Privacy Reports

 

 

 

 

 

          PRIVACY COMPLAINT REPORT

 

 

           PRIVACY COMPLAINT NO. MC08-49 and MC09-1

 

 

           City of Vaughan

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC08-49 and MC09-1

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            City of Vaughan

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a privacy complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) from an individual (the complainant) relating to the City of Vaughan (the City).

 

In her letter of complaint, the complainant explained that she had sent a letter (letter A) to the City, and had later noticed that she had been identified as the author of the letter in public City documents. Specifically, the complainant noted that her name had appeared as the author of the letter in a public extract of the City Council Meeting Minutes of April 14, 2008.

 

The complainant also raised a concern that letter A may have been disclosed by the City to members of the media.

 

Upon receiving the complaint, the IPC opened privacy complaint file MC08-49.

 

The IPC subsequently received another complaint from the complainant regarding a second letter (letter B) that she had sent to the City, and which she had marked “STRICTLY PRIVILEGED AND CONFIDENTIAL”. The complainant noticed that letter B had also been referenced in an extract of the City’s Council Minutes of May 12, 2008. The complainant further noted that a copy of letter B, with her name severed, appeared on the City’s website attached to an Audit Report (the Report) prepared by an external auditor.

 

In her complaint to the IPC respecting letter B, the complainant stated her concern that the City had acted improperly by disclosing it to the external auditor, and by allowing the letter to appear as part of the Report. In response to this second complaint, the IPC opened privacy complaint file MC09-1.

Because both MC08-49 and MC09-1 involve the same complainant and the same institution and the issues are similar, I have decided to issue one Report that will address both privacy complaints.

 

BACKGROUND

 

The complainant and the City provided the IPC with additional information concerning the complaint.

 

Letter A

 

Letter A was the complainant’s first letter to the City, and was dated April 4, 2008. The letter was addressed to the City Manager, and copied to the members of the City’s Audit and Operational Review Committee (AORC). The letter was sent as an e-mail attachment and was also hand delivered to the intended recipients. The complainant stated that a member of the public was erroneously copied on the original e-mail transmission of the letter, and that the actual intended recipient was a member of the AORC.

 

In letter A, the complainant raised concerns regarding the expenses claimed by a member of City Council during the year 2007. The letter requested that a full and comprehensive forensic audit be conducted of the member’s expenses, and that a full detailed explanation be provided of those expenses. The letter further stated:

 

My request is that you, as City Manager, bring these issues forward to Council and seek Council’s permission to hire an external forensic audit firm, with the results to be made public.

 

Enclosed with letter A were two appendices detailing the specifics of the complainant’s concern.

 

Letter A was dealt with in a Committee of the Whole meeting (Closed Session) on April 7, 2008, and was referred to the AORC on April 14, 2008, where it was also dealt with in a closed session. The recommendations of the AORC together with the letter were then forwarded to City Council on April 14, 2008.

 

The complainant’s name as the author of letter A appeared in an extract of the City Council Minutes of April 14, 2008. These Minutes also noted the AORC’s recommendation that Council hire an external forensic auditor to address the allegations contained in the complainant’s letter.

 

On April 17, 2009, an article appeared in the Vaughan Today newspaper, which made reference to the complainant’s letter and mentioned the complainant by name.

 

Letter B

 

On May 2, 2008, the complainant sent letter B to the City Manager. Letter B was copied to members of the City’s AORC and was marked “STRICTLY PRIVILEGED AND CONFIDENTIAL”. This second letter requested that the AORC examine the additional issues raised in the letter at its next meeting on May 6, 2008.

 

An extract of the Council Meeting Minutes of May 12, 2008 contained the complainant’s name, made reference to letter B and stated:

 

That the confidential written submission of [the complainant], dated May 2, 2008 be received.

 

Letter B was eventually provided to the external auditor that had been hired by the City to conduct an audit of the council member’s expenses.

 

On December 3, 2008, the external auditor issued the Report on its audit of the council member’s expenses. The Report was posted on the City’s website along with the agenda for the December 5, 2008 AORC meeting. Both letters A and B, with the complainant’s name and address severed, were included as Exhibits to the Report.

 

To summarize, the complainant has raised the following issues:

 

1.      The disclosure of her name (as the author of letters A and B) in the extracts of Council Meeting Minutes (Council Minutes);

 

2.      Possible disclosure of Letter A to the media; and

 

3.      Disclosure of letter B to the external auditor, and the posting of Letter B to the City’s website as an attachment to the Report.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

The definition of “personal information” is set out in section 2(1) of the Act, which states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(d) the address, telephone number, fingerprints or blood type of the individual,

 

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

…

 

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

The records at issue in this investigation are extracts of Council minutes, which included extracts of AROC meeting minutes containing reference to the complainant by name, as well as letters A and B. I will now proceed to consider whether each of these records qualifies as “personal information” under the Act.

