PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC08-39

 

 

University of Ottawa

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   PC08-39

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            University of Ottawa

 

 

SUMMARY OF COMPLAINT:               

 

The Information and Privacy Commissioner/Ontario (IPC) received a privacy complaint from an individual (the complainant) regarding the University of Ottawa (the University). The complainant was concerned that the University was improperly collecting and using his e-mails in contravention of the provisions of the Freedom of Information and Protection of Privacy Act (the Act). The e-mails in question were e-mails that were composed and originally sent by the complainant.

 

Background

 

The complainant provided the following background information about this complaint to the IPC.

 

The complainant is a Professor at the University and had organized a weekly event series at the University (the events). In order to provide information regarding the events, the complainant sent regular e-mails to a list of individuals. The e-mail addresses on the list were comprised of past event participants, and there were more than 1000 recipients of the e-mails.

 

In addition to making announcements regarding the events, the e-mails also made reference to other events taking place near the University campus, links to the complainant’s web blog, and additional statements provided by the complainant. The e-mails were sent from a personal e-mail account set-up by the complainant, and were addressed to himself at his University e-mail address in the “To” line of each e-mail. The remaining recipients were included as blind “Bcc” copies.

 

The complainant received a letter from one of the University’s Deans making reference to the content of one of the e-mails. Subsequently, the Dean wrote a further letter to the complainant that also made reference to the content of the same e-mail.

As a result of these letters, the complainant filed a privacy complaint with the IPC. In his letter of complaint, the complainant stated that he was concerned that the University had improperly collected and used his personal information contained in the e-mails. In addition, the complainant stated that the University had failed to provide him with a proper notice of collection as required under the Act.

 

After filing the original complaint, the complainant wrote to the IPC and reiterated his concerns regarding the University’s collection and use of the e-mails. The complainant explained that he had received additional records through requests made under the access provisions of the Act, and that these additional records demonstrated that University administrators had been collecting and internally disseminating the e-mails.

 

The complainant provided the IPC with copies of the e-mails (the records) referred to in this complaint. I have reviewed these records as part of my investigation into this complaint.

 

The complainant has also requested that I review the portions of the records in question where access had been denied by the University under the Act. The University has provided these additional records to me, and I have reviewed these records in the context of this investigation.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

 

(e)        the personal opinions or views of the individual except where they relate to another individual,

 

…

 

(h)        the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual…

 

The information at issue in this complaint is the information that appears on the records provided by the complainant. As indicated above, the records are e-mails that had originally been sent by the complainant as announcements of events, and some of these had been internally disseminated by administrators within the University. In some cases, these e-mails had been forwarded by one University Administrator to another, and some of the forwarded e-mails contain comments made by administrators. Where the records were obtained by the complainant through an access request made under the Act, portions of these comments were, in some instances, “blacked out,” or severed by the University on the basis that they were exempt from disclosure under the Act. As mentioned above, I have been provided with, and I have reviewed, unsevered copies of the records at issue by the University.

 

The University’s decision to sever portions of the records in response to the complainant’s access request has been appealed to our office. A decision has not yet been issued by our office respecting that appeal, and that appeal process is separate from this privacy investigation.

 

I have reviewed all records that have been provided to the IPC over the course of this investigation. Most of the e-mails were sent from the complainant’s personal e-mail address to himself at his University e-mail address. These records primarily contain announcements of upcoming events. In some cases, the e-mails contain statements by the complainant regarding ongoing concerns he has had regarding the University administration. Some of these comments contain the personal views of the complainant.

 

With respect to the portions of the e-mails that contain announcements of events (which are a majority of the records at issue), I note that these portions of the e-mails contain factual information about public events. Therefore, I conclude that they do not qualify as personal information under section 2(1) of the Act.

 

I further note that some of the e-mails contain the complainant’s views or opinions. Accordingly, based on subsection (e) of the definition of “personal information,” above, I am satisfied that these portions of the e-mails qualify as the complainant’s personal information.

 

With respect to the address lines of the e-mail, as stated above, the e-mails are sent from a personal e-mail account set up by the appellant, and the “From” line of each e-mail contains the complainant’s personal e-mail address. The IPC has previously held that a personal e-mail address is considered to be “personal information” [see Order PO-2367]. I am therefore satisfied that the complainant’s personal e-mail address qualifies as his personal information.

