PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC07-49

 

 

The Corporation of the County of Northumberland

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC07-49

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            The Corporation of the County of

                                                                        Northumberland

 

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a letter from an individual (the source) expressing concerns related to a document issued by Northumberland County Housing Services titled “Tenancy Agreement Addendum For Crime Free Multi-Housing” (the Addendum). A copy of this document was provided to the IPC. The Housing Services Department of Northumberland County is the municipal non-profit housing provider for residents in Northumberland County.

 

The source noted that the Addendum is intended to be signed by prospective applicants for residential tenancies with Housing Services. Among other things, the Addendum states:

 

Neither I/we as Tenant(s) nor any member of my/our household, any guest or occupant of the rental unit, nor any persons invited onto the residential complex by me/us or any member of my/our household, shall engage in any criminal activity, including but not limited to offences under the Criminal Code of Canada , the Controlled Drugs or Substances Act, or any other law or statute or regulation which could affect the character of the residential complex.

 

I/we agree that if I/we default in any provision of this Addendum, the Landlord will take appropriate proceedings to end my/our tenancy.

…

A single violation of any of the provisions of this Addendum shall be deemed a serious violation and material non-compliance with the Tenancy Agreement. It is understood and agreed that a single violation shall be good cause for a notice to end a tenancy. Unless otherwise provided by law, proof of a violation shall not require criminal charge or conviction.

…

Should incidents occur resulting in police involvement, I agree to allow the investigating police service to release information to the Landlord. This is in accordance with the Municipal Freedom of Information and Protection of Privacy Act … .

 

[emphasis added].

 

The source explained that she was not writing on her own behalf, but was writing on behalf of other individuals who were asked to sign the agreement. The letter expressed concerns regarding the Addendum itself and expressed the position that requiring prospective tenants to sign the Addendum constituted an excessive use of Housing Services’ powers. In addition, the letter raised concerns regarding the potential collection of personal information as contemplated by the Addendum.

 

The IPC commenced a Commissioner-initiated privacy investigation to assess whether the activities of Housing Services are in accordance with the Municipal Freedom of Information and Protection of Privacy Act (the Act). Specifically, this investigation will assess whether the collection of information from investigating police services, as contemplated by the Addendum and the notice provided through the Addendum, are in accordance with the provisions of the Act.

 

For the purposes of this investigation, I will refer to both the Corporation of the County of Northumberland and its non-profit housing division as “the County”.

 

Background Information

 

During the course of the investigation, the County provided the following information regarding the information that is collected from investigating police services including Cobourg Police Services, Port Hope Police Services, and the Ontario Provincial Police.

 

The County stated that these police services operate in the Northumberland County area and provide it with information that may include the personal information of tenants. The information provided generally relates to criminal activity and can include:

 

• information pertaining to the criminal convictions of tenants;
• information pertaining to the criminal charges of tenants;
• information pertaining to search warrants to be executed on Housing Services property; and
• information relating to a crime in progress.

 

In materials provided to the IPC, the County also identified the purpose of having tenants sign the Addendum as follows:

 

• to deter illegal activity;
• to inform tenants of the consequences of a breach of the Addendum; and
• to obtain consent for the sharing of information by the Police.

The County stated that the Addendum is only provided to prospective tenants to sign and is not provided to current tenants. In addition, the County states that any breach of the Addendum is dealt with in accordance with the law. The County stated that it does not require existing tenants to sign the Addendum, but noted that a landlord may provide an existing tenant with the option of signing the Addendum. The County stated that there are no consequences for an existing tenant who refuses to sign the Addendum.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

The information in question is the information collected by the County from investigating police services. This information would generally relate to the following circumstances:

 

• an individual that has been charged with a crime;
• an individual that has been convicted of a crime;
• information relating to a property which is the subject of a search warrant; and
• information pertaining to a crime in progress.

 

The information provided by an investigating police service would normally consist of the individual’s name and address, together with information about the incident. The County has stated that it would not normally be provided with information pertaining to other types of police calls, such as noise complaints or domestic disputes, which do not result in criminal charges.

