Privacy Act the Act). The WSIB advised the IPC that a client (client #1) who had requested access to his own WSIB claim file had also received documentation from another individual's claim file (client #2). As a result, a privacy investigation was initiated by the IPC.
In a follow-up letter to this office dated November 15, 2001, the WSIB's FOI Coordinator explained that, in May 2001, the WSIB had sent client #1 a copy of his own claim file, but had inadvertently attached a copy of an unrelated file belonging to client #2. Upon notifying an adjudicator of this incident, client #1 was advised that the documents were confidential and must be returned to the WSIB immediately, and that a WSIB investigator would be sent to retrieve the entire package. Client #1 advised that he would prefer to return the package to the WSIB's office on the following day, and subsequently met with the access manager who reviewed the entire file and removed all documentation relating to client #2.
Approximately six months later, client #1 advised the adjudicator that he had kept a copy of the documents relating to client #2. At this time, the adjudicator contacted the FOI Coordinator who then initiated an internal investigation and notified the IPC.

SUMMARY OF COMPLAINT: The complainant owned property in the Municipality of Bayham (the Municipality) and was allegedly in arrears of property taxes. The Municipality initiated formal proceedings to collect the arrears owing. The complainant claims that in December of 2000 she became aware that a Final Notice of Registration of Tax Arrears Certificate (final notice) and Tax Arrears Certificate - Document General (certificate) was sent to a law firm that had formerly acted for the complainant and her husband. The final notice and certificate (which I will refer to collectively as the "notice") contained information pertaining to the property, including the address, a legal description of the property, the assessment roll number and the amount allegedly owing in tax arrears. The notices do not contain the complainant's name. Upon further inquiry, the complainant discovered that the Municipality had sent out notices to 13 addressees. The addressees consisted of parties that the Municipality believed had an interest in the property including the complainant, the complainant's spouse, mortgagees, mortgage guarantors and various law firms. Of these, the complainant contends that only five had any interest in the identified property, and would thereby be entitled to receive such notices under section 11(1) of the Municipal Tax Sales Act (MTSA) . The complainant alleges that her personal information was inappropriately disclosed to the remaining eight addressees, contrary to the Act. Of the eight, six addressees were various law firms that have represented interested parties and the remaining two addressees consisted of a corporation that allegedly no longer had an interest in the property, and the law firm that represented them. The mediator and the Municipality corresponded on a number of occasions in regard to the complaint. It was acknowledged that the Municipality did in fact send the 13 notices alleged by the complainant. The Municipality had hired an outside consultant to handle its tax sales. This consultant sought and obtained a legal opinion in regard to the legality of sending the notices to persons other than those who have an interest in the property - namely solicitors who prepared documents registered on title. The Municipality indicated that the legal opinion advised that, although the Municipality is not required to do so, it would be a good practice to notify these other parties given that a common objection to property tax sales is the allegation of no notice being provided to the interested parties. Despite the legal opinion, the Municipality agreed that it would alter its policy, and would now send notices only to those who had an interest in the property. Notices would be sent to lawyers listed on the registered documents only if the interested parties' addresses were unknown. The Municipality's position in regard to the privacy complaint is threefold. Firstly, the Municipality contends that the information contained in the Notices does not meet the definition of "personal information" as set out in the Act . The Municipality claims that none of the notices contained the name of the complainant except those that contained the complainant's name as addressee (i.e. notices sent to her directly, or sent to her in "care of" a law firm). Therefore, the Municipality asserts that the information in the notices is information about the property. They claim the notices do not disclose a financial transaction involving the individual complainant since the individual's name did not appear in conjunction with the other personal information. Secondly, the Municipality claims that the information is generally available to the public for a fee. They rely on section 415(1) of the Municipal Act which states that the Municipal Treasurer is obligated "on demand" to give a written certified statement of the arrears due on any land to any person. The Municipality also notes that MTSA proceedings are open to the public. The Municipality asserts that there is nothing confidential about these records and that the records are truly available to the general public. Thirdly, it is the Municipality's position that the MTSA does not prohibit the sending of the Notices to the solicitors, and that it may, in fact, be a prudent practice. The Municipality claims that the Notices were sent to the solicitors in good faith to ensure that those parties with an interest in the property did in fact receive notice. It is the Municipality's agent's normal practice to conduct a search of title for the purpose of identifying all registered interests against title and then proceeds to issue Notices to all interested parties at every address, including their solicitor's address as shown in the most recent addition of the Ontario Lawyer's Phone Book. The Municipality's arguments raise the possible application of section 27 of the Act , which indicates that the privacy rules in Part II of the Act do not apply to informat