 

As set out above, the “To” line of each e-mail includes the complainant’s professional e-mail address. In order to determine whether the complainant’s professional e-mail address qualifies as “personal information,” it is helpful to look to section 2(3) of the Act, which states:

 

Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

 

Because the complainant’s professional e-mail address contains his professional contact information, I am satisfied that the professional e-mail address that appears on the records does not qualify as “personal information”.

 

In sum, I have concluded that the majority of the content of the records at issue in this complaint (i.e., the e-mails) do not qualify as “personal information” under the Act, as these messages largely consist of public notices about public events.

 

I have also concluded that certain portions of the e-mails may be considered to be personal information. Specifically, the complainant’s personal e-mail address, where it appears, as well as the complainant’s personal views or opinions would qualify as “personal information” under the Act.

 

Having reached the conclusion that portions of the e-mails contain some personal information, it is important to note that the e-mails in question were sent to a list of more than 1000 recipients by the complainant, any of whom could have freely forwarded the e-mail to others. In addition, some of the e-mails encouraged recipients to send the e-mails to other individuals. In this case, I am of the view that the complainant’s privacy interest in the records is diminished by virtue of the wide distribution of the messages.

 

Accordingly, while I will consider whether these records were dealt with in accordance with the Act, I will proceed under the premise that the manner of dissemination of the records gives rise to a diminished expectation of privacy.

 

Was the collection of the “personal information” in accordance with section 38 of the Act?

 

As stated above, the records in question were e-mail announcements of events sent to a list of more than 1000 recipients. The complainant has stated that the University received or collected e-mails from at least three individuals who were employees of the University. One of the recipients of these e-mails was a University staff person who was on the list by virtue of the fact that his name was similar to that of a former student who had been on the list.

 

Based on information supplied by both parties, I note that multiple University employees were on the e-mail list, and received and forwarded e-mails.

 

Section 38(2) of the Act states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

 

With respect to this issue, the University has stated:

 

The information contained in those emails were neither solicited nor intercepted unlawfully by the University or any representative of the University. The manner in which the subject emails came into the possession of a University employee can not be characterized as an act of collection.

 

The University has therefore taken the position that its receipt of the e-mails in question did not constitute a “collection” of personal information under the Act, and that this activity is therefore not subject to section 38(2).

 

In order to determine the applicability of section 38(2), it is first necessary to determine whether the records in question were collected under the Act. I note that neither the term “collect” nor the term “collection” is defined under the Act.

 

In determining the meaning of an undefined term, the accepted approach to statutory interpretation is to determine the intent of the Legislature by reading the words of the provision in context and according to their grammatical and ordinary sense, harmoniously with the scheme and the object of the statute.

 

The purposes of the Act are expressed in section 1, which states in part:

 

The purposes of this Act are,

 

(b)        to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information.

 

This provision states that one of the purposes of the Act is the protection of personal information held by institutions. In determining whether the legislature intended to make the unsolicited receipt of correspondence a “collection” under the Act, it is instructive to look to the provisions of the Act that regulate the use and disclosure of personal information and give effect to the purposes of the Act.

 

The use and disclosure of personal information are dealt with at sections 41 and 42 of the Act respectively. Section 41(1)(b) sets out one of the circumstances where an institution may use personal information and  states:

 

An institution shall not use personal information in its custody or under its control except,

 

(b)        for the purpose for which it was obtained or compiled or for a consistent purpose…  [Emphasis added].

 

Section 42(1)(c) of the Act, which relates to the disclosure of personal information, contains similar wording.

 

Sections 41 and 42 of the Act both make reference to personal information having been “obtained or compiled” by an institution. In my view, in drafting the Act, the legislature intended the meaning of the term “obtained or compiled” to be different from the term “collect,” which is employed in section 38. Had the legislature intended sections 41 and 42 to only apply to personal information that is collected, it would have used that word in those sections.