 

The complainant was identified as the author of letter A in extracts of Council Minutes of April 14, 2008 and May 12, 2008. Both of these Minutes included extracts of AORC Meeting Minutes, which also included the complainant’s name. These Minutes are public documents.

 

With respect to this issue, the City has stated:

 

The City submits that the use of the complainant’s name in the minutes of Council and Committee meetings does not constitute “personal information” as defined in the Act. The complainant’s name did not appear with other personal information nor did the use of the complainant’s name reveal other personal information about her as set out in the definition.

 

In contrast, the complainant has taken the position that these records qualify as “personal information”.

 

I note that the records contain the complainant’s name, and identify her as the author of a letter that was considered by the Committee of the Whole, the AORC, and City Council. From reviewing the Minutes, an individual would be able to surmise that the letter was likely related to the City’s decision to retain an external forensic auditor to investigate a council member’s expenses.

 

I have reviewed letter A, in which the complainant is identified as its author. I conclude that the Minutes and Letter A contain information about the complainant which qualifies as “personal information” under the Act.

 

The complainant’s second letter, letter B, was attached to the December 3, 2008 Report of the external auditor (the Report), and was available for public viewing on the City’s website. The complainant’s name was redacted from the copy of the letter that appeared on the City’s website. The letter was marked “STRICTLY PRIVILEGED AND CONFIDENTIAL”.

 

The test to determine whether a given record contains personal information is whether it is reasonable to expect that an individual may be identified if the information is disclosed [Order PO-1880, upheld on judicial review in Ontario (Attorney General) v. Pascoe, [2002] O.J. No. 4300 (C.A.)]. Therefore, in this case, the appropriate question to ask is whether the complainant can be identified through the disclosure of the records in question.

 

I have reviewed the record. As noted above, the complainant’s name had been redacted from the copy of letter B that appears on the City’s website.

 

Letter B makes reference to the fact that it was the second letter that the complainant had written on the subject of the council member’s expenses. The letter further references the fact that the content of the first letter had been discussed in the media. The complainant had previously been identified as the author of a letter that was dated May 2, 2008 in an extract of Council Minutes.

 

After the Report was issued, the complainant made a deputation to the AORC of council concerning the content of the Report. The complainant had been publicly identified in the media in connection with her written request that an audit be conducted on the City council member in question. In my view, there is sufficient information in the public area to identify the complainant as the author of letter B.

 

Based on all of the above, I am satisfied that an individual reviewing the record, even with the complainant’s name redacted, with knowledge of other publicly available information would be able to identify the complainant as the author of the letter.

 

Accordingly, I am satisfied that the information in letter B qualifies as “personal information” under section 2(1) of the Act.

 

Was the disclosure of the “personal information” in accordance with section 32 of the Act?

 

At issue in this investigation are three separate disclosures of the complainant’s personal information as follows:

 

1.      The disclosure of the complainant’s personal information in public meeting documentation;

 

2.      The possible disclosure of the appellant’s letter to members of the media;

 

3.      The disclosure of letter B to the external auditor, and as an Appendix to the Report.

 

I will address each of these disclosures in turn.

 

 

 

 

 

The rules respecting the disclosure of personal information are set out in section 32 of the Act, which states, in part:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(a) in accordance with Part I;

 

(b) if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(d) if the disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions;

… .

 

 

1. The disclosure of the complainant’s personal information in public meeting documentation

 

As discussed above, the complainant’s personal information appears in Council Minutes as follows:

 

•         Extract from Council Meeting Minutes of April 14, 2008 (containing an item from the Committee of the Whole)

 

•         Extract from Council Meeting Minutes of May 12, 2008 (making reference to councillor expenditure policy)

 

•         Extract from Council Meeting Minutes of May 12, 2008 (containing the recommendations of the AORC).

 

The complainant objects to the use of her name and other personal information in the Minutes and has stated that “the only purpose of the submission of the letter was to hold an elected official accountable for the use of public money.”

 

In providing her position that the disclosure of her personal information in the Minutes was not in accordance with the Act, the complainant has expressed the position that the information contained in the letter had only been provided to the City so that it could address the substance of her complaint.

