PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-040012-1

 

 

Sarnia Police Service

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-040012-1

 

 

 

INVESTIGATOR:                                       Chris Severin

 

 

 

INSTITUTION:                                            Sarnia Police Service

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (the IPC) received a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) from an individual (the complainant) involving the Sarnia Police Service (the Police).  Specifically, the complainant advised as follows.

 

On January 25, 2002, the complainant faxed an access request under the Act to the Police for access to certain records containing his personal information. 

 

On February 6, 2002, the complainant had a scheduled appointment with his probation officer.  During this appointment the probation officer informed the complainant the Police had called him (the probation officer) regarding the complainant’s access request.   The probation officer advised the complainant that the Police inquired with the probation officer as to why the complainant was making the access request.  The probation officer advised the Police that the purpose of the complainant’s access request could possibly be related to his request for variation to his probation order that the complainant was making at the time.

 

The complainant contends that the Police breached his privacy by disclosing to his probation officer that he had made an access request as well as collecting a potential reason for that request from the probation officer.

 

During the course of my investigation, the complainant provided a copy of the probation officer’s case notes that refer to the conversation between the probation officer and the Police.  The notes state that the probation officer was contacted by the Police and was advised that the complainant had submitted a request under the Act for certain incident reports relating to the complainant.  The notes also state that the probation officer explained that the purpose of the request was likely related to the complainant’s request for variation to his probation order.

The Police have advised that the complainant’s access request was for “any and all records [the Police] may have regarding [the complainant]”.  Other than that, the Police do not dispute the facts in this case.  In response to this complaint they have relied upon section 32(f)(ii) of the Act for both the disclosure to the probation officer of the fact that the complainant had made an access request and the collection from the probation officer of a possible reason for the access request, considering both to be “a law enforcement information exchange”.  Section 32 lists circumstances under which personal information may be disclosed.  It does not address the issue of collection.  I will reference section 28 of the Act when discussing the issue of collection.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

.  .  .  .  .

 

(h)        the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

The information that was disclosed by the Police to the probation officer included the complainant’s name, the fact that he submitted an access request and the nature of that request.  The information that was collected by the Police from the probation officer was the possible reason for the complainant’s access request.  In my view, this information qualifies as “personal information” as defined in section 2(1) of the Act.  This view is consistent with past statements of this office dealing with disclosure of a requester’s name together with other information about the request (see, for example, IPC Practices 16 and Order PO-1998, in which this office stated that, for privacy reasons, it is inappropriate to disclose the identity of a requester to employees except on a “need to know” basis).

 

Did the Police disclose the personal information in accordance with section 32 of the Act?

 

Introduction

 

As stated above, the Police rely on section 32(f)(ii) of the Act as their authority for the disclosure of the personal information in question.  This section states that an institution shall not disclose personal information in its custody or under its control except:

 

if disclosure is by a law enforcement institution,

 

to another law enforcement agency in Canada;

 

Section 2(1) of the Act defines “law enforcement” as:

 

(a)        policing,

 

(b)        investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed on those proceedings, and

 

(c)        the conduct of proceedings referred to in clause (b);

 

There are other statutory provisions that may be relevant to this question. 

 

According to the Ministry of Correctional Services Act (the MCSA), probation officers fall under the responsibility of the Ministry of Correctional Services, now the Ministry of Community Safety and Correctional Services (the Ministry).  Section 1 of the MCSA defines “probation” as follows:

 

“probation” means the disposition of a court authorizing a person to be at large subject to the conditions of a probation order or community service order;

 

Section 5 of the MCSA describes the functions of the Ministry as follows:

 

It is the function of the Ministry to supervise the detention and release of inmates, parolees, probationers and young persons and to create for them a social environment in which they may achieve changes in attitude by providing training, treatment and services designed to afford them opportunities for successful personal and social adjustment in the community, and, without limiting the generality of the foregoing, the objects of the Ministry are to,

 

(a)        provide for the custody of persons awaiting trial or convicted of offences;

 

(b)        establish, maintain and operate correctional institutions;

 

(c)        provide for the open custody, secure custody and temporary detention of young persons awaiting trial, found guilty or convicted of offences;

 

(d)       establish, maintain and operate places of open custody, secure custody and temporary detention;

 

(e)        provide programs and facilities designed to assist in the rehabilitation of inmates and young persons;

 

(f)        establish and operate a system of parole;

 

(g)        provide probation services;

 

(h)        provide supervision of non-custodial dispositions, where appropriate; and

 

(i)         provide programs for the prevention of crime.

 

Section 44(1) of the MCSA describes the duties of a probation officer as follows:

 

It is the duty of a probation officer,

 

(a)        to procure and report to a court such information pertaining to a person found to have committed an offence as the court may require for the purpose of making a disposition of the case;

 

(b)        to make recommendations in the report referred to in clause (a) as to the disposition of the case upon being requested by the court;

 

(c)        to comply with any direction made to the probation officer by a court in a probation order.