 

I note that personal information may come into the custody or control of an institution in a variety of circumstances: it may be actively solicited, it may be passively received, or it may be created by the institution. In my view, the term “obtained or compiled” is intentionally broad, and is intended to accommodate the various ways in which an institution may acquire personal information. This analysis supports the notion that the term “collect” is intended to be interpreted narrowly so as not to apply to situations such as this where correspondence is sent to institutions voluntarily and without solicitation.

 

It is also instructive to look to section 39(2) of the Act. Section 39(2) requires that institutions provide “Notice of Collection” to all individuals from whom personal information has been collected. Institutions such as the University receive large volumes of unsolicited correspondence from individuals on a regular basis. In addition, any individual who sends correspondence to an institution would be aware of the fact that such correspondence would have been received, thereby avoiding the need for the institution to provide Notice. To interpret the unsolicited receipt of correspondence as a collection of personal information, and therefore subject to the statutory notice requirement, would entail that institutions would be required to provide Notice to every individual who chooses to send it correspondence. Such a requirement would be unduly burdensome and unnecessary.

 

In light of the above, I am satisfied that in drafting the Act, the legislature did not intend to have the term “collect” apply to this type of fact situation (e.g., the unsolicited receipt of correspondence containing personal information).

 

In applying this interpretation to the facts of this case, I note that the University staff members who were recipients of these records received them by virtue of the fact that their e-mail addresses appeared on the complainant’s list. Accordingly, the recipients would not have had a choice as to receive the e-mails or not.

 

In accordance with our policy and procedures for privacy complaint investigations, a draft copy of the report was provided to both the complainant and the University. Both parties were given the opportunity to comment on any factual errors or omissions in the report.

 

In response to the draft report, the complainant expressed disagreement with its characterization of the University’s receipt of the e-mails as the passive receipt of unsolicited correspondence. Rather, the complainant expressed his view that the e-mails in question had been actively intercepted.

 

In support of his position, the complainant made specific reference to the University staff person whose e-mail address appeared on the complainant’s e-mail list by virtue of the fact that it was similar to that of a former student who was on the e-mail list.

The complainant stated that it was improper for the University to assign the e-mail of a former student to a University staff person. Further, the complainant noted that the e-mail address of the former student was slightly different from that of the University staff person as it contained a different domain name.

 

The complainant also objected to the fact that the University staff person who received the e-mails did not notify him directly that they had been received by an unintended recipient.

 

The University responded to the concerns raised by the complainant as follows.

 

With respect to its decision to assign the e-mail of a former student to a University staff person, the University has stated that, upon his arrival to the faculty, the University staff person wanted an e-mail address that was consistent with the format of addresses used generally under the University system. This e-mail address happened to have been assigned to a former student. The University explained that it contacted the former student who agreed to allow the staff person to use the e-mail address.

 

With respect to the complainant’s concerns relating to the fact that the domain address in the e-mail list was different from the domain address of the University staff person’s e-mail account, the University stated:

 

… the Faculty … managed its own email server. [The former student] … used the [username]@[faculty name].uottawa.ca with alias email account [username]@[department name].uottawa.ca interchangeably. These email accounts were consolidated within the [username]@uottawa.ca account after the student’s departure from the University around 2006-2007 and to standardize account names across servers/domains.

 

It is therefore the University’s position that e-mails sent by the complainant to the e-mail address containing the “@[faculty name].uottawa.ca” domain were automatically redirected to the “@uottawa.ca” domain as a result of the consolidation of the University’s e-mail servers.

 

The complainant also expressed his concern that the University staff person had not notified him that he had received e-mails that were, in the complainant’s view, not intended for him. The University responded:

 

…under the circumstances, meaning the mass mailouts which the Complainant effected (and may continue to effect) regularly to a number of Faculty … members (staff and students), it would not have occurred to [the staff person]   that the emails received from the Complainant were not necessarily meant for him. …

 

To put matters in further context [the staff person] has confirmed that on the few occasions he received messages that were destined personally for [the former student] he replied to the sender to indicate that he was not the intended recipient. On the other hand, the emails received from [the complainant] were not addressed to anyone specifically and often contained notices encouraging the recipients to publicize their contents, with notices such as “Please join us. All welcome. Completely free. PLEASE POST – PLEASE SEND TO FRIENDS”.