 

Under the definition of “personal information,” section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

…

(b)  information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

…

(d)   the address, telephone number, fingerprints or blood type of the individual,

…

(h)   the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; … .

 

Based on my review of the Addendum and the information provided by the County, I am satisfied that the information collected by the County from the investigating police services qualifies as personal information under section 2(1) of the Act. I note that the County concurs with this position.

Was the collection of the “personal information” in accordance with section 28(2) of the Act?

 

I will now consider whether the collection of personal information by the County was in accordance with the Act.

 

Section 28(2) of the Act sets out the circumstances under which the collection of personal information may take place under the Act, and states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

 

In order for a given collection of personal information to be permissible, an institution must demonstrate that the collection in question is in accordance with one of the three conditions set out in section 28(2) of the Act.

 

I will first consider whether the collection of personal information is in accordance with the third condition, i.e., whether it is “necessary to the proper administration of a lawfully authorized activity”. This third condition under section 28(2) has also been referred to as the “necessity condition”.

 

In order to determine whether this condition applies, I must first identify the lawfully authorized activity in question, and second, I must make an assessment as to whether the collection of the personal information in question meets the necessity condition (i.e., whether it can be shown to be necessary to the proper administration of this lawfully authorized activity). With respect to the identification of the lawfully authorized activity, the County has stated that its collection of personal information is related to the following four situations involving potential criminal activity:

 

• where an individual has been charged with a crime;
• where an individual has been convicted of a crime;
• where a search warrant is to be executed on a specific unit; and
• where the information relates to a crime in progress, such as a kidnapping.

 

The County stated that as the landlord, it is responsible for the administration of municipal non-profit housing. The County has made reference to the Residential Tenancies Act, which provides, among other things, that the responsibilities of a landlord include the provision of safe housing.

 

The Residential Tenancies Act also provides that a landlord may terminate a tenancy where a tenant commits an illegal act. Section 61(1) of the Residential Tenancies Act states:

 

A landlord may give a tenant notice of termination of the tenancy if the tenant or another occupant of the rental unit commits an illegal act or carries on an illegal trade, business or occupation or permits a person to do so in the rental unit or the residential complex.

 

Further, section 64(1) of the Residential Tenancies Act provides that landlords may terminate the tenancy of a tenant who:

 

… substantially interferes with the reasonable enjoyment of the residential complex for all usual purposes by the landlord or another tenant or substantially interferes with another lawful right, privilege or interest of the landlord or another tenant.

 

Based on the above, I am satisfied that the lawfully authorized activity is the County’s administration of a residential rental property as a landlord, which includes the provision of safe housing. I will now proceed to consider whether the “necessity condition” has been met.

 

In Cash Converters Canada Inc. v. Oshawa (City)[1], the Ontario Court of Appeal made reference to past decisions of the IPC in interpreting the necessity condition and stated:

 

In cases decided by the Commissioner’s office, it has required that in order to meet the necessity condition, the institution must show that each item or class of personal information that is to be collected is necessary to properly administer the lawfully authorized activity. Consequently, where the personal information would merely be helpful to the activity, it is not “necessary” within the meaning of the Act.  Similarly, where the purpose can be accomplished another way, the institution is obliged to choose the other route.

 

            [Emphasis added]

 

Accordingly, in order to demonstrate that a specific collection of personal information is permissible under the necessity condition set out in section 28(2) of the Act, the County must show that the collection of each item or class of personal information is necessary to administer the lawfully authorized activity. In this case, the classes of personal information collected are the four classes of information set out above.

 

With respect to the collection of personal information of tenants relating to criminal charges or convictions, the County’s position is that this collection is necessary in order to satisfy its duties as a landlord as set out in the Residential Tenancies Act. In particular, the County has taken the position that the collection of this information is necessary to the provision of safe housing to tenants.

 

In considering the position put forward by the County, I am mindful of the fact that criminal charges or convictions are routinely matters that are public. Court hearings dealing with such charges are normally open to the public, and the records dealing with such hearings are also a matter of public record. It would therefore be illogical to conclude that such public information could not be provided by an investigating police service to a landlord.

