Privacy Reports

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC10-55

 

 

Chatham-Kent Energy

 

September 16, 2011

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC10-55

 

 

 

INVESTIGATOR:                                       Jeffrey Cutler

 

 

 

INSTITUTION:                                            Chatham-Kent Energy

 

 

 

SUMMARY OF COMPLAINT:

 

The Office of the Information and Privacy Commissioner (IPC) received a privacy complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) from an individual regarding Chatham-Kent Energy (CKE) and the Municipality of Chatham-Kent (the Municipality).

 

CKE is a corporation incorporated under section 142 of the Electricity Act and the Business Corporations Act  (Ontario)  and is designated as an institution by the Ontario Regulation 372/91, which states:

 

1.  (1) The following bodies are designated as institutions:

 

4.1 Every corporation incorporated under section 142 of the Electricity Act, 1998.

 

The Complainant alleged that CKE improperly disclosed the Complainant’s personal information within CKE and to the Municipality, and improperly disclosed this information via an anonymous letter to the Complainant’s family members and his former employer.

 

As the complaint related to the activities of the CKE and the Municipality, which are separate institutions under the Act, this office decided to open two files to process the complaint.  This file is referred to as Privacy Complaint MC10-55 and was opened to deal with the aspects of the complaint that relate to CKE.  Privacy Complaint MC10-46 will deal with the aspects of the complaint that relate to the activities of the Municipality.

 

BACKGROUND:

 

The following background information has been provided by the Complainant and CKE.

 

The Complainant initially filed a freedom of information (FOI) request with the Municipality under the Act on October 22, 2007. Among the information sought in the FOI request was information related to the Complainant’s utility account with CKE.

 

On October 31, 2007, the FOI Coordinator for the Municipality contacted the Complainant via email and informed him that because the request concerned information in the custody of CKE, the request had been forwarded to that institution.

 

On November 6, 2007, the Chief Financial and Regulatory Officer (the CFRO) with CKE issued a decision letter in response to the Complainant’s FOI request which was sent to the Complainant by email.  The email included attachments, specifically the decision letter to the Complainant and an appendix that included details of the Complainant’s account on file in CKE’s customer information system. The email was copied to the Chief Executive Officer (the CEO) of CKE, as well as the FOI Coordinator for the Municipality and the Mayor.

 

The decision letter informed the Complainant that some of the information requested was publicly available on CKE’s website. Additional responsive information would not be disclosed at that time because, according to CKE, the requested information was not readily available, and would require additional staff resources to obtain it. In its decision letter, CKE added that it would compile the information provided the Complainant paid a fee of $950 in advance, and noted that if it took fewer resources to respond to the request, then part of this money would be refunded to the Complainant. 

 

With regards to the Complainant’s account, the decision letter included comments that the complainant asserts are superfluous and derogatory.

 

CKE states that the fee was never paid and this information was not released to the Complainant.

 

The Complainant asserts in his privacy complaint that on August 23, 2010, a family member received an anonymous letter in the mail. The Complainant also asserts that on August 26, 2010 another family member received a copy of the same letter. Included in the letter was information about the Complainant’s CKE utility account. The Complaint also asserted that there are grounds to believe that a similar letter was sent to his then employer. The Complainant expressed that the source for the information in this letter is from the documents provided to the Mayor and/or CEO of CKE as part of the FOI request process.

 

DISCUSSION:

 

Preliminary Matters

 

As set out above, the Complainant alleges that an anonymous letter was sent to two family members. He also alleges that another anonymous letter was sent to his former employer. Before I turn to the issues before me, I will address the Complainant’s allegation that a letter was sent from an anonymous source to his former employer.  Here the Complainant has not provided me with sufficient evidence or information to support a finding that such a letter was ever written and delivered to his former employer, and the Municipality and CKE have denied that such a letter was ever written or sent by any of its officers or employees. 

 

I also considered the allegation that an anonymous letter was sent to two family members. I have reviewed the anonymous letter, and I am not able to determine who the author was or where the information may have originated.  Both the Municipality and CKE have denied that such a letter was ever written or sent by any of their officers or employees.