 

Finally, the complainant stated that, in addition to the e-mails received from the University staff person, records previously provided to the complainant indicate that two other university staff persons, who were not on the complainant’s list, appear to have received e-mails.

 

In regard to this matter, the University stated:

 

From its enquiries and on the basis of information available to the University, we can confirm that both [university staff person] and [university staff person] were recipients on the … email list.

 

I have carefully considered the concerns raised by the complainant as well as the explanations provided by the University. I am satisfied that the University did not play an active role in obtaining the e-mails in question. The University received the e-mails as a result of the fact that they had been widely disseminated by the complainant. The fact that the a large number of e-mails were received by someone who happened to be different from the person that originally signed up to be on the list does not entail that the e-mails were actively intercepted by the University.

 

Based on all of the above, I conclude that the University’s unsolicited receipt of the e-mails was not a collection of personal information under section 38(2) of the Act. Accordingly, the University did not contravene section 38(2) of the Act.

 

The complainant has raised issues related to the University’s handling of the e-mails after they had been received. The subsequent provision of e-mails from one university staff person to another is a use of personal information under the Act. This issue is dealt with under section 41(1) of the Act, and is addressed below.

 

Was Notice of Collection provided in accordance with section 39(2) of the Act?

 

I have concluded above that the e-mails were not collected under the Act, and I am therefore satisfied that the requirement to provide Notice of Collection does not apply in the present case.

 

I note that the e-mails were sent by the complainant and he had access to a list of the recipients, some of whom chose to forward the e-mails. In my view, an individual who sends an unsolicited e-mail to an institution should not expect to receive a Notice of Collection.

 

Was the use of the “personal information” in accordance with section 41(1) of the Act?

 

The information provided by the complainant shows that he has concerns relating to two types of uses of his personal information as follows:

 

•         the use of his personal information through the internal dissemination of the e-mails among University staff and administrators; and

•         the use of personal information in correspondence sent to him by his supervisor citing portions of the e-mails.

 

The internal dissemination of e-mails, as well as citing the e-mails in correspondence both constitute uses of personal information under the Act. The rules respecting the use of personal information are set out in section 41(1) of the Act, which states:

 

An institution shall not use personal information in its custody or under its control except,

 

(a)        where the person to whom the information relates has identified that information in particular and consented to its use;

 

(b)       for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(c)        for a purpose for which the information may be disclosed to the institution under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act; or

 

(d)       subject to subsection (2), an educational institution may use personal information in its alumni records for the purpose of its own fundraising activities, if the personal information is reasonably necessary for the fundraising activities.

 

[Emphasis added].

 

In what follows, I will address both types of uses of the complainant’s personal information.

 

Use of information through internal dissemination of e-mails

 

As discussed above, some of the e-mails, once received by the University were internally disseminated among University administrators through the forwarding of the e-mails. The complainant has made reference to 13 such uses involving 15 members of the University administration. In some cases, the forwarded e-mails contain additional messages that have been added by the individual forwarding the e-mail. In some cases, additional messages have been “blacked out” by the University because the records were obtained by the complainant through an access request made under the Act.

 

I have reviewed section 41(1) and note that the provision of section 41(1) that may apply to this particular use of personal information is section 41(1)(b), which permits the use of personal information for the original purpose for which it was obtained or compiled, or for a consistent purpose. I have also reviewed the e-mails at issue.

 

As discussed above, in my view the term “obtained or compiled” is not equivalent to the term “collect”. As I have indicated above, there are other ways in which personal information may be obtained or compiled. For instance, a record that is received by an institution on an unsolicited basis is obtained by that institution.

 

In this case, the e-mails were obtained by the University on an unsolicited basis. In order to administer its operations effectively, a University is required to review and address correspondence, including e-mails that are received on an unsolicited basis. Based on the information before me, the University compiled the e-mails for the purpose of addressing issues related to the operation of the University. Accordingly, I am satisfied that the University obtained or compiled the e-mails for the purpose of the effective administration of the University.

 

Upon receipt, it appears that the e-mails were internally disseminated for more than one purpose. One of the purposes of the dissemination was to alert administrators of events that were taking place on University property, which allowed for the effective administration of the University.

 

In addition, I note that some of the emails were internally disseminated in order to obtain legal advice, which also related to the effective administration of the University.

