PC-040044-1

SUMMARY OF COMMISSIONER INITIATED COMPLAINT: The Office of the Information and Privacy Comissioner/Ontario (the IPC) was contacted by Management Board Secretariat (MBS) regarding a disclosure of personal information relating to the Ontario Student Award Program (OSAP) by the Ministry of Training, Colleges and Universities and a private collection agency. Subsequently, this Office was contacted by MBS regarding a second disclosure of personal information relating to the same program by another private collection agency. On the basis of this information, the IPC initiated two privacy complaints under the Freedom of Information and Protection of Privacy Act (the Act ). Background The first complaint involves the Student Support Branch of the Ministry of Training, Colleges and Universities (the Ministry), and both complaints involve the Collections Management Unit (CMU) of the Shared Services Bureau (SSB) of MBS. The Student Support Branch of the Ministry manages OSAP, a program of student financial assistance administered by the Ministry and composed of a variety of programs funded by the province of Ontario and the government of Canada. The CMU manages the collection of overdue non-tax debts owing to the government, by hiring private sector debt collection agencies to undertake the collection of unpaid debts on behalf of the Ontario government. When a debtor defaults on the repayment of an OSAP loan and the Ministry is unable to settle the account with the debtor, the Ministry refers the debt to the CMU at MBS for collection, and these accounts are then assigned by the CMU to private collection agencies. Particulars of the two incidents In the first complaint, PA-040033-1, a private collection agency retained by MBS received a request from a debtor for supporting information about her student loan. In response, the agency forwarded the request to the Ministry, which in turn sent a copy of a bulk report prepared by a bank to the agency. The agency then forwarded this report to the debtor. However, the report contained the personal information of thirty- eight other individuals in addition to that of the debtor. In the second instance, PA-040044-1, another private collection agency mailed information to a debtor regarding her student loan and inadvertently enclosed the personal information of another debtor in the envelope. In both instances, MBS was made aware of the incidents by the two recipients of the records. The personal information in the records at issue included the student debtors’ names, social insurance numbers (SIN) and details regarding the student loans. Actions taken in response to these incidents PC-040033-1 Management Board Secretariat MBS advised that it undertook the following steps to address this incident. On receipt of the telephone call from the debtor’s mother advising that her daughter had received a record from a collection agency retained by MBS containing the personal information of individuals other than her daughter, staff in the SSB alerted senior management in the CMU, and obtained the debtor’s written consent for the SSB to communicate with her mother on this issue. A client services officer in the CMU then contacted the mother, who confirmed that her daughter received a record containing the names, social insurance numbers and details of the loans relating to 38 other individuals. The record was sent to the daughter by a private collection agency retained by the CMU. This information was provided to her daughter as a result of a request for supporting information from the Ministry regarding the daughter’s outstanding OSAP loan. At MBS’ request, the mother faxed the record to the CMU, and advised that she would shred her copy. Subsequently, MBS arranged to pick up the record by courier and has since returned it to the Ministry. The CMU then contacted the collection agency, which confirmed that it sent the information at issue to the daughter. It also confirmed that it had originally received this record from the Ministry. The CMU also contacted the Student Support Branch of the Ministry, which confirmed that the record was sent to the collection agency by the Ministry. The Ministry indicated that the record is one of a series of quarterly statements prepared for the years 1996 and 1997 for a particular bank identifying individuals who have participated in the interest relief program. The record identifies 38 individuals including the recipient. It contains the individuals’ social insurance number, given name and surname, and other details of the loans relating to these individuals. MBS notes that it has established comprehensive contractual provisions in its contracts with the PCA [private collection agency] agents it retains in order to protect the personal information that is collected, used and disclosed in the course of debt collection... at the behest of the CMU all [staff at the collection agency] were reminded that when receiving back-up information about debtors from Ministries they must conduct a thorough review of all documents to ensure that only the personal information of the debtor is mailed out; the CMU, the MBS legal services branch, and the Access and Privacy Office of MBS [conducted] a comprehensive privacy training session for staff of all PCAs retained by the CMU.[...] A training session [was] conducted for staff in the [CMU]. Ministry of Training, Colleges and Universities The Ministry advised that it undertook the following steps to address this incident. Specifically it sent letters to all 38 individuals, advising them that as the result of a mailing error, their personal information (name, social insurance number and the principal and interest of their OSAP loan) was inadvertently sent to another individual. The director of Student Support Branch, who signed the letter, apologized for the breach, stated that the record had been returned without being copied, and provided the name and telephone number of the Senior Manager of Operations as a contact person to provide them with additional information. We also informed the individuals that the ministry has changed the process by which banks and collection agencies report on OSAP loans and we have enhanced internal measures to protect client privacy. The letters were sent by registered mail to the most recent address that the ministry could obtain for each of the individuals. However, many of these addresses are several years old. To date, 21 of the letters have been returned to the ministry. These letters are being kept in the files of the individuals concerned. The Ministry indicated that in light of this incident, it has reviewed its policies and procedures and made the following changes: The processes under which disclosure of personal information is made to private collection agencies, upon request for proof of an OSAP debt, has been enhanced. Before disclosure is made by a financial services clerk, the disclosure is re