SUMMARY OF COMMISSIONER-INITIATED COMPLAINT: The Office of the Information and Privacy Commissioner (the "IPC") received a telephone call from the London Police Service ("London Police") regarding a possible disclosure of personal information. More particularly, London Police advised the IPC that it had accidentally released to a requester, a copy of a document containing the personal information of individuals other than the requester. On the basis of this telephone call, the IPC initiated an investigation under the Municipal Freedom of Information and Protection of Privacy Act (the Act). DISCUSSION: During the investigation, the following information was obtained as a result of discussions with the London Police's Freedom of Information Coordinator ("FOI Co-ordinator") and written materials provided to our office. Background London Police had received a request under the Act for a copy of an occurrence report. The individual requesting the report (the "requester") indicated to London Police that he was only interested in the information in the report that pertained to him and that he was not interested in information pertaining to other individuals. As a result, London Police decided to release to the requester a severed version of the report, deleting the personal information of individuals other than the requester. Having prepared the severed version of the report, London Police subsequently notified the requester that his records package was ready and that he could come by any time during office hours to pick up the package. London Police's procedures require that the Freedom of Information Analyst (the "FOI Analyst") place the records being released to a requester in an envelope together with the decision letter, and then place the envelope in the bottom shelf of the filing cabinet. The procedures also require that the person retrieving the package from the filing cabinet check the contents of the package to ensure that what is being released is in fact the severed copy. In this case, when the requester attended at London Police's office to pick up his package, it was lunch hour and both the FOI Co-ordinator and FOI Analyst were out of the office. An individual from the Records Department, who fills in at reception when the usual back up person is not available, was handling the reception desk. When the receptionist went to retrieve the package from the filing cabinet, she found the requester's file containing both the severed and unsevered report, but no records package for the requester. The receptionist tried to contact the FOI Analyst at home, but could not reach her. She also tried to contact the individual who usually fills in at reception, but could not reach her either. The receptionist ultimately decided to prepare the records package herself, rather than ask the requester to wait or return later. She placed both the unsevered and severed copy of the occurrence report in an envelope, which she then gave to the requester. The FOI Analyst and Co-ordinator learned of the error when they returned to the office about an hour later. Steps Taken by London Police Upon learning of the error, the FOI Co-ordinator immediately instructed the FOI Analyst to call the requester and advise that they would be sending a police officer to the requester's residence to retrieve the package. Upon receiving the call, the requester volunteered to personally return the package. About 30 minutes later, the requester attended at London Police's office and returned the package. The FOI Co-ordinator also contacted the IPC that same day to advise of the incident. In a follow up conversation the next day, the IPC suggested that the FOI Co-ordinator specifically ask the requester whether he had viewed or had copied the unsevered document and whether he would be willing to swear an affidavit. The FOI Co-ordinator later called the requester, who advised her that he had neither viewed nor copied the documents and further indicated that he was willing to swear an affidavit to that effect. The requester did later swear an affidavit, stating that during the time the documents were in his possession and prior to returning them to London Police, they remained in his personal automobile and that he did not have the opportunity to view them. London Police indicated that based on this affidavit, no personal information had been disclosed to the requester and no benefit would be served in notifying the individuals whose information had been contained in the report. In addition to the above steps, the FOI Co-ordinator obtained reports from

