PRIVACY COMPLAINT REPORT

 

 

            PRIVACY COMPLAINT NO. MC-050005-1

 

 

          City of Toronto

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-050005-1

 

 

 

INVESTIGATOR:                                       Suzanne Tardif

 

 

 

INSTITUTION:                                            City of Toronto

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner (the IPC) received a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) from an individual (the complainant) involving the City of Toronto (the City). 

 

Specifically, the complainant is concerned that his identity as a requester under the Act was disclosed by the City’s legal counsel, to an affected person’s solicitor, without his consent.  With his complaint, the complainant provided a copy of a letter written by the City’s legal counsel to the affected person’s solicitor which identifies the complainant’s name and the fact that he had made an access request.

 

Background

 

The complainant filed an access request under the Act, with the City of Toronto, for records relating to two incidents involving the Office of the City’s Director of Corporate Access and Privacy.  The City granted access to the records in part and the complainant appealed this decision to the IPC.  During the course of Adjudication, the City located further responsive records which required notification of an affected person.  In a letter from the City’s legal counsel to the affected person’s solicitor to obtain the affected person’s representations on the disclosure of her personal information, the complainant’s name and information about his access request were mentioned.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Issue A:          Is the information in question “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

As indicated above, the information that is the subject of this complaint includes the complainant’s name and the fact that he submitted an access request to the City.  In its submission, the City states the following:

 

It is the City’s view that the name of the requester together with the information that he has submitted an access request meets the requirements of the definition of “personal information” in section 2(1) of [the Act].

 

 I agree that the information in question qualifies as “personal information” as defined in section 2(1) of the Act. This view is consistent with past statements of this office dealing with disclosure of a requester’s identity (see, for example, IPC Practice 16, Order PO-1998 and Privacy Complaint Report MC-040012-1).

 

Issue B:           Was the disclosure of the “personal information” in accordance with section 32 of the Act?  

 

Introduction

 

Section 32 of the Act sets out the rules for the disclosure of personal information other than to the individual to whom the information relates.  This section provides that an institution shall not disclose personal information in its custody or under its control, except in the circumstances listed in sections 32(a) through (n).

 

Submissions

 

In its submission, the City does not rely on any specific sections of the Act to authorize the disclosure of personal information in question.  The City does, however, provide the following information concerning the particular circumstances of this case:

 

[The City’s legal counsel] has advised that he had the impression that [the complainant] had spoken to the media about this particular request.  [The complainant] had previously made several access requests … that had received much media attention and coverage and in a related privacy complaint [privacy complaint number], it had been determined that [the complainant] did not have any privacy interest in his name being revealed as a requester.  [The City’s legal counsel] believed that this new request was also in the public domain but has since acknowledged that he had no notes or other evidence that such was the case.

 

…

 

[The City’s legal counsel], however, also had the impression that [the complainant] had filed this request with the knowledge and perhaps the co-operation of [the affected person].  The wording of [the complainant’s] FOI request supports [the City’s legal counsel’s] belief there had been contact between the two parties with respect to the request, in that no one else other than the [affected person and other limited City officials] had knowledge about [certain facts referenced in the complainant’s request].  Certainly, City staff did not release this information to the general public and it was not mentioned in the media articles dealing with the [incident that is the subject of the complainant’s request].

 

The City submits that in such circumstances, it is arguable whether what is essentially a “confirmation” that the access request has been made by [the complainant] would constitute a “disclosure” of his personal information to [the affected person]. 

 

It is the City’s view that in any event, [the City’s legal counsel] would not have been required to seek the consent of [the complainant] to disclose information that [the affected person] appeared to have knowledge of and the “disclosure” to her would not have constituted a breach of his privacy.

 

…

 

If the “disclosure” of the complainant’s personal information to the [affected person] through her solicitor is, nevertheless, found to be a breach of [the complainant’s] personal information under the Act, the City submits that this breach was not intentional and it will take the appropriate steps to ensure that any future disclosures of personal information are made in accordance with the legislation.

 

Analysis

 

Although the City has indicated that its legal counsel was under the impression that the complainant had spoken to the media about this particular request, it has now acknowledged that there is no evidence that such was the case.  I too have no evidence to suggest that this particular request was placed in the public domain by the complainant or that the complainant did not have any privacy interests in his name being revealed as a requester. 

 

The City also submitted that its legal counsel was under the impression that the complainant had filed this request with the knowledge and perhaps the co-operation of the affected person.  This belief was based on some factual information referred to in the complainant’s request that was only known to the affected person and other limited City officials, but not to the general public. The City therefore takes the position that “it is arguable whether what is essentially a ‘confirmation’ that the access request has been made by [the complainant] would constitute a ‘disclosure’ of his personal information to [the affected person]”. 

 

Based on the City’s submissions, I am unable to conclude with certainty that the factual information in question was in fact provided to the complainant by the affected person.  Even if I were to find that the affected person did provide the complainant with the factual information in question, I am not persuaded that this, in itself, proves that the complainant subsequently filed his request with the knowledge and/or the cooperation of the affected person.  Therefore I find that the reference to the complainant by name and the fact that he made an access request in the City’s legal counsel’s letter to the affected person’s solicitor does constitute “disclosure” pursuant to section 32 of the Act.

 

Although the City did not rely on any specific provisions under section 32 to authorize the disclosure of the personal information in question, I have nevertheless examined all these provisions and find that none apply to the City's disclosure of the complainant's personal information to the affected person. Accordingly, I find that the disclosure of the personal information to the affected person’s solicitor was not in compliance with section 32.

 

I am, however, mindful of the fact that the relationship between the complainant and the City has been a difficult one and has involved numerous access to information requests, privacy complaints and appeals of City decisions to this office.  Similarly, others have also had dealings with the City regarding related and overlapping issues.  Given this context, I understand how legal counsel may have been under the impression that the complainant had spoken to the media about this particular request.  However, the prudent practice for the City in handling any access request, absent consent, is to always protect the identity of a requester under the Act. 

 

Given the above, I am of the view that the disclosure in question is an oversight.  In light of this, as well as the City’s commitment to take the appropriate steps to ensure that any future disclosures of personal information are made in accordance with the Act, it is not necessary to make any recommendations to the City in the circumstances of this case.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

(1)        The information in question is “personal information” as defined in section 2(1) of the      

            Act.

 

(2)        The disclosure of the personal information to the affected person’s solicitor was not in

       compliance with section 32 of the Act.

 

 

 

 

 

 

 

Original signed by:                                                                              August 10, 2005

Suzanne Tardif Investigator