Based on the information provided by the County, I am satisfied that the collection of information pertaining to a tenant’s criminal charge or conviction is necessary to the proper administration of its operation as a municipal non-profit housing provider. I have reached this conclusion on the basis of the housing provider’s statutory responsibility to provide tenants with safe housing as well as a landlord’s statutory right to begin proceedings to terminate a tenancy where the tenant in question has committed an illegal act.

 

With respect to the collection of personal information pertaining to search warrants, I note that it is reasonable that a landlord would need this information from the investigating police service in order to allow them to execute a search warrant on a landlord’s property. Accordingly, I am satisfied that the collection of personal information relating to a unit that is subject to a search warrant is necessary to the proper administration of a lawfully authorized activity (i.e., the provision of non-profit housing).

 

Finally, with respect to a crime that is in progress, such as a hostage situation taking place in a unit on the landlord’s property, it is reasonable that a landlord would need to collect personal information from the investigating police service to properly assist the police. Accordingly, I am satisfied that the collection of personal information by the County in relation to a crime in progress is also necessary to the proper administration of a lawfully authorized activity.

 

Therefore I conclude that the collection of the types of personal information described by the County and collected from the investigating police services is permissible and in accordance with section 28(2) of the Act, as it is necessary to the proper administration of a lawfully authorized activity. As such, I do not need to consider the other conditions in section 28(2).

 

I note that this conclusion applies only to the four types of personal information that have been put forward by the County: information relating to (1) criminal charges, (2) criminal convictions, (3) search warrants, and (4) crimes in progress. The collection of any additional information, such as information relating to police calls where criminal charges were not laid may not be permissible under the Act.

 

Was the manner of collection of the personal information by the County in accordance with section 29(1) of the Act?

 

Section 29(1) of the Act states, in part:

 

An institution shall collect personal information only directly from the individual to whom the information relates unless,

 

(a)    the individual authorizes another manner of collection;

 

(b)   the personal information may be disclosed to the institution concerned under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act;

 

(c)    the Commissioner has authorized the manner of collection under clause 46 (c);

…

(f)    the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or judicial or quasi-judicial tribunal; [or]

 

(g)   the information is collected for the purpose of law enforcement

 

… .

 

This statutory provision states that an institution shall only collect personal information directly from the individual to whom that information relates, unless one or more of the listed exemptions apply to make the collection permissible. In this case, the personal information collected by the County was provided by investigating police services, thereby making the collection an indirect collection of personal information.

 

The County has made reference to sections 29(1)(a), 29(1)(f), and 29(1)(g) as provisions that may apply to make the indirect collection permissible.

 

In my view, the section that would most likely apply to this indirect collection of personal information is section 29(1)(b), which provides that an institution may indirectly collect personal information if that information may be disclosed to it under section 32 of the Act. Section 32 of the Act states, in part:

 

      An institution shall not disclose personal information in its custody or under its control except,

…

(c)     for the purpose for which it was obtained or compiled or for a consistent purpose;

…

 

Section 32(c) permits the disclosure of personal information for the original purpose for which the information has been collected or for a purpose that is consistent with that original purpose. Accordingly, the first step in this analysis is a determination of the “original purpose” of the information that is collected.

 

As discussed above, the personal information that was provided to the County by the police services relates to:

 

• an individual that has been charged with a crime;
• an individual that has been convicted of a crime;
• a search warrant that is to be executed on a specific unit; or
• information relating to a crime in progress.

 

 

Clearly, the above personal information was originally collected by investigating police services for the purpose of law enforcement. The next step is to determine whether the disclosure of this personal information to the County is for the same or original law enforcement purpose.

 

In this case, because the County is not a law enforcement institution, I am not satisfied that the information was provided to it for a law enforcement purpose. Therefore, I conclude that the information is not provided to the County for the original purpose of the collection.

 

However, a disclosure of personal information is still permissible under section 32(1)(c) if the purpose of the disclosure is consistent with the purpose of the collection. In order to determine whether a given disclosure is a “consistent purpose” under section 32(1)(c), it is instructive to look to section 33, which states:

 

The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31 (b) and 32 (c) only if the individual might reasonably have expected such a use or disclosure.