 

Submissions

 

In response to this complaint, the Police provided the following general information relating to the duties and functions of police services and probation officers:

 

The Courts, Police Services, Crown Attorneys, Ministry of Public Safety and Security, Probation and Parole Services and Correctional Facilities – jails are all part of the Criminal Justice System in Canada and work very closely together including the sharing of information of mutual interest on charged or convicted individuals.

 

Probation and Parole area offices provide supervision of individuals serving community dispositions.  Probation, one of the Community dispositions is a court ordered sanction given instead of, or in addition to, a term of incarceration.  Probation and Parole officers thus supervise convicted individuals during their term of probation and have law enforcement status.

 

Police Services, in their capacity as law enforcement institutions, have access to probation orders and conditions as set out by the Probation and Parole Offices and are responsible for ensuring that convicted individuals comply with the terms and conditions of their probation order.

 

The Police go on to take the position that during the period of the complainant’s probation, all of his activities, including a Freedom of Information Request, are subject to section 32(f)(ii) of the Act.  They also provide the following information concerning the particular circumstances of this case.

 

When [the complainant] made his request of January 25, 2002 under [the Act], he knew very well that the only information in [our] records regarding him, other than his complaint of November 9, 2001, related to investigation of his criminal activity and subsequent conviction.

 

Since [the complainant] would have received these records through the courts disclosure process, I found it puzzling as to what records he thought were in [our] possession . . . that he had not already obtained.  Given he was under the supervision of a Probation Officer, I thought it appropriate to contact this officer to determine his insight into this matter as to what additional records, real or imagined, were involved.  The disclosure to the probation officer of the fact that the complainant had made a request under the Act, and the collection from the probation officer of a reason for this request, were within the parameters of Section 32(f)(ii) of the Act as a law enforcement information exchange.

 

Findings

 

The Police are clearly a “law enforcement institution” in accordance with section 2(1) of the Act.

 

The next question is whether the disclosure was to “another law enforcement agency in Canada”.

 

It is arguable that in the context of a probation officer performing his or her duties under the MCSA, the Ministry is a “law enforcement” agency for the purpose of section 32(f)(ii), in part since a violation of parole could lead to a penalty or sanction as described in paragraph (b) of the “law enforcement” definition.  On the other hand, it is not clear that probation officers engage in “policing” under paragraph (a), or “investigations or inspections” under paragraph (b).  It is arguable that based on section 44(1) of the MCSA, probation officers gather information, report, and recommend, as opposed to police, investigate or inspect as required by the definition.

 

In the circumstances, it is not necessary for me to reach a conclusion on this point.  In my view, in order for section 32(f)(ii) to apply, the disclosure in question must be made for the purpose of a specific law enforcement matter.

 

The Police disagree with this interpretation, and state:

 

I see nothing in past I.P.C. decisions to support this view and do not believe that it was the intention of the legislation to limit the law enforcement community’s sharing of information on person’s under the control or supervision of a correctional authority; otherwise, such a clause would have been included in the Act.

 

I do not accept the argument of the Police.

 

The legislative history of section 32(f)(ii) supports this interpretation.  In discussing the need to allow law enforcement agencies from different jurisdictions to share personal information, the report entitled Public Government for Private People:  The Report of the Commission on Freedom of Information and Individual Privacy 1980, vol. 3 (Toronto: Queen's Printer, 1980) (the Williams Commission Report) stated (at p. 701):

 

. . . The account of law enforcement information systems in Ontario published in a Commission research paper indicates the existence of information-sharing practices among federal, provincial, municipal, and even foreign law enforcement agencies.  Clearly, such cooperative efforts are instrumental in the apprehension of criminals, and it would be unwise, in our view, to preclude information exchanges for that purpose.  Such information will not normally be submitted voluntarily by the data subject in the first place.  Information gathered in the course of an investigative activity will most commonly be shared in order to secure assistance from other law enforcement officials who may have an opportunity to apprehend suspected parties.  Accordingly, we recommend that such exchanges be exempt from the no-transfer rule. [my emphasis]

 

It appears from the language used by the Williams Commission that the purpose of allowing transfers of personal information between law enforcement agencies is to further law enforcement purposes, rather than to allow unfettered, discretionary exchanges of information for any purpose.

 

In addition, related provisions in Part II of the Act that permit law enforcement agencies to handle personal information contain law enforcement purpose limitations.  For example, section 28(2) reads, in part:

 

No person shall collect personal information on behalf of an institution unless the collection is . . . used for the purposes of law enforcement . . .

 

Section 29(1)(g) reads:

 

An institution shall collect personal information only directly from the individual to whom the personal information relates unless,

 

the information is collected for the purpose of law enforcement

 

In my view, it would be inconsistent and irrational for the legislature to have intended that law enforcement agencies may rely on section 28(2) and 29(1)(g) only where the collection is for law enforcement purposes, yet permit those same agencies to share information with each other for any purpose whatsoever, even if unrelated to a law enforcement purpose.