 

Based on the above, I am satisfied that the e-mails were used for the same purpose for which they were obtained or compiled (i.e., for the effective administration of the University) and therefore that the internal dissemination of these e-mails was in accordance with section 41(1)(b) of the Act.

 

Use of e-mails in letters sent to the complainant by his supervisor

 

The complainant had supplied the IPC with copies of three letters sent by his supervisor that reference some of the e-mails. I have reviewed these letters in the context of this investigation.

I have already concluded that while the majority of the content of the records does not consist of the complainant’s personal information, some portions of the e-mails (including the portions containing the complainant’s personal views or opinions) do qualify as the complainant’s personal information.

 

Having reviewed the copies of the three letters provided by the complainant, I note that while they all refer to the e-mails, only one of these letters (dated January 8, 2008) contains a reference to a portion of an e-mail that qualifies as personal information. The second letter, dated February 20, 2008, contains enclosures that include personal information derived from the e-mails. The third letter makes reference to an e-mail, but does not include the personal information.

 

Therefore, I will consider whether the use of these portions of the e-mails by citing them in the correspondence was in accordance with the Act.

 

As indicated above, section 41(1)(b) permits the use of personal information for the original purpose for which it was obtained or compiled or for a consistent purpose. As also set out above, the e-mails were received on an unsolicited basis, and compiled by the University for the purpose of addressing issues related to the effective operation of the University.

 

With respect to this issue, the University has addressed the e-mail reproduced in the January 8, 2008 letter, and has stated that it was used for disciplinary purposes. The University has stated:

 

It just so happens that that particular e-mail did contain a personal opinion of the Complainant, which he knew or ought to have known, if sent to various University employees, could be provided to the University (through its management representatives) and could be used for disciplinary purposes in the circumstances … .

 

Based on the information provided to me by both the complainant and the University, it is clear that there were disciplinary matters ongoing involving these two parties at the time the January 8, 2008 letter was sent.

 

I have reviewed the letter and I am satisfied that the e-mail referenced in it was used by the University for disciplinary purposes. I have also reviewed the February 20, 2008 letter and note that the e-mail referenced in it was used for disciplinary purposes. The third letter, dated February 5, 2008 does not reference personal information contained in an e-mail.

 

In this case, I am satisfied that addressing matters related to discipline is a component of the effective administration of a University. Accordingly, I conclude that the e-mails were used for the same purpose for which they were obtained or compiled, being the effective administration of the University.

 

I am therefore satisfied that the University’s use of the records in question was in accordance with section 41(1) of the Act.

 

Conclusion on the uses of the complainant’s personal information

 

In reaching the above conclusions I note that in situations where an individual publicly disseminates his or her views by e-mail, as is the case with the complainant, the public nature of these statements will entail a diminished reasonable expectation of privacy with respect to the content of those statements. Accordingly, in the case of this complaint, there is no reasonable basis for the complainant to expect that the e-mails messages would not have been internally disseminated among the University administrators and then utilized in the University’s correspondence to him.

 

Accordingly, I am satisfied that both of the University’s uses of the records as discussed above were in accordance with section 41(1) of the Act.

 

Academic Freedom

 

In the complainant’s response to the draft report, he stated that its conclusions did not adequately take into account the concept of academic freedom. In support of this position, the complainant made reference to the Association of Professors of the University of Ottawa (APUO) Collective Agreement as well as other policy documents that explain the principle of academic freedom in the context of a university setting.

 

The report is the result of my investigation into whether the University has acted in accordance with the Act. It is not within the mandate of the IPC to make a determination as to whether a complainant’s right to academic freedom has been violated. If the complainant continues to have concerns in this regard, he should consider pursuing them in other forums, including those provided under the APUO Collective Agreement.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigations:

 

1.            Portions of the records in question contain information that qualifies as “personal information” under section 2(1) of the Act.

 

2.            The records were not collected under section 38(2) of the Act.

 

3.            The University was not required to provide Notice of Collection in accordance with section 39(2) of the Act.

 

4.            The use of the personal information was in accordance with section 41(1)(b) of the Act.

 

 

 

 

 

 

                                                                                                            May 14, 2010

Mark Ratner Investigator