SUMMARY OF COMPLAINT: This investigation was initiated as a result of a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act ) that Prince Edward-Lennox and Addington Social Services (Social Services) had improperly disclosed the personal information of a client. Specifically, the complainant reported that a caseworker copied the Children's Aid Society on a letter the caseworker sent to her, which contained the complainant's personal information. DISCUSSION: The complainant receives money through the Ontario Works program and as a condition of receiving benefits, the complainant was asked to verify that her former spouse was not residing with her; however, the Social Services worker did not receive the verification prior to the May 25 cut-off date for processing recipients' ongoing direct bank deposits. On May 28, 2001 the caseworker wrote to the complainant, outlining the concerns around the possibility of her former spouse residing with her, suggested that the complainant had provided false information to Ontario Works and noted that her assistance would be delayed. She also indicated that because of a concern for the complainant's children, Social Services was obliged to advise the Children's Aid Society, which they did by way of a copy of this letter. The Social Services indicated to the Mediator that they provided this information to the Children's Aid Society in compliance with section 72 of the Child and Family Services Act , "duty to report child in need of protection". CONCLUSION: The Child and Family Services Act requires an individual who has reasonable grounds to suspect that a child is in need of protection, to report the suspicion and the information on which it is based to a Children's Aid Society. It is the complainant's lawyer's position that the caseworker disclosed personal information of the complainant beyond what was required by the legislation. The County does not dispute this. In fact, the Director of the Prince Edward-Lennox and Addington Social Services has provided a letter to the complainant's lawyer, with a copy to the Mediator, in which he acknowledges that "I agree that information provided to Family and Children's Services contained both necessary information as well as some extraneous information. I regret the inclusion of this extraneous information and staff have been advised in similar future cases, to develop a separate communique to other agencies such as Family and Children's Services". He also offered his apologies to the complainant. In discussions with the mediator, the Director has indicated that a different letter will be issued to the CAS in any future instance, ensuring that only relevant information is disclosed. I recommend that the Director continue to ensure that all social services staff are aware of how the principles of the Act apply to the collection and disclosure of personal information. The complaint file is now closed. Original signed by: Leslie McIntyre, Mediator November 5, 2001

order to make my report to the Legislature, I require information concerning questions of compliance which arise, as well as an adequate understanding of the institution's position on compliance necessary to make this a meaningful exercise. Accordingly, my Office has developed an investigation process by which information concer

