PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC07-21

 

 

Ministry of Transportation

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   PC07-21

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            Ministry of Transportation

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a privacy complaint from an individual involving the Ministry of Transportation (MTO). In the complainant’s opinion, MTO had improperly disclosed her personal information to a private investigator in contravention of the provisions of the Freedom of Information and Protection of Privacy Act (the Act).  The complainant provided the following information.

 

The complainant, a worker with a child protection agency, had made a recommendation respecting the custody of a child in a client’s care.  Under the agency’s process, the worker’s recommendation was subject to review by a tribunal.

 

During the tribunal hearing, the complainant became aware that the client had hired a private investigator that was employed by an investigation company to follow the complainant.  As a result, the tribunal ordered that the complainant be provided with a copy of the investigator’s report.

 

The private investigator’s report indicated that he had conducted a search through the MTO driver’s licence database and was able to obtain:

 

• the complainant’s residential address,
• the complainant’s driver’s licence number,
• the complainant’s date of birth, and
• information stating that the complainant is the registered owner of the vehicle.

 

 

 

The private investigator also checked the licence of a second car that was parked in the complainant’s driveway, which belonged to the complainant’s spouse, and was able to obtain similar information pertaining to the complainant’s spouse. In addition, a copy of the investigator’s report containing this information had also been provided to the client who had hired the private investigator following the complainant’s recommendation.

 

The complainant feels that the disclosure of her personal information and the personal information of her spouse by MTO to the private investigator was inappropriate and in contravention of the provisions of the Act.

 

Background Information on the Complaint

 

In response to the complaint, MTO provided background information to the IPC on the Authorized Requester Program (ARP), which is the MTO program through which the private investigator was able to obtain information pertaining to the complainant.

 

Under the ARP, certain entities are permitted to access residential address information that is contained in the MTO driver licence database. MTO has stated that the entities that qualify for the ARP are those that have been approved and have entered into an Authorized Requester Agreement with MTO.

 

In the information provided to the IPC, MTO elaborated on the ARP and stated:

 

All applications to become an Authorized Requester are carefully reviewed and applicants must meet strict criteria as well as provide their regulated licences where applicable, before being approved. Once approved, they enter into a legal agreement with the ministry that stipulates the terms and conditions under which they can access, use, disclose and retain personal information. On an ongoing basis, the ministry enhances its stewardship role of safeguarding the personal information in its databases. For example, the ministry actively verifies that its clients maintain their business registration… . The ministry also requires its clients to re-verify on an annual basis that the information provided at the time their application was approved is still valid and up-to-date.

 

The Authorized Requester Agreement described above provides that an authorized requester may only use the residential address information for one of 13 specific enumerated purposes, including safety recalls, law enforcement, and for legal investigations.  Examples of authorized requesters include insurance companies, lawyers, private investigators, and debt collectors.  In the subject complaint, the private investigation company is an authorized requester.

 

MTO stated that it actively monitors the ARP and ensures that authorized requesters maintain business registrations and operating licences.  In addition, MTO has established a Management Assurance Framework, which includes a web-based training tool for authorized requesters, reminder letters, desk audits, systemic on-site audits, annual self-assessments, and Assurance Declarations/Certificates.  The Management Assurance Framework also provides for progressive sanctions as necessary.  MTO stated that it has cancelled contracts with authorized requesters that have failed to comply with audit requirements.

 

MTO also provided information on the private investigation company that had been hired to follow the complainant and has stated:

 

[The private investigation company] receives the information under an AR legal agreement with the ministry for the purpose of conducting legal investigations which may give rise to legal proceedings.  It is licensed to conduct private investigations by the province through the Ministry of Community Safety and Correctional Services under the Private Investigators and Security Guards Act.

 

In response to this incident, the complainant advised that she wrote to MTO explaining where she works, the type of work she does, that she was involved in the removal of a client’s children from the client’s custody/care and that the client hired a private investigator to gather information about her.  She further advised MTO that she had obtained a copy of the private investigator’s report.  In her letter to MTO, she cited a specific paragraph of the report that noted her driver licence number, date of birth and her home address.  In addition, the complainant also asked a number of questions regarding the ARP.  The complainant subsequently filed a formal freedom of information request (FOI).

