PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-050018-1

 

 

City of Toronto

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-050018-1

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            City of Toronto

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) involving the City of Toronto (the City).  The complainant was an applicant for a position on the City’s Licensing Tribunal (the Tribunal), which is a Tribunal that conducts hearings on licensing matters under City by-law 547-2000.

 

As part of the application process, the complainant (along with the other candidates) were required to complete an examination that included an assessment of their skills and understanding of the requirements of the position.  The test was administered by staff within the City Manager’s office and was anonymously marked by senior civil servants working for the City.

 

Prior to taking the test, all applicants (including the complainant) were required to complete an application package. Included in the written package was information about the application process, which included the following statement:

 

Applications will be treated as confidential and applicants’ names remain confidential until Council appoints them. We will then send a letter, advising of Council’s decision, to everyone who applied to the Toronto Licensing Tribunal.

 

After the test was completed, the City Manager’s office provided a copy of the names and test results of the candidates to a subcommittee of the City’s Planning and Transportation Committee, (the P&T subcommittee) which was responsible for interviewing candidates and using the test results to compile a list of recommended candidates.

 

After being provided with the test scores, the P&T subcommittee interviewed high-scoring candidates and put together a list of 4 “recommended” candidates, which was provided to Council.  The complainant was not included on the list of recommended candidates.

 

Although Council was initially only provided with a list of all the recommended candidate names without test scores, Council subsequently requested that the City provide Council with a full list of all candidate names as well as the corresponding test scores for each candidate.

 

The City Manager’s office initially objected to providing this information to Council on the basis that candidates had been provided with assurances that their results would remain confidential.  However, in order to allow Council to properly decide on the Tribunal vacancies, the City Manager’s office eventually agreed to provide Council with the information requested on a confidential basis.  In order to protect the applicant’s confidentiality, the results would be provided to Council during an in camera meeting of City Council.

 

As such, the names and test scores of all of the applicants for positions with the Tribunal were provided to City Council to be considered during in camera sessions of Council that took place on October 25, 26 and 27.  The information in question appeared via both an overhead projection, and via confidential paper handouts that were collected from Councillors at the end of the meeting.  This information was provided to Council under an express condition of confidentiality.

 

On November 8, 2004, the complainant’s name, along with his test score appeared in an article in the Toronto Star newspaper.

 

Based on his concern that his personal information had been disclosed in contravention of the Act, the complainant filed a privacy complaint with the IPC.

 

STEPS TAKEN BY THE INSTITUTION TO DATE

 

After becoming aware of the Toronto Star article, the City took a number of steps to address the disclosure of information.

 

• Upon being contacted by the complainant, the City sent a letter of apology to the complainant expressing regret over the disclosure.  The letter was signed by the Chief Administrative Officer of the City.

 

• Upon request, the City provided the complainant with a copy of the transcript of his test.  However, the City did not provide the complainant with a copy of the marking criteria that was used to assess the test.  The City explained that it wanted to keep its marking criteria confidential so that it may be able to use the same test again in the future.

 

• Upon being notified that a privacy complaint had been filed with the IPC, the City’s Corporate Access and Privacy Office (CAP) decided to initiate an internal investigation into the matter.  The results of this investigation were provided to the IPC.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(c)                any identifying number, symbol or other particular assigned to the individual,

 

…

 

(h)               the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual … .

 

In this case, the information at issue is the complainant’s name as well as the score he received on a test administered by the City.  I am satisfied that this information clearly fits within the definition of “personal information” set out above.  The City does not dispute this.

 

Was the disclosure of the “personal information” in accordance with section 32 of the Act?