 

Under section 33, the purpose of a disclosure of personal information is a consistent purpose where the individual in question may have reasonably expected the disclosure to have taken place.

 

In this case, the County has stated that its mandate as a nonprofit housing provider is, among other things, to provide safe and affordable housing. To achieve these ends, it has created the Addendum to be signed by all prospective tenants. The Addendum (titled Tenancy Agreement Addendum for Crime Free Multi-Housing) is intended to reduce the incidence of crime on the County’s properties and enhance safety for its tenants.

 

In the circumstances of this complaint, I am of the view that tenants residing in one of the County’s properties would reasonably expect, as part of the County’s effort to reduce crime and increase safety, that their personal information may be disclosed to their landlord in the four circumstances that have been considered. Therefore, I am satisfied that the purpose of the disclosure of the personal information to the County is consistent with the original purpose of the collection and therefore in accordance with section 32 of the Act.

 

As a result of this conclusion that the disclosure of the personal information is in accordance with section 32, I am satisfied that the County’s indirect collection of this information is permissible under section 29(1)(b) of the Act. This conclusion is consistent with the conclusion reached in the Report prepared for privacy complaint files MC-030001 and MC-030002. Accordingly, it is not necessary for me to consider the application of sections 29(1)(a), 29(1)(f), or 29(1)(g).

 

I note that our office has also reviewed a similar program in place in the Regional Municipality of Peel. In Privacy Complaint Report MC07-23 and MC07-24 our office considered the sharing of information between the Peel Regional Police and the Region of Peel’s nonprofit housing provider, Peel Living. In that case, Peel Living was part of a formal program titled the “Region of Peel Crime Free Multi-Housing Program”. As part of that program, the Region of Peel entered into a Memorandum of Understanding (MOU) with the Peel Regional Police that established the parameters of that program. The County may wish to consider entering into a written agreement or MOU with the police services with which it shares personal information. Such an agreement would describe the circumstances under which personal information may be shared.

 

Is Notice of Collection provided in accordance with section 29(2) of the Act?

 

The Notice of Collection requirement is set out in section 29(2) of the Act, which states:

 

If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,

 

(a) the legal authority for the collection;

 

(b) the principal purpose or purposes for which the personal information is  intended to be used; and

 

(c) the title, business address and business telephone number of an officer or employee of the institution who can answer the individual’s questions about the collection.

 

In this case, a form of Notice is provided to all tenants who have signed the Addendum, as the Addendum informs these tenants that their personal information may be released by an investigating police service to the landlord. However, based on my review of the Addendum, I note that it does not satisfy all the statutory requirements set out in section 29(2) of the Act. While the Addendum expresses the general sentiment that the intent of the collection of personal information is to aid in the reduction of crime within the property, thereby satisfying 29(2)(b), it does not state the legal authority for the collection of personal information, (section 29(2)(a)) nor does it include the contact information of an officer or employee of the County who is able to answer an individual’s questions about the collection of personal information (section 29(2)(c)).

 

Futhermore, I note that this Notice is only provided to new tenants at the time they sign their tenancy agreement and it is not provided to existing tenants.

 

Based on the foregoing, I am not satisfied that the County is meeting the Notice of Collection requirements set out in section 29(2) of the Act. In order to address this issue, I will make recommendations below that address the wording of the notice as well as the requirement that it be provided to all tenants.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

1.      The information qualifies as “personal information” under section 2(1) of the Act.

 

2.      The collection of the personal information is in accordance with section 28(2) of the Act.

 

3.      The manner of collection is in accordance with section 29(1) of the Act.

 

4.      Notice of Collection is not provided in accordance with section 29(2) of the Act.

 

RECOMMENDATIONS:

 

I recommend the following:

 

1. That the County prepare a Notice of Collection addressing the collection of personal information from investigating police services which satisfies all of the statutory criteria set out in section 29(2) of the Act.

 

2. The Notice of Collection referenced above should be provided to all tenants.

 

By April 13, 2009, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

Original Signed By:                                                                            January 13, 2009

Mark Ratner Investigator