 

 

The complainant has further stated that by providing letter A to the City Manager, she did not give permission to the City to use the letter in public meeting minutes. As a result, the complainant has stated that, in her view, the disclosure of her personal information in the Minutes was not in accordance with the Act.

 

In addition, the complainant stated that the City acted unfairly in the manner in which it dealt with letter A. The complainant expressed specific concern that the City publicly disclosed her name in the Minutes, while at the same time, dealing with the content of her letter in a closed session. In the complainant’s view, this approach had the effect of discrediting her as the author of Letter A, and preventing the public from being aware of Council’s discussion of the alleged misuse of public funds.

 

In response to the complainant’s concerns, the City has stated:

 

The complainant submitted a letter to the City Manager, members of the Audit and Operational Committee … seeking that her concerns be dealt with in a public forum. There was no expectation of privacy or confidentiality.

 

… the City submits that such a disclosure is exempt under the Act, in accordance with subsections 32(c) and 32(d). The letter was obtained by the City for the purpose of bringing its contents to the attention of Council in order to address the concerns raised in a public forum. It would not have been appropriate for the City, under these circumstances, to deal with the letter in an anonymous manner. The City has an obligation to be transparent and accountable. The fact that the City dealt with the contents of the letter in a confidential manner was in accordance with the Municipal Act provisions dealing with personal matters about identifiable individuals and is not relevant to this MFIPPA inquiry.

 

The City made reference to a number of privacy complaint reports that have addressed the public disclosure of records sent to municipal councils, specifically MC-040019-1, MC-050015-1, and MC-040027-1. In those cases, the IPC concluded that the disclosure of personal information in those records was in accordance with section 32(c) of the Act.

 

I have considered the positions put forward by both parties to this complaint.

 

As stated above, the City has taken the position that the disclosure was in accordance with section 32(c) and 32(d) of the Act. I will first deal with section 32(c).

 

Section 32(c) of the Act, which is reproduced above, permits the disclosure of personal information for the purpose for which it was obtained or compiled or for a purpose that is consistent with that original purpose.

 

In order to consider whether section 32(c) applies to a given disclosure of personal information, it is first necessary to determine the original purpose for which the information was collected.

 

 

In letter A, the complainant stated:

 

My request is that you, as City Manager, bring these issues forward to Council and seek Council’s permission to hire an external forensic audit firm, with the results to be made public.

 

Based on my review of the letter, I conclude that the purpose of the City’s collection of the complainant’s personal information was to allow City Council to deal with a matter of public interest raised by the complainant.

 

In order to determine whether the City’s collection was in accordance with section 32(c) of the Act, it is helpful to look to previous decisions of the IPC.

 

In MC-040027, Investigator Frances Soloway considered whether a municipality had acted properly when it publicly disclosed personal information contained in a letter sent by an individual to the Mayor of the Township. The letter in question raised concerns about the conduct of a council member, and was eventually read aloud at a public meeting. In concluding that the disclosure was in accordance with the Act, Investigator Soloway stated:

 

… it is not reasonable for a complainant to file a letter of complaint to be addressed by council and expect the complaint to be dealt with behind closed doors in an anonymous fashion.

 

In MC-040019, the IPC considered the case of an individual who had sent a letter seeking assistance from the Mayor of a municipality, and had marked the letter “CONFIDENTIAL”. The letter was subsequently discussed at an open council meeting and was placed in the minutes of the council meeting, which were posted to the municipality’s website. In that case, the complainant was of the view that the municipality had violated his privacy rights by dealing with the letter publicly. In MC-040019, Investigator Brian Bisson concluded that the public dissemination of the letter was appropriate and in accordance with the Act.

 

The IPC has consistently found that individuals raising matters before municipal councils should not expect anonymity with respect to those complaints. There is a public interest in the transparency and accountability of the workings of municipal government, and the precedents discussed above make clear that this principle applies to the identity of individuals who may raise matters of public interest and concern.

 

Accordingly, I am satisfied that the disclosure of the complainant’s identity in the public meeting documentation took place to allow the City to properly address a matter of public interest. I further note that this purpose was the same as the original purpose of the collection. Therefore, I conclude, based on all of the above, that the disclosure was in accordance with section 32(c) of the Act, and the disclosure of the complainant’s personal information was in accordance with section 32. Accordingly, it is not necessary for me to address the possible application of section 32(d) of the Act.

 

 

I will now discuss the complainant’s concern respecting the City’s decision to deal with the substance of letter A in a closed session.