 

Section 32 of the Act establishes a general prohibition on the disclosure of personal information but sets out a series of statutory exceptions where personal information may be disclosed.  In sum, the provisions of section 32 are in place to protect the privacy of personal information while balancing this right against the need of government institutions to disclose personal information as necessary to carry out their legitimate activities.  In order to determine whether a given disclosure of personal information is in accordance with the Act, it is necessary to assess whether the disclosure complies with section 32, which states, in part:

 

An institution shall not disclose personal information in its custody or under its control except,

 

…

 

(c)                for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(d)               if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution’s functions;

 

…

 

At issue in this privacy complaint are three separate disclosures of the complainant’s personal information:

 

1. The disclosure of the complainant’s name and test results from the City Manager’s Office to the P&T subcommittee.

 

2. The disclosure of the complainant’s name and test results from the City Manager’s Office to City Council.

 

3. The disclosure of the complainant’s name and test results to a reporter with the Toronto Star newspaper.

 

I will deal with each disclosure in chronological order.

 

Was the disclosure of the complainant’s name and test results to the P&T subcommittee in accordance with section 32 of the Act?

 

In its investigation, the CAP concluded that the complainant’s name and test score had been provided by the City Manager’s office to the P&T subcommittee, which had been created in order to assess the applications of candidates for positions on the Tribunal.

 

I have reviewed the provisions contained in section 32 of the Act, and I am satisfied that section 32(c) may apply to make the disclosure permissible.  This section permits the disclosure of personal information:

 

(c)                for the purpose for which it was obtained or compiled or for a consistent purpose … .

 

This provision allows institutions to disclose personal information for the same purpose for which it was collected, or for a consistent purpose.

 

With respect to this disclosure, the City has stated:

 

The disclosure of the name and test results to the sub-committee was necessary and proper in the discharge of the institution’s functions pursuant to by-law 547-2000, section 4(3) which confers City Council with the responsibility for appointments to the Toronto Licensing Tribunal.

 

I have reviewed the provisions of the applicable by-law and have confirmed that City Council is responsible for selecting individuals to sit on the Tribunal.  Furthermore, I am satisfied that the City acted properly in delegating the responsibility of assessing the candidates to the P&T subcommittee, which is a subcommittee comprised of three members of City Council.

 

In this case, the information in question was “obtained or compiled” by the City Manager’s office at the time the test was administered, and the scores were created once the tests were marked.  The purpose of this collection, therefore, was solely to assess the suitability of the various candidates for positions on the Tribunal.  The information was subsequently disclosed to the P&T subcommittee for the purpose of allowing the subcommittee to evaluate the results and create a list of recommended candidates.

 

Based on this analysis, I am satisfied that the purpose for which the personal information was obtained or compiled (to test candidates) was consistent with the purpose for which it was disclosed (to allow the P&T subcommittee to evaluate, and prepare a ‘short-list’ of candidates).  As such, I am satisfied that this information was disclosed in accordance with section 32(c) of the Act.

 

Was the disclosure of the complainant’s name and test results to City Council in accordance with section 32 of the Act?

 

The information relating to the complainant’s test scores were disclosed to City Council in two forms.  First, the information (along with the test scores of the other candidates) was disclosed on an overhead projection; and second, the information was disclosed in paper form to all Council members.  Both of these disclosures took place during in camera sessions of City Council, which took place on October 25, 26 and 27, 2004.

 

With respect to these disclosures, I have reviewed the provisions of section 32, and am satisfied that there are two provisions of the Act that may apply to make the disclosures permissible: section 32(c) and section 32(d).

 

As discussed above, section 32(c) permits an institution to disclose personal information where the disclosure is for the same purpose for which it was originally collected, or where the disclosure is for a consistent purpose.

 

In this case, (similar to the disclosure above) the purpose of the disclosure to City Council was to allow Council to vote on the list of recommended candidates that had been put forward by the P&T subcommittee.

 

Section 4(2) City of Toronto By-law 574-2000 states:

 

The Toronto Licensing Tribunal shall be composed of no more than (7) members who shall be appointed by City Council [emphasis added].

 

This by-law provision makes clear that Council as a whole is ultimately responsible for determining the composition of the Tribunal.  The way in which it exercises this power is through assessing, and voting on the candidates.  Although Council acted properly by delegating the responsibility of creating a short list of recommended candidates to the P&T subcommittee, it is Council as a whole that bears the ultimate responsibility of deciding on who to appoint.