 

In response to the draft Privacy Complaint Report, MTO was of the view that the complainant, in her letter, did not provide any evidence of a use or disclosure of her personal information by the private investigation company that was contrary to their Authorized Requester Agreement with MTO, but instead advised that she was concerned with the disclosure of her information and posed a number of questions relating to the disclosure.  MTO was of the view that the combination of questions about the ARP and the formal FOI request did not constitute a complaint that warranted investigation.

 

MTO further stated that they had not received any information from the complainant pointing to a breach of the agreement, rather, her concerns related to the fact that MTO had disclosed her personal information.  MTO is of the view that such a disclosure would not, by itself, be seen by it as constituting a privacy breach requiring investigation.  MTO advised that it became aware of the complainant’s privacy complaint, which included an extract from the private investigator’s report, after it had been submitted to our office.

 

I reviewed a copy of the complainant’s letter to MTO, as well as a copy of the private investigator’s report and the Authorized Requester Agreement between MTO and the private investigation company. 

 

I note that, contrary to MTO’s statement, the complainant, in her letter to MTO, did clearly quote an excerpt of the private investigator’s report that provides the complainant’s name, driver’s licence number, date of birth and her home address. This fact demonstrates that this information had been provided to the client in contravention of confidentiality provision of section 5 of the Authorized Requester Agreement between MTO and the private investigation company.

 

In my view, when MTO received the complainant’s letter with the excerpt noted, it should have been enough to warrant an investigation by MTO and an immediate audit of the private investigation company to determine whether its use and disclosure of the complainant’s personal information, as well as the potential use and disclosure of other individuals personal information, was in accordance with the terms of the Authorized Requester Agreement.

 

It is notable however, that MTO did eventually hire an independent auditor to conduct an audit of the private investigation company several months after the initial letter of complaint to MTO.

 

MTO stated that the auditor’s investigation revealed that the private investigation company had made an improper disclosure of the complainant’s personal information, which was contrary to the terms of the Authorized Requester Agreement.  MTO advised that as a result, it decided to sanction the private investigation company and suspended its access to the MTO database for a period of three months.  Further, MTO has stated that any further failure to comply with any of the terms or conditions of the Authorized Requester Agreement may result in the termination of the Agreement and the private investigation company’s account with MTO.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

At issue in this complaint is the information that was provided by MTO to the private investigation company.  The information includes:

 

• the complainant’s address,
• the complainant’s driver’s license number,
• the complainant’s date of birth, and
• information stating that the complainant is the registered owner of the vehicle.

 

In addition, MTO provided similar information regarding the complainant’s spouse.

 

The definition of “personal information” is set out in section 2(1) of the Act, which states in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(c)                any identifying number, symbol or other particular assigned to the individual,

 

(d)               the address, telephone number, fingerprints or blood type of the individual,

 

…

 

(h)               the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

Based on the above definition, I am satisfied that the information in question clearly qualifies as “personal information” under the Act.  I note that MTO concurs with this position.

 

Was the disclosure of the “personal information” in accordance with section 42 of the Act?

 

Section 42(1) of the Act imposes a general prohibition on the disclosure of personal information but states that personal information may be disclosed in a number of enumerated exceptional circumstances. Section 42(1) states, in part:

 

An institution shall not disclose personal information in its custody or under its control except,

 

…

 

(c)                for the purpose for which it was obtained or compiled or for a consistent purpose;

 

…

 

In order for a given disclosure of personal information to be permissible under the Act, the institution in question must demonstrate that the disclosure was in accordance with at least one of the section 42(1) exceptions.

 

In this instance, MTO has taken the position that its disclosure of the complainant’s personal information to the private investigator was in accordance with section 42(1)(c), (i.e., that the disclosure had taken place for the original purpose for which it had been obtained or compiled, or for a purpose that was consistent with that original purpose).

 

In determining whether a given disclosure of personal information is in accordance with section 42(1)(c), it is first necessary to determine the original purpose of the collection.  Next, it is necessary to assess whether the disclosure of this information can be properly characterized as being either for the original purpose of the collection, or for a purpose that is consistent with that original purpose.