INTRODUCTION This report deals with two privacy investigations involving the Ministry of the Attorney General (the Ministry). Both stem from incidents involving the disclosure of personal information as a consequence of computer theft. In both instances the police were notified of the theft, but neither computer has been recovered. Both investigations remain ongoing. BACKGROUND Privacy Investigation #1 - PC-000026-1 On August 4, 2000, the Office of the Information and Privacy Commissioner (the IPC) received a letter from a Director from one Division of the Ministry regarding the theft of a portable computer containing litigation documents. The letter stated: On Thursday August 3, 2000 a portable computer containing information related to litigation conducted by counsel from [the Ministry] was stolen. The computer was locked in the trunk of the lawyer's automobile and was removed while the vehicle was in an underground parking area. The police have been notified and I am advised that efforts are underway to recover this stolen property. As the data on the computer includes some personal information, [the Deputy Attorney General] requested that I notify you of this matter. Also, please be advised that office policies with respect to the security of portable computers are under review and all staff will be reminded of their obligation to secure personal information. ... On the basis of this letter, the IPC initiated Privacy Investigation PC-000026-1, pursuant to the Freedom of Information and Protection of Privacy Act (the Act ). Privacy Investigation #2 - PC-010009-1 On February 21, 2001, the IPC received a letter from the Ministry's Assistant Deputy Attorney General, Criminal Law Division, which stated: On February 14, 2001, a laptop belonging to an Assistant Crown Attorney was stolen from the locked trunk of his car in Durham Region. It appears to have been stolen when he stopped at a Shopper's Drug Mart on his way home from work. I have been advised that there was personal information, and also information of a sensitive nature stored in the C drive of the computer. The computer was not password protected. There are inquiries being made regarding the extent to which the information was backed up so we can determine who ought to be notified of the incident. The Criminal Law Division is reviewing current practices regarding the transportation of files in an effort to enhance security measures. Crowns have recently been reminded not to leave laptops and files unattended. We will take immediate steps to ensure that all laptops in the Criminal Law Division are password protected in an effort to ensure that should such an unfortunate event occur in the future, the information stored on the computer would be inaccessible. ... As a result, the IPC initiated Privacy Investigation, PC-010009-1 under the Act . RESULTS OF THE INVESTIGATION The first two priorities when faced with a potential disclosure of personal information are: (1) to identify the scope of the potential disclosure and take steps to contain it; and (2) to identify those individuals whose personal information may have been disclosed and, barring exceptional circumstances, to notify those individuals accordingly. Although the circumstances which lead to Privacy Investigations #1 and #2 were very similar in nature, the approach taken by the Ministry in addressing these two priorities differed significantly. Privacy Investigation #1 - PC-000026-1 The Ministry initially advised the IPC that the stolen computer contained a very large number of documents relating to a specific litigation matter. No details were provided. The Ministry informed the IPC that the lawyer whose laptop was stolen was of the view that the only personal information contained in the electronic records stored on the computer consisted of the names and home telephone numbers of certain public servants. On August 9, 2000, the Director who authored the August 4, 2000 letter to the IPC sent an e-mail to her staff advising them of the stolen laptop and reminding them to "take laptops directly home from the office" and to "ensure that access to documents stored on the laptop is password protected." On August 28, 2000, the Ministry's Freedom of Information and Privacy Co-ordinator (the Co-ordinator) provided the Director with a copy of the IPC Practices entitled "Privacy and Confidentiality When Working Outside the Office" and asked her to distribute it to the staff of the branch. The IPC advised the Ministry that it required more information in order to determine whether the actions taken by the Ministry adequately addressed basic privacy concerns. Specifically, the IPC asked the Ministry to provide more information concerning: the type of records at issue; the scope and type of personal information at issue; and the identity of the individuals whose personal information was contained in the records. IPC staff offered to meet with the lawyer, but the Ministry declined. The Ministry provided a general description of the types of records at issue, but no further details concerning the particulars of the case or the individuals involved. The Ministry subsequently explained that the records contained privileged information that could not be divulged to the IPC, but that some remedial steps had been taken by the Ministry to prevent similar incidents in future. As an initial investigative step, the IPC decided to focus our efforts in the following two areas: ensuring that all public servants whose personal information was included in the records had been notified by the Ministry; and ensuring that a privacy expert from the Ministry personally reviewed the hard-copy version of each record contained on the stolen computer to confirm that no other personal information was contained in any of them. The Ministry promptly confirmed that the notifications relating to the first item had been sent by the lawyer during the week of September 7, 2000. As far as the second item was concerned, the Ministry took until December 22, 2000 to complete the review, almost 5 months after the theft of the computer had been reported. Further, although the review was apparently completed on December 22, 2000, the IPC was not advised of the results of the review until February 2, 2001. In response to persistent enquiries from the IPC, the Ministry finally confirmed that the review had been completed, and advised us for the first time at that point that additional personal information had been identified in the records. The Ministry informed the IPC that internal consultations were underway to address this situation. On February 22, 2001, the Deputy Attorney General wrote to the Commissioner outlining a number of steps the Ministry had taken to prevent similar situations from arising in future, which are discussed later in this report. As far as the specific records at issue in Privacy Investigation #1 were concerned, the Ministry stated: ... during the week of September 2, 2000, the public servants whose personal information was included in t