 

It is notable that all applicants for positions on the Tribunal had been provided with assurances that their application information would be treated as confidential.  In order to respect the applicant’s confidentiality, the City Manager’s office decided to disclose the information in an in camera Council session.  The City based its decision to provide the information to Council on, in part, section 27-15B(6) of the City’s Municipal Code, which makes clear that Council members are required to keep information obtained during in camera sessions confidential.  That provision states:

 

B. No member shall:

 

…

 

(6) Where a matter has been discussed in camera, and where the matter remains confidential, disclose the content of the matter or the substance of the deliberations of the in camera meeting … .

 

I am therefore satisfied that the purpose of the disclosure of this personal information (to allow Council to assess, and vote on candidates) was consistent with the purpose of the collection (to test the candidates), and I am satisfied that this disclosure was in accordance with section 32(c) of the Act.

 

Having made this determination, it is not necessary for me to consider whether the disclosure was in accordance with section 32(d) of the Act.

 

Was the disclosure of the complainant’s name and test results to the Toronto Star reporter in accordance with section 32 of the Act?

 

Once City Council was presented with a list of candidate names and test scores, Council voted on, and approved the P&T subcommittee’s list of recommended candidates.

 

In the days following Council’s decision, an article appeared in the Toronto Star newspaper discussing the appointments.  The complainant’s name, along with a test score attributed to him, was printed in the article.

 

Because Council’s decision took place during a closed meeting, the disclosure to the reporter who authored the story must have come from someone who was present at the meeting, or from a City employee that had been privy to the test results.

 

From its investigation into the matter, the City’s Corporate Access and Privacy Office concluded that it was probable that the disclosure to the reporter came from a member of City Council, rather than a civil servant working for the City.  This conclusion was based on the following factors:

 

•         That access to the test scores among City staff was limited to a small number of senior civil servants.  In order for the disclosure to have come from one of these civil servants, it would have had to come from an individual who was well acquainted with privacy protection measures and who had previously demonstrated a commitment to the secure storage of information in the custody of the City.

 

•         That the Toronto Star article in question included quotations from City Councillors alluding to the testing procedure; and

 

•         That the City’s Integrity Commissioner had previously reported that disclosures of confidential information to the press by members of City Council are a common occurrence.

 

In support of the third point, the City’s Investigation Report includes a statement by David Mullan, Integrity Commissioner for Toronto that appeared in a memorandum that was issued to City Council, which states:

 

First term Councillors in particular tended to be astonished at the extent to which there are leaks to the media of confidential material, and most placed the blame for this primarily on their colleagues, not staff. On the part of some long-serving Councillors, there was almost a sense of resigned acceptance of the inevitability of the continuation of leaks. …  The attitude of this group was very much to the effect that leaks are an ingrained part of the culture of City Hall, so one should not entrust to the system any information that you want kept confidential.

 

In addition, during the course of this Investigation, I spoke with the reporter who authored the article in question that contained the test score.  The journalist did not provide any information that contradicted the City’s conclusion.

 

Based on the information provided to this office, I am satisfied that the City’s conclusion, (that the disclosure to the reporter originated with a member of Council) is reasonable, and I accept this explanation for the purposes of this Report.

 

Having made this determination, it is necessary to consider whether the actions of members of City Council are subject to the provisions of the Act.

 

In the past, the IPC has concluded that City Councillors are not considered to be “officers or employees” of an institution (see Order MO-1264).  However, the activities of City Councillors may be subject to the provisions of the Act if those activities relate to personal information that is in the custody or control of a municipality.  The responsibilities of City Councillors as custodians of City information was addressed in Privacy Complaint MC-020030-1.  That privacy complaint involved the disclosure of an e-mail containing personal information by a Niagara Falls City Councillor, and stated:

 

As regards disclosure by a councillor other than the Mayor, I have already concluded that City councillors are neither officers nor employees of the City. Nevertheless, records in the possession of a councillor are subject to the Act if they are within the custody or control of the City.  This assessment depends, in part, on whether the information was held by the councillor solely in his or her capacity as a constituent representative and never integrated into the municipality’s files (Orders M-846, M-813).  In this case, I have concluded that the information related to City business and was not solely a constituency matter, as indicated by the fact that the information was originally provided to the councillors by the City.