 

Based on the information provided by the complainant and the City, the substance of letter A related to allegations regarding a council member’s expenses. Section 239 of the Municipal Act sets out the criteria that a municipality must consider prior to making a decision to hold a meeting in the absence of the public. This issue is not dealt with in Part II of the Act, which relates to the collection, use, disclosure and retention of personal information. Therefore, I do not have the authority to determine whether it was appropriate for the City to deal with the substance of the complaint in a closed meeting. I note that the Municipal Act provides a remedy for individuals who feel that a municipality has improperly convened a closed meeting. Accordingly, I will not address this subject further in this report.

 

2.  The possible disclosure of letter A to a member of the media.

 

In the letter of complaint submitted to our office, the complainant stated:

 

Through an unknown disclosure, the letter, and submitted information was sent to several media outlets.

 

In support of this statement, the complainant provided the IPC with an internet link to a newspaper article that made reference to the complainant’s letter of April 4, 2008. The City also provided the IPC with a copy of a different newspaper article that contained a reference to the complainant’s April 4, 2008 letter.

 

With respect to this matter, the City has stated:

 

… it is not appropriate to infer that the City sent the complainant’s letter to several media outlets. In fact the complainant refers to the release of the information to the media as being “through an unknown disclosure”.

 

The City has further stated that it was not aware of the disclosure of the letter as having originated with the City.

 

Based on the information available to me, I am not in a position to determine if the letter was delivered to the media or by whom. Accordingly, I make no findings or conclusions on this matter.

3.  The disclosure of letter B to the external auditor, and its posting on the City’s website as an Appendix to the Report.

 

With respect to this aspect of the complaint, the complainant expressed concerns regarding the handling of letter B, which had been marked as confidential and privileged. Specifically, the complainant expressed concerns regarding:

 

 

•         the provision of letter be to the external auditor; and

 

•         the posting of letter B as an appendix to the Report.

 

The complainant’s position is that by providing the letter to the auditor, and then posting the letter to the City’s website, both the City Manager and the external auditor had breached her privacy.

 

The complainant stated:

 

The second letter submitted to the City Manager is clearly marked privileged and confidential. The letter is a complaint. The letter should never have been disclosed without permission. Permission was never sought. The express withdrawal of consent is clearly marked on the document, given the statement “privileged and confidential”.

 

In summary, the complainant is concerned about both the disclosure of the letter by the City to the external auditor and the eventual disclosure of the letter on the City’s website. I will therefore address both issues in turn.

 

Disclosure of letter B to the External Auditor

 

With respect to the disclosure of letter B to the external auditor, I note that section 32(d) of the Act permits the disclosure of personal information “to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties”.

 

In letter B, the complainant raised concerns regarding the expenses of a council member. The letter requested that a full audit be conducted of the council member’s expenses and also set out the basis for this request. The audit was conducted by the external auditor.

 

In my view, the external auditor would have required access to the letter of complaint about the council member’s expenses in order to conduct the audit.

 

The external auditor qualifies as a “consultant or agent of the institution” and the letter was clearly required in the performance of their duties (i.e., conducting the audit). I am therefore satisfied that the disclosure of the letter to the external auditor was in accordance with section 32(d) of the Act.

 

Disclosure of letter B in the Report on the City’s website

 

As discussed above, letter B was disclosed as part of the Report of the audit into the expenses of a municipal council member that was dated December 3, 2008. The Report was posted to the City’s website, and letter B was included as Exhibit B to the Report. The letter was marked “STRICTLY PRIVILEGED AND CONFIDENTIAL,” and the complainant’s name was severed from the copy of the letter that appeared on the City’s website.

 

With respect to the disclosure of this letter on the City’s website, the City has stated:

 

The complainant’s correspondence cannot be considered as implicitly or explicitly of a private or confidential nature as the complainant’s letter was copied to the Members of the Audit and Operational Review Committee. …

 

[The letter] was submitted for the purpose of having a Special Purpose Committee of Council (and subsequently, Council) consider her request with the understanding that Council and Committees generally deal with such matters in a public forum. Therefore, the City submits that the disclosure of the personal information in question was for the original purpose for which it was obtained or for a consistent purpose, which was to facilitate an informed public debate on a matter that has been brought to the attention of Council.

 

The City further noted that the complainant made a deputation to the AORC on December 5, 2008. She was publicly identified in the AORC recommendations that were published as an extract of the Council meeting minutes of December 8, 2008.

 

The City pointed out that the complainant made statements to the media regarding her concerns and provided copies of newspapers articles where she had been quoted and identified as the individual who had initiated the matter with the City.

