PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-050017-1

 

 

Corporation of the City of Kingston

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-050017-1

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            Corporation of the City of Kingston

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) regarding the City of Kingston (the City).  The complainant is concerned that the City inappropriately disclosed her personal information.

 

Background

 

On March 17, 2004, the complainant (along with her spouse) applied for social assistance at an Ontario Works Office operated by the City. Under the Ontario Works Act, municipalities are delivery agents of the province of Ontario for the purpose of administering social assistance.  As part of this application, the complainant and her spouse signed a form titled “Consent to Disclose and Verify Information.”

 

Among other things, the form that was signed provides that the individual signing consents to having a representative of the delivery agent disclose or exchange personal information with any third party for the purpose of verifying eligibility for social assistance.

 

On May 26, 2004, a lawyer representing the complainant sent a letter to the City qualifying the consent provided by the complainant and her spouse.  Specifically, the letter stated that the City should not release the complainant’s personal information to any third party without the specific authorization of both the complainant and her spouse.

 

On August 19, 2004 an employee of the City’s Social Services Department transmitted a fax to the Citizenship and Immigration Department of the Government of Canada (CIC) requesting confirmation of the complainant’s immigration status within Canada.  The fax contained information relating to the complainant and her spouse.

 

Based on her concern that this fax transmission constituted an inappropriate disclosure of personal information under the Act, the complainant filed a complaint with the IPC.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(d)                the address, telephone number, fingerprints or blood type of the individual,

 

...

 

(h)             the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

... .

 

I have examined a copy of the fax that was transmitted to the CIC.  The fax contains a cover sheet requesting the immigration status of the complainant and her spouse.  The second page of the fax contains the complainant’s name, her date of birth, her address and her telephone number. The third page of the fax contains similar information pertaining to the complainant’s spouse. The fax also contains the Consent to Verify and Disclose Information form that was originally signed by both the complainant and her spouse.

 

I am satisfied that this information qualifies as the complainant’s personal information under the Act.  Neither the complainant nor the City disputes this conclusion.

 

Was the disclosure of the “personal information” in accordance with section 32 of the Act?

 

The privacy provisions of the Act are premised on the notion of a balance between the right to privacy, and the need of government institutions to collect, use and disclose personal information for the purposes of administering its programs.

 

With respect to the disclosure of personal information, this balance is reflected in section 32 of the Act, which expresses a general prohibition on the disclosure of personal information, but states that personal information may be disclosed in certain enumerated exceptional circumstances.  If any one of the enumerated exceptions applies to a given set of circumstances, the disclosure would be deemed to be in accordance with the Act.

 

In this case, I have reviewed section 32, and note that there are a number of exceptions that may apply to make the disclosure in question permissible. Section 32 of the Act states, in part:

 

An institution shall not disclose personal information in its custody or under its control except,

 

…

 

(b)               if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

(c)                for the purpose for which it was obtained or compiled or for a consistent purpose;

 

…

 

(e)             for the purpose of complying with an Act of the Legislature or an Act of Parliament or a treaty, agreement or arrangement there under;

 

…

 

(h)          in compelling circumstances affecting the health or safety of an individual if upon disclosure notification is mailed to the last known address of the individual to whom the information relates;

 

… .

 

In general, in order for a given disclosure of personal information to be in accordance with the Act, it must be shown to be in accordance with at least one of the provisions contained in section 32 of the Act.

 

Below, I will consider the application of each provision in chronological order.

 

Section 32(b)

 

Section 32(b) provides that an institution may disclose personal information where the individual has consented to its disclosure.

 

In this case, the individual in question had signed a consent form authorizing the general disclosure of her personal information.  However, she had subsequently qualified this consent (through a letter written by her lawyer) by expressing that her personal information should not be disclosed to any third parties without the consent of the complainant and her spouse.

 

I am satisfied that the letter sent by the complainant’s lawyer constitutes a valid revocation of the complainant’s original consent.  As such, section 32(b) does not apply to make the disclosure permissible.

 

However, notwithstanding the fact that consent was revoked, the disclosure in question would be deemed to be permissible if it can be shown to be in accordance with one of the other section 32 provisions, which I will consider below.

 

Section 32(c)

 

Section 32(c) of the Act provides that institutions are permitted to disclose personal information for the same purpose for which that information was obtained or compiled or for a purpose that is consistent with that original purpose.