 

In Order 120, former Commissioner Sidney B. Linden set out a list of factors to consider in deciding whether records are within an institution's custody or under its control.  Whether the record was created by an officer or employee of the institution, and whether its content relate to the institution's mandate and functions are both identified as factors to consider, and in my view, these factors, in addition to the fact that the City provided the information to the councillors, and that it did not pertain to constituency matters, all support the conclusion that the e-mail remained within the City's control.  I have therefore concluded that, in the councillors' hands, the e-mail was under the City's control.

 

I have reviewed the facts of this privacy complaint, and I am satisfied that similar considerations apply.  In this case, the information in question was information relating to the results of a test administered by the City for the purpose of selecting individuals to sit on a City tribunal.  The records were created by City employees who administered and marked the tests, and were provided to Council in a confidential manner, and at all times, remained within the City’s control.  In keeping with the reasoning set out in MC-020030-1, I am satisfied that City Council’s actions in relation to this information are subject to the privacy requirements set out in the Act.

 

Having determined that the actions of City Councillors are subject to the Act in this instance, I have reviewed the provisions of section 32 of the Act, and I am satisfied that there are no provisions in the Act that would operate to make the disclosure in question permissible.  In addition, as discussed above, it is notable that disclosing information obtained during an in camera session of Council to the media constitutes a contravention of section 27-15B(6) of the City’s Municipal Code.

 

As such, I conclude that the disclosure of the complainant’s name and test score to the reporter with the Toronto Star was not in accordance with section 32 of the Act.

 

In addition to the disclosure of the complainant’s personal information, an additional concern relates to the City’s security practices involving personal information. Section 3(1) of Regulation 823 (the General Regulation under the Act) states:

 

Every head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.

 

This provision mandates that institutions put measures in place to protect sensitive information, including records of personal information.  In this instance, despite the City’s attempt to maintain the security of the personal information by collecting copies of the test results at the end of the meeting, the fact that confidential test results were disclosed to a reporter in contravention of section 32 of the Act indicates that “reasonable measures” to protect that information were either lacking, not in place, not completely understood, or ignored by Council.  In addition, the memorandum issued by the City’s Integrity Commissioner further calls attention to the need for City Council to improve the way in which it handles sensitive information, including personal information.

 

In light of these shortcomings, I will make recommendations addressing the need for City Council to improve its practices with respect to personal information. These recommendations appear below.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

•         The information in question qualifies as “personal information” as defined in section 2(1) of the Act.

 

•         The disclosure of the complainant’s name and test score to the P&T subcommittee was in accordance with section 32(c) of the Act.

 

•         The disclosure of the complainant’s name and test score to City Council was in accordance with section 32(c) of the Act.

 

•         The disclosure of the complainant’s personal information to the Toronto Star reporter was not in accordance with the Act.

 

RECOMMENDATIONS:

 

In light of the conclusions contained in this Report, I recommend that the City take steps to ensure that personal information is disclosed only in accordance with section 32 of the Act.  Specifically, I make the following recommendations:

 

1. The City should circulate this Report to all City Councillors.

 

2. That all City Councillors should be provided with a copy of the booklet titled Working with the Municipal Freedom of Information and Protection of Privacy Act:  A Councillor’s Guide, which has been published by the IPC in partnership with the City of Ottawa.

 

3. That the City develop a privacy protocol addressing how City Councillors should deal with personal information that is handled by City Council.

 

4. That the City take steps to educate City Councillors on the protocol developed under Recommendation 3.

 

By July 31, 2006 the institution should provide the IPC with proof of compliance with the above recommendations.

 

 

 

 

 

 

 

Original signed by:                                                                              April 27, 2006

Mark Ratner Investigator