 

The City further stated that it had taken steps to protect the complainant’s identity by removing her name from both letters A and B that appeared on the City’s website.

 

In sum, it is the City’s position that the complainant did not have an expectation of privacy or confidentiality with respect to letter B, which was published on the City’s website.

 

The City also stated that the disclosure of the letter was in accordance with section 32(c) and 32(d).

 

I will first consider whether the City’s inclusion of letter B as an appendix to the Report was in accordance with section 32(c) of the Act.

 

As discussed above, section 32(c) permits the disclosure of personal information “for the purpose for which it was obtained or compiled or for a consistent purpose”. In order to determine whether a given disclosure of personal information accords with section 32(c), it is necessary to first identify the purpose for which it was originally obtained or compiled.

 

The record in question was collected by the City for the purpose of dealing with a matter of public interest that had been raised by the complainant. It was then posted on the City’s website as an exhibit to the Report. The Report was the result of an audit into the expenses of the City council member. This audit had originally been requested by the complainant in letters A and B.

 

 

 

I am satisfied that the letter was obtained for the purpose of dealing with the council member’s expenses, which was a matter of public interest, and was also disclosed for the same purpose for which it was originally obtained or compiled. I am therefore satisfied that the disclosure was in accordance with section 32(c) of the Act, and it is not necessary for me to consider the possible application of section 32(d).

 

I will now address another issue the complainant has raised. I note that the complainant, in her submissions, made reference to the fact that letter B was marked “STRICTLY PRIVILEGED AND CONFIDENTIAL”. The complainant further stated that the City had neither sought, nor obtained permission to publish the letter, and stated that consent to disclosure had been explicitly withdrawn by virtue of the fact that it was marked “Privileged and Confidential”. In the complainant’s view, marking the letter “Privileged and Confidential” entailed that the City was not entitled to disclose it on its website. In this manner, the complainant has raised the possible application of section 32(b) of the Act.

 

I do not accept the complainant’s position in this regard. Although section 32(b) of the Act identifies consent as one of the circumstances where disclosure is permitted, the institution must demonstrate that the disclosure in question is in accordance with at least one of the section 32 exceptions. In this case, as discussed above, I am satisfied that the disclosure in question was in accordance with section 32(c) of the Act. Consent is not required in order to make the disclosure permissible.

 

The facts of the present case are similar to MC-040019-1, which I have discussed above. The complainant in MC-040019-1 had marked a letter “Confidential” and complained to the IPC when he discovered that it had been publicly disseminated. In concluding that the disclosure in that instance was in accordance with the Act, Investigator Bisson stated:

 

It is clear that the City has established a process in keeping with the principles of open government and transparency of decision-making in open meetings and I commend the City for this. It is also clear that when individuals write to the Mayor, their communication may, as in the present case, contain personal information which must only be disclosed in accordance with the requirements of section 32 of the Act. It is important to note that an individual, who writes to a City official and marks the letter “Confidential”, would expect it to be held in confidence. There is an onus, however, on a complainant to carefully consider what personal information he/she is willing to have disclosed, in order to have their issues addressed. Under the Act, an institution has an obligation to balance transparency against the disclosure of personal information.

 

I agree with the position enunciated by Investigator Bisson in MC-040019-1 and adopt it in the present case. The City is required to balance the requirement to protect privacy against the need to be transparent in its operations. As a general principle, when an individual raises a matter of public interest in a public forum, he or she cannot impose an expectation of privacy simply by labelling a document “confidential”. To accept such a position would impair the ability of municipal government institutions to conduct their business in a fully transparent and accountable manner.

I am also guided by the fact that the complainant had associated herself in the media as a catalyst behind the Report and a critic of the Council Member’s expenses.

 

For all of the reasons discussed above, I am satisfied that the disclosure of the personal information was in accordance with section 32(c) of the Act.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

Personal Information

 

1.      The information contained in the public meeting documentation qualifies as “personal information” under section 2(1) of the Act.

 

2.      The information contained in letter A qualifies as “personal information” under section 2(1) of the Act.

 

3.      The information contained in letter B qualifies as “personal information” under section 2(1) of the Act.

 

Disclosure

 

4.      The disclosure of the complainant’s identity in the public meeting minutes was in accordance with section 32 of the Act.

 

5.      The disclosure of letter B to the external auditor was in accordance with section 32 of the Act.

 

6.      The disclosure of letter B on the City’s website as part of the Report of the external auditor was in accordance with section 32 of the Act.

 

 

 

 

 

 

 

                                                                                                              March 26, 2010

Mark Ratner Investigator