 

In information provided to the IPC, MTO has stated:

 

Personal information is collected by MTO under the authority of section 205 of the Highway Traffic Act. The information is used for creating a record that is maintained as a public record and used for the administration of the ministry’s driver, vehicle and carrier programs.

 

Section 205 of the Highway Traffic Act sets out the duties of the Registrar of Motor Vehicles for the province of Ontario, which include, among other things, the maintenance of records relating to licences in the province. Section 205(1) states, in part:

 

205.          (1)  The Registrar shall, …

 

(c) keep,

 

(iii) a record of all licences, permits and CVOR certificates issued,  suspended, revoked, cancelled or revived under this Act … .

 

I have reviewed MTO’s notice of collection appearing on its website, which states:

 

Personal information is collected by the Ministry of Transportation under the authority of section 205 of the Highway Traffic Act. The information is used for creating a record that is maintained as public record and used for the administration of the ministry’s driver, vehicle and carrier programs. Notwithstanding the above and subject to the paragraph below, residence address information which is collected, is not part of the public record and is not available to the general public.

 

Only “authorized” requestors who have been approved and have entered into a contractual agreement with the ministry may obtain residence address information for the purposes set out below:

 

•         Safety recalls by auto manufacturers

•         Law enforcement

•         Service of documents and for legal investigations which may give rise to legal proceedings (i.e., from lawyers, process servers, private investigators and security guards and for locating persons in connection with claims/ litigation/ accidents)

•         Verification of information by financial institutions

•         Debt collection

•         Road toll collection (i.e., 407-ETR)

•         Postal code verification (first 3 digits only)

•         Key tag service (War Amps)

•         Automobile insurance purposes

•         Parking violations

•         Government use for program delivery where authorized by statute

•         Statistical/Educational (research by educational, research organizations)

 

•         Public Interest - for example, compassionate circumstances to facilitate contacting next of kin or friend of individual who is in crisis, injured, ill or deceased, with confirmation by police or medical practitioner

 

[emphasis added].

 

Based on the information provided by MTO, along with the information contained in the notice, above, I am satisfied that the purpose of MTO’s collection of driver personal information is to administer MTO’s driver, vehicle and carrier programs.

 

The next step in the section 42(1)(c) analysis is to determine whether the disclosure was for the original purpose of the collection or for a purpose that was consistent with that original purpose.

 

In this instance, it is clear that the disclosure of the complainant’s personal information to the private investigator was for a purpose unrelated to the core functions of MTO, and was therefore not for the original purpose of the collection.  The investigator was hired by an individual for purposes unrelated to the administration of MTO’s driver, vehicle and carrier programs.

 

MTO’s position is that the disclosure constitutes a “consistent purpose” under the Act. Section 43 of the Act provides clarification on whether given disclosures of personal information constitute a “consistent purpose” under the Act, by imposing a “reasonable person” test.

 

Section 43 states:

 

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(1)(b) and 42(1)(c) only if the individual might reasonably have expected such a use or disclosure.

 

In support of the position that the disclosure was for a “consistent purpose” MTO stated:

 

Disclosure of address information subject to the terms and conditions of the [authorized requester] agreement is a consistent purpose under section 42(1)(c). …[T]he public notices of collection posted by the ministry advise the public that address information may be made available to private investigators for use in legal investigations that may give rise to legal proceedings. The ministry takes the position that the well-known nature of the program, the participation of the IPC in its development, the controls to which the [authorized requesters] are subject, and the explicit reference to the disclosure to private investigators in the notice of collection makes the disclosure a consistent purpose disclosure, as it is a disclosure reasonably expected by individuals, as set out in section 43 of the Act.

 

MTO has further stated:

 

Only Authorized Requesters (AR) who have been approved and have entered into a contractual agreement with the ministry may obtain residential address information under any of 13 specific purposes, such as safety recall by auto manufacturers, law enforcement, automobile insurance purposes, parking violations, regulated business activities such as financial institutions, collection agencies and private investigators, etc. … [P]ublic notices listing these purposes are posted in Driver and Vehicle Licence Issuing Offices, DriveTest Centres, the ministry’s web site and in the newsletter included in all driver and vehicle licence renewal applications.