 

Section 33 of the Act provides direction to assist in determinations of whether a given disclosure of personal information is in accordance with the section 32(c) “consistent purpose” provision of the Act, and states:

 

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 31(b) and 32(c) only if the individual might reasonably have expected such a use or disclosure [emphasis added].

 

Therefore, in order to determine whether section 32(c) applies, it is necessary first to assess the purposes of both the collection and the disclosure of the information in question. Second, it is necessary to determine whether these purposes are consistent with one another. Section 33 provides guidance in determining whether a consistent purpose is present under a given set of circumstances.

 

In terms of the purpose of the collection of personal information, this information was collected in accordance with the City’s legal authority, as an administrator under the Ontario Works Act, to collect personal information about individuals that apply for social assistance.  This authority is set out in section 17(2) of the General Regulation (Ontario Regulation 134/98) made under the Ontario Works Act, which allows administrators to collect basic information about social assistance applicants in order to determine and verify the eligibility of those applicants to receive social assistance.

 

Section 17(2) of the General Regulation to the Ontario Works Act states:

 

17(2) The administrator may require an applicant to provide information necessary to determine and verify the applicant’s eligibility for basic financial assistance, including the following information with respect to any member of the benefit unit:

 

…

 

9.                  Information with respect to the person’s status in Canada. 

 

… .

 

With respect to the purpose of the disclosure of information, according to materials provided by the City, the disclosure took place to enable the City to confirm the immigration status of the applicant.  Where an administrator (such as the City) is unable to confirm a client’s immigration status, section 14 of the Ontario Works Act requires that administrators must either deny or suspend the applicant’s social assistance.  Thus, the City was required to either confirm status by making the disclosure, or was required to cease providing social assistance.

 

In the event that the City was unable to confirm status, the City would have been required, under section 24 of the Ontario Works Act, to issue a notice of its decision which would also inform the recipient of their right to appeal that decision to the Social Benefits Tribunal. The Ontario Works Act also establishes that the applicants may be eligible for interim assistance while awaiting a Social Benefits Tribunal hearing.

 

Having identified the purposes of both the City’s collection and disclosure of personal information, it is now necessary to consider whether these purposes are consistent with one another. In carrying out this analysis, it is necessary to consider the application of section 33 to determine whether the consistent purpose threshold in section 32(c) is met.

 

In this privacy complaint, my objective is to determine whether an individual in the complainant’s position, being mindful of all of the relevant circumstances, might reasonably have expected the disclosure in question to have taken place. If I deem that it is reasonable that the disclosure should have been expected, this would lead me to the conclusion that the disclosure was in accordance with section 32(c), and therefore in accordance with the Act.

 

In this case, the relevant circumstances that were known to both parties include:

 

•         That the complainant had revoked her original consent to the disclosure of her information.

 

•         That the complainant had asserted that she and her spouse had made a claim to become convention refugees;

 

•         That the City had informed both the complainant and her lawyer that the complainant’s status as a refugee claimant had to be confirmed; and

 

•         That failure to confirm status would have resulted in the City having to initiate the process set out in the Ontario Works Act to suspend support payments.

 

In support of the position that the City’s disclosure was not permissible, the complainant (through her representative) has advanced two arguments. The first argument is that the complainant’s revocation of her original consent to the disclosure should have been considered by the City, and it should have prevented the City from disclosing the information in question to CIC.

 

The second argument relates to concerns previously expressed by the City that its failure to confirm status could have resulted in the suspension of payments and could have resulted in harm to the complainant and her family. The complainant has disputed that this is a legitimate concern and has pointed out that it was likely, had support been suspended, that the family would have been able to receive an interim order of support from the Social Benefits Tribunal.

 

I have carefully considered the positions put forward by both parties to this privacy complaint.

 

In this case, the City had deemed it necessary to confirm the complainant’s status with CIC in order to satisfy its administrative responsibilities as a delivery agent for the provincial Ontario Works program. This position is supported by the wording of section 6(1)(2)(i) of the General Regulation made pursuant to the Ontario Works Act, which states:

 

6.  (1)  The following persons are not eligible for assistance:

…

2.                  A person who is a visitor, unless the person,

 

 

i.                    has made a claim for refugee status under the Immigration Act (Canada),

 

ii.                  has made a claim for refugee protection under the Immigration and Refugee Protection Act (Canada), … .