INTRODUCTION: Background of the Complaint Letter #1 A resident of the Township of Springwater (the Township) filed an objection with the Township Clerk concerning certain proposed development activity under consideration by the Township. The Clerk referred the objection to the Township's Chief Administrative Officer, who in turn raised the matter with a planner employed by the developer (the developer's planner). After receiving a response from the developer's planner, the matter was discussed at a closed session of the Township Council and referred to the Township's Solicitor and outside planning consultant (the outside planning consultant) for further action. Letter #2 The resident filed a second objection with the Township concerning a re-zoning application under consideration by the Township. The Township Council referred this matter to the Snow Valley Working Group (the Working Group), an organization whose membership included the developer's planner who is the subject of letter #1. The resident (now the complainant) sent a letter of complaint to this Office, alleging that the Township had improperly disclosed his personal information to the developer's planner and to the outside planning consultant (letter #1) and to the Working Group (letter #2), contrary to the provisions of the Municipal Freedom of Information and Protection of Privacy Act (the Act ). The complainant's letter also identified three other matters which, as explained by the mediator, fall outside the scope of this investigation. Issues Arising from the Investigation The following issues were identified as arising from the investigation: (A) Was the information in question "personal information"as defined in section 2(1) of the Act ? (B) Did the Township disclose personal information relating to letter #1 and, if so, was this disclosure in accordance with section 32 of the Act ? (C) Did the Township disclose personal information relating to letter #2 and, if so, was this disclosure in accordance with section 32 of the Act ? RESULTS OF THE INVESTIGATION: Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act ? Section 2(1) of the Act states, in part: "personal information" means recorded information about an identifiable individual, including, (e) the personal opinions or views of the individual except if they relate to another individual, (f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence, The two letters of objection submitted to the Township by the complainant contain his name, address, telephone and fax number, as well as his views and opinions regarding development issues under consideration by the Township. As such, I find that the information contained in the two letters falls within the scope of paragraph (e), and therefore qualifies as the complainant's personal information. Conclusion : The information in question was personal information as defined in section 2(1) of the Act . Issue B: Did the Township disclose personal information relating to letter #1 and, if so, was this disclosure in accordance with section 32 of the Act ? The complainant maintains that letter #1 was disclosed to the developer's planner by the Township's Chief Administrative Officer, and subsequently to the outside planning consultant following consideration by the Township Council. The complainant does not indicate any objection to disclosure to the Township Solicitor. The Township denies that letter #1 was disclosed. It takes the position that the subject matter of the complainant's concerns was discussed with the developer's planner, but the actual letter was not disclosed. According to the Township, the complainant's identity was not revealed to the developer's planner during the course of these discussions. I have reviewed the summary of the content of the complainant's first objection that was prepared by the Township's Chief Administrative Officer and provided by him to the developer's planner, as well as the response provided by the developer's planner. This exchange of correspondence did not identify the complainant or disclose any of the complainant's personal information. There is nothing in the content of these letters to suggest that the developer's planner was aware of the identity of the complainant or any of his personal information. Although the complainant holds the view, based on actions taken by the developer and informal discussions with other individuals during the relevant time period, that his identity was disclosed by the Township, I am unable to conclude, based on information provided to me during the course of this investigation, that letter #1 was disclosed to the developer's planner. The explanation offered by the Township is reasonable and it would appear that the nature of the complainant's objection, but not his identity or other personal information, was disclosed to the developer's planner, as suggested by the Township. As far as the outside planning consultant is concerned, the Township acknowledges that letter #1 was provided to him, as directed by Township Council. This issue is whether or not this disclosure was in compliance with section 32 of the Act . Section 32 lists a number of permitted disclosures of personal information, including section 32(c) which states: An institution shall not disclose personal information in its custody or under its control except, <

On March 21, 2001, the Office of the Information and Privacy Commissioner (IPC) received a letter from the Leader of the Ontario New Democratic Party alleging a disclosure by electronic mail of a report entitled 2000 Traumatic Fatalities Reported in Occupational Disease & Survivor Benefits Program (the Report), and asking the IPC to investigate. Enclosed with the letter was a copy of an e-mail and the Report, which he had received from one of the e-mail recipients.

That same day, the Commissioner received a telephone call from the Minister of Labour (the Ministry) in respect of the same incident, assuring us of their intention to cooperate fully with our investigation.

The IPC initiated an investigation under the Freedom of Information and Protection of Privacy Act (the Act) against the Ministry (PC-010013-1).

On March 27, 2001, the IPC met with the Ministry's Freedom of Information and Privacy Co-ordinator, and in the course of the discussions determined that the Report in question was a Workplace Safety and Insurance Board (WSIB) report. While the Minister of Labour has overall responsibility for WSIB, WSIB is a separate institution under the Act.

Accordingly, on March 29, 2001 the IPC initiated an investigation involving WSIB (PC-010014-1), and met with some of WSIB's senior staff.

Both complaints are addressed in this report because the disclosure of the WSIB report involved both Ministry and WSIB staff. Further, there is considerable overlap in the events, relationships and actions taken.