 

Section 32(k) is similar in nature to section 32(f)(ii), in that it permits disclosure “to the Information and Privacy Commissioner”, yet does not explicitly state a purpose limitation.  However, it would not be reasonable to argue, in my view, that section 32(k) contemplated that an institution could disclose personal information to this office for any purpose other than for the purpose of this office carrying out its legislative duties and functions under the Act, its provincial counterpart, and the Personal Health Information Protection Act, 2004.

 

This interpretation also is consistent with one of the fundamental purposes of the Act, which is “to protect the privacy of individuals with respect to personal information about themselves held by institutions” [section 1(b)].

 

Here, the Police have not persuaded me that the disclosure of the personal information in question was for the purpose of law enforcement or in any way connected to either of the law enforcement matters involving the complainant to which the Police refer.  Rather, it appears that the Police disclosed the complainant’s personal information in an attempt to determine a possible reason for the access request and obtain additional information as to what, if any, additional records may have been sought by the complaint.  In my view, this is not sufficient to establish that the information in question was disclosed for a law enforcement purpose.  Accordingly, I conclude that the disclosure of personal information in question was not validly made under section 32(f)(ii).  Since none of the other section 32 exceptions could apply here, the disclosure was made contrary to section 32 of the Act.

 

Did the Police collect the personal information in accordance with section 28(2) of the Act?

 

Section 28(2) states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

 

For section 28(2) to apply, the Police must show that the collection of the personal information in question (the possible reason for the complainant’s access request) was “expressly authorized by statute”, “used for the purpose of law enforcement” or “necessary to the proper administration of a lawfully authorized activity”.

 

As stated earlier, in their submissions, the Police make no reference to section 28(2) or to any other statutes other than the Act.  In these circumstances, the Police have not provided a sufficient basis to establish the application of the “expressly authorized by statute” exception in section 28(2). 

 

For similar reasons as articulated above under the issue of disclosure, I also find that the Police have not provided a sufficient basis to conclude that the personal information in question was “used for the purposes of law enforcement”.  As mentioned above, it appears from the Police’s submissions that the purpose for disclosing and subsequently collecting the complainant’s personal information was to obtain additional information in order to process his access request and not for law enforcement purposes.

 

As to whether the collection of the personal information was “necessary to the proper administration of a lawfully authorized activity”, I find that though the processing of a request for information under the Act is “a lawfully authorized activity”, the collection by the Police of the reason for that request is not “necessary to the proper administration” of that activity.

 

Previous orders [see Orders M-96, MO-1284, PO-1763] of this office have determined that it is not necessary for a requester to justify or provide a reason for his or her request.  This thought is reiterated in Commissioner Ann Cavoukian’s 2000 Annual Report, where she discusses “need to know” as a basis for disclosure of a requester’s identity.  She states:

 

A basic premise underlying the operation of all freedom of information schemes is that the identity of a requester should only be disclosed within an institution on a “need to know” basis.  Requiring individuals to demonstrate a need for information or explain why they are submitting a request would erect an unwarranted barrier to access.  IPC Practice 16:  Maintaining the confidentiality of Requesters and Privacy Complainants (re-issued September, 1998) sets out some basic principles, two of which are of particular importance here:

 

employees of an institution responsible for responding to requests - generally the Freedom of Information and Privacy Co-ordinator and assisting staff - should not identify any requester to employees outside the Co-ordinator’s office when processing requests for general records;

 

when an individual requests access to his or her own personal information, while the Co-ordinator may need to identify the requester to other employees in order to locate the records or make decisions regarding access, the name of the requester should be provided only to those who need it in order to process the request.

 

If the Police felt that they required additional information in order to process the complainant’s access request, such information should have been obtained directly from the complainant, rather than from his probation officer.  Pursuant to section 17(2) of the Act, if the Police were of the view that the request did not sufficiently describe the records sought, the Police were required to inform the requester of the defect and offer assistance in reformulating the request.

 

In view of the above, I find that it was not necessary to the proper administration of a lawfully authorized activity for the Police to collect the personal information in question.

 

Accordingly, I find that the collection of the “personal information” was not in accordance with section 28(2) of the Act.

 

CONCLUSION:

 

1.         The information in question is personal information as that term is defined in section 2(1) of the Act.

 

2.         The disclosure of personal information was not in compliance with section 32 of the Act.

 

3.         The collection of personal information was not in compliance with section 28(2) of the Act.

 

RECOMMENDATION(S):

 

1.         I recommend that the Police circulate a copy of IPC Practice 16:  Maintaining the Confidentiality of Requesters and Privacy Complainants to the appropriate staff reminding them of their obligations to protect the privacy of individuals under the Act.

 

2.         By May 8, 2005, the Police should provide this office with proof of compliance with the above recommendation.

 

 

 

 

 

Original signed by:                                                                              February 8, 2005

Chris Severin Investigator