 

MTO is therefore relying on its Notice of Collection to inform the public that the personal information collected may be provided to private investigators.  According to MTO, the notice is provided in variety of locations.  In sum, MTO has taken the position that an individual in the complainant’s position would thus have reasonably expected the disclosure to the private investigator to have taken place, and that this expectation serves as the primary basis for making the disclosure permissible under section 42(1)(c).

 

I have considered the position put forward by MTO and I do not agree. As I have indicated above, the complainant is a worker with a child protection agency.  The complainant’s recommendation regarding the custody of the child was under review at a tribunal hearing.  It was at this hearing that the complainant became aware of the disclosure of her personal information to the private investigator. The Notice suggests that disclosure of address information may be made to private investigators for the service of legal documents and for legal investigations which may give rise to legal proceedings.  Neither of these purposes is applicable in this case.  Here, the address information was used by the private investigator to “tail” an independent witness to a tribunal hearing.  This was a use that the complainant would not reasonably have contemplated when reading the MTO Notice.

 

In its response to the draft Privacy Complaint Report, MTO stated that the private investigator used the information obtained through the ARP not to follow an independent witness, but rather to test the degree of that witness’s independence itself.  With respect, I fail to see a distinction between these two positions.

 

It appears from the private investigator’s own report that following the complainant was little more than a fishing expedition, undertaken in an attempt to discredit a key witness in the child protection proceedings.  This is a use of the information obtained from the ARP that a reasonable person would not contemplate having read MTO’s Notice.

 

I have concluded above that the purpose of MTO’s collection of driver personal information is to administer MTO’s driver, vehicle, and carrier programs.  In my view, there must be a rational connection between the purpose of the collection and the purpose of the disclosure in order to meet the “reasonable person” test set out in section 43.  In the circumstances of this complaint, I do not see any such connection and I conclude that an individual in the complainant’s position would not have reasonably expected the disclosure of their personal information, including their home address, to a private investigator.  Therefore, the disclosure of the complainant’s personal information to the private investigator was not in accordance with section 42(1)(c) of the Act.

 

I note that the MTO notice that is excerpted above contemplates 13 separate disclosures under the authorized requester program.  Several of these disclosures (e.g., safety recalls by auto manufacturers, road toll collection, parking violations) appear to be related either to the core business function of MTO or rationally connected to the administration of MTO’s programs. However, other disclosures, (e.g., disclosure for debt collection or for investigations by private investigators) appear to be for neither purpose.

 

Finally, in this case, it is notable that MTO has acknowledged that the authorized requester (the private investigation company) improperly disclosed the complainant’s personal information, and had accordingly suspended the private investigation company’s authorized requester privileges.  Although MTO has taken action with respect to this private investigation company, the fact that an improper disclosure did take place demonstrates the risks of improper disclosure that are inherent to the ARP.

 

In the past, the IPC has advocated that MTO limit the scope of organizations having access to the MTO database through the ARP.  The Commissioner has stated that the ARP should be restricted to purposes related to licensing, registration and administration of drivers and vehicles; road and vehicle safety; litigation; law enforcement; and compliance with legislation.  She noted that the use of personal information for unrelated purposes, such as debt collection or investigations, should be revisited.

 

In my view, the incident giving rise to this privacy complaint reinforces the need for MTO to review all classes of authorized requesters to assess whether disclosures taking place are consistent with MTO’s core purposes. Accordingly, MTO should revisit the continued disclosure of personal information for purposes that are unrelated to MTO’s primary areas of business.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

• The information in question qualifies as “personal information” as defined in section 2(1) of the Act.

 

• The personal information was not disclosed in accordance with section 42(1)(c) of the Act.

 

RECOMMENDATIONS:

 

In light of the above conclusions, I make the following recommendations:

 

1. Consistent with what the Commissioner previously requested, that MTO review all classes of authorized requesters to assess whether the disclosures taking place are consistent with MTO’s core purposes. In cases where disclosures are inconsistent with MTO’s core purposes, MTO should cancel the applicable authorized requester agreement in place.

 

2. That MTO review its audit procedures to ensure that complaints regarding the ARP are addressed in a timely manner.

 

By June 30, 2008, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

 

 

Original Signed by:                                                                                March 31, 2008

Mark Ratner Investigator