INTRODUCTION: Background of the Complaint The Office of the Information and Privacy Commissioner received a complaint submitted by counsel on behalf of a client (the complainant), to the effect that the complainant's privacy had been breached by staff of the Toronto Police Services Board (the Police). The complainant alleges that a detective in the Toronto Homicide Squad contacted his father. In the course of speaking with the father, the complainant maintains that the detective revealed that the complainant was HIV positive. According to the complainant, prior to that conversation, his father did not know his medical status. The complainant also states that he did not consent to the disclosure of his medical information to his family by the Police. The complainant has presumed that the detective came into possession of information about him through the detective's professional duties, and alleges that such a disclosure contravenes the Municipal Freedom of Information and Protection of Privacy Act (the Act ). Issues Arising from the Investigation The following issues were identified as arising from the investigation: (A) Was the information in question "personal information" as defined in section 2(1) of the Act ? (B) Was the disclosure of the complainant's personal information made in accordance with section 32 of the Act ? RESULTS OF THE INVESTIGATION: Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act ? Under section 2(1) of the Act, personal information is defined in part as recorded information about an identifiable individual, including information relating to the medical history of the individual. Clearly, the information at issue, the medical status of the complainant, falls within the scope of the definition of "personal information" in section 2(1) of the Act . The Police do not dispute this finding. Conclusion: The personal information at issue is the personal information of the complainant, as defined in section 2(1) of the Act . Issue B: Was the disclosure of the complainant's personal information made in accordance with section 32 of the Act ? During our investigation, the Mediator contacted the complainant's father, who indicated that the conversation with the detective took place in a courtroom in February 2000, during a trial involving the complainant's brother. The detective had been the arresting officer in this case. According to the father, the detective asked him if he had seen the complainant, and when the father indicated that he believed him to be in another province, the detective informed him that in fact, he was in the Don Jail, and that he was HIV positive. The Freedom of Information Co-ordinator (the Co-ordinator) for the Police questioned the detective about the circumstances identified by the complainant. According to the Co-ordinator, the detective agreed that he had spoken to the complainant's father during the course of the investigation and subsequent trial, but denied disclosing any medical information about the complainant. The detective is of the view that the complainant's medical status was well-known, and states that he would have had no reason to discuss it with the father. The Police also note that the complainant's medical information had been disclosed during court proceedings prior to February 2000, and suggest the possibility that the father learned about the complainant's medical status from another source. The Police state: [The complainant's] HIV status had been stated in open court on at least one previous occasion. Although this fact may not justify a Service member releasing such sensitive information to a third party, it does suggest that the complainant's HIV status would have been known by several individuals (in attendance at court that day) any one of whom may have been in contact with the father. It is not possible to determine with certainty which version of events is correct. In my view, the explanation offered by the Police is reasonable and, based on the information provided by the complainant and the Police, I am not persuaded that the detective disclosed the client's personal information in the manner described by the father. That being said, if the disclosure was made by the detective as described by the father, it would constitute an improper disclosure, and would not be in compliance with section 32 of the Act . Conclusion: I am not persuaded that there was an improper disclosure of the complainant's personal information. In response to receiving a draft version of this report, counsel for the complainant submits that a third issue needs to be addressed. Specifically, the complainant states: Under [the Act ], sections 41 through 44 create a mechanism whereby the Commissioner can hear appeals regarding refusals of access and amendment requests. Those sections give the Commissioner the necessary powers to address those appeals. In particular, section 41(8) gives the Commissioner the power to examine any person under oath, and section 41(4) gives the parties the right to counsel. There is no similar scheme for complainants involved allegations of wrongful disclosures. Under the Act , the only powers the Commissioner has to address complaints regarding wrongful disclosures are contained in section 46. Section 46 does not give the Commissioner any investigative powers, not does it even give the Commissioner the right to order a head to cease disclosing information in contravention of the legislation. There is no general right to investigate, no powers to compel production or evidence, no power to hold an oral hearing. As a result, the Act creates a scheme whereby the Commissioner has virtually no ability to properly investigate complainants of wrongful disclosu