 

This provision makes clear that one of the circumstances where a visitor is entitled to receive social assistance is where that person has made a claim for refugee status under Canada’s Immigration Act. In this case, the City has maintained that it was obligated to either confirm status with CIC, or initiate the process whereby it would cease making the complainant’s support payments.

 

Although the City had received written instructions from the complainant not to disclose any of her personal information to any third parties, the City decided, notwithstanding the complainant’s request, that it was required to contact CIC in order to properly document the status of the complainant as an Ontario Works client, and to comply with its responsibilities set out in sections 6(1)(2) and 17(2) of the Regulation to the Ontario Works Act.

 

In general, under the privacy protection provisions of the Act, the mere fact that someone has requested confidentiality with respect to certain information does not, in itself, provide an absolute prohibition on the disclosure of that information. This principle is reflected in the wording of the Act (which does not require consent for all disclosures of personal information) and is supported by compelling public policy considerations. To conclude otherwise would unduly restrict the ability of government institutions, faced with a request of confidentiality from an individual, to disclose personal information where a legal requirement, or some other consideration makes it prudent, and correct, to do so.

 

On the contrary, and as expressed above, the Act (and specifically section 32(c)) is premised on the notion of balance between the right to personal privacy and the right of institutions to collect, use and disclose personal information as required in order to carry out legitimate activities. Where an institution can demonstrate that a disclosure of personal information has taken place for a purpose that is consistent with the reason it was collected in the first place, that disclosure is correctly deemed to be permissible under the Act.

 

In applying this general principle to the facts of this case, the complainant’s request for confidentiality must be considered in light of both the City’s legal and administrative requirement to confirm status, as well as the complainant’s assertion that her family was in the process of applying for refugee status.

 

To have continued providing payments to the complainant without proper documentation would have placed the City in a position where it was in breach of its duties as a delivery agent for the province. According to the website of the Ministry of Community and Social Services, (which is the Ministry responsible for Ontario Works) the Ministry engages in random audits of delivery agent files in order to ensure all eligibility decisions are properly documented.[1]

 

In considering whether the City’s actions are permitted under the Act, I am also mindful of the complainant’s claim that the suspension of her family’s benefits would not have resulted in a risk of imminent harm, as there would have been an option of applying for interim support. (Previously, the City had made reference to the fact that the complainant and her spouse were the parents of a young child and had stated that this consideration was a factor in its decision to disclose the information).

 

Although both parties have made reference to the potential risk (or lack thereof) of harm to the complainant’s child, I do not feel that this potential risk is a primary consideration in determining whether the City’s actions were permissible in this case. Rather, I have focused on whether the purpose of the City’s disclosure of the information was consistent with the purpose of its collection in accordance with section 32(c). (Potential risk of harm is a factor that could be considered in a section 32(h) analysis).

 

In making the decision to contact CIC, the City concluded, that based on the complainant’s assertion that a refugee application was pending, it was appropriate to contact CIC to confirm that it had information about the complainant and her family on file. Based on the complainant’s prior assertion, the City was not disclosing information that would have been novel to CIC, and was therefore not violating the spirit of the instructions that had previously been provided.

 

Because the complainant had previously expressed to the City that a refugee application was pending, I am satisfied that in her circumstances, it would have been reasonable to expect the City to contact CIC to confirm whether this information was correct. Therefore, the disclosure in question was “reasonably expected” within the meaning of section 33.

 

Based on all of the above, I am satisfied that the purpose of the City’s disclosure of the complainant’s personal information to CIC (to confirm the complaint’s status as a refugee claimant) was consistent with the purpose for which it was collected (to administer its responsibilities as a delivery agent for Ontario Works). I therefore conclude that the disclosure was in accordance with section 32(c).

 

Sections 32(e) and 32(h)

 

Having determined that the disclosure in question was permissible under section 32(c), it is not necessary for me to consider the application of sections 32(e) or 32(h).

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

•         The information in question qualifies as personal information as defined in section 2(1) of the Act.

 

•         The disclosure of the personal information was in accordance with section 32(c) of the Act.

 

 

 

 

 

 

 

 

Original Signed by                                                                              August 2, 2006           

Mark Ratner Investigator