 

While I am sensitive to the concerns of the Complainant regarding the contents of this letter, on the evidence before me, I am not able to make a finding that CKE disclosed the Complainant’s personal information to the recipients of this letter. Accordingly, I am not able to make a finding in this report that there has been a breach of the Act. For these reasons, I will not discuss it further in this report.

 

The following issues were identified as arising from the investigation:

 

Do the November 6, 2007 email and the attachments contain “personal information” as defined in section 2(1) of the Act?

 

The information at issue is contained in the email dated November 6, 2007 and the attached decision letter and appendix. The issue I must initially determine is whether that information qualifies as personal information within the meaning of the Act.

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

(b)  information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved [emphasis added],

 

(g)  the views or opinions of another individual about the individual.

 

(h)   the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

In this case, CKE does not dispute that the November 6, 2007 email, and its attachments, contain information which qualifies as the Complainant’s personal information.  Having reviewed the records, I am satisfied that the information in question qualifies as the Complainant’s personal information.

 

Was the disclosure of the personal information at issue to the Municipality and the CEO of CKE in accordance with section 32 of the Act?

 

Section 32 of the Act provides a general prohibition against disclosure of personal information in the custody of an institution unless the circumstances fall within one of the exceptions specified in the Act.

 

Section 32 of the Act states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(a) in accordance with Part I;

 

(b) if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(d) if the disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions;

 

(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act or a treaty;

 

…

 

On November 6, 2007, the CFRO disclosed the response to the Complaint’s FOI request to the CEO and to the Municipality, by copying these parties on the email. I will consider each of these disclosures in turn.

 

(a)               Disclosure to the CEO of CKE

 

CKE stated that the CEO was copied on the November 6, 2007 email by the CFRO because he was the immediate superior of the CFRO who felt that the CEO was entitled to know about the manner in which he was discharging his duties.

 

Section 32(d) permits the disclosure to officers and employees of an institution who “need the record in the performance of their duties” and “if disclosure is necessary in the discharge of the institution’s functions.”  More particularly, it states:

 

32. An institution shall not disclose personal information in its custody or under its control except,

 

 (d) if the disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions;

 

This section has been considered by this office in a number of previous Privacy Complaint Reports. Generally, the IPC decisions identify three criteria for the application of this exception.  They are:

 

1.      the disclosure must be made to an officer, employee, consultant or agent (Investigation Report I96-113P);

2.      who needs the information in the performance of their duties (Privacy Complaint Report MC-050034-1 and Order PO-1998); and

3.      the disclosure must be necessary and proper in the performance of the institution's functions which includes the administration of statutory programs and activities necessary to the overall operation of the institution (See, for example, Investigation Report I95-007M).

 

As there is no issue here about the status of the CEO as an officer and employee of CKE, the only issues that I must decide are whether the CEO “needs the information” that was copied to him in the performance of his duties and whether the disclosure was necessary and proper in the performance of the institution’s functions.

 

As stated, CKE stated that in his capacity as supervisor, the CEO was entitled to know how the CFRO was carrying out his duties. 

 

Section 32(d) makes it clear that a disclosure of personal information even within an institution must be justified and will be subject to scrutiny on a “need to know basis.”  The sharing of information within an institution must be based on more than “mere interest or concern” [for example, see: H. (J.) v. Hastings (County) (1993), 12 M.P.L.R. (2d) 40 (Ont. Ct. Gen. Div.]. There must be a requirement for the personal information to be disclosed in order for individuals to carry out their duties and ensure the performance of the institution’s functions. For example, previous reports have found that the names and addresses of individuals who have made requests for records under the Act should not be communicated within an institution other than to staff of the institution’s Freedom of Information and Privacy office who require this information in order to process the request (Privacy Complaint Report MC-050034-1).

 

In view of the limitations on disclosure set out in section 32(d), this office has published IPC Practice 16: Maintaining the Confidentiality of Requesters and Privacy Complainants which states:

 

Any employee who assists the Co-ordinator in responding to requests for personal information should be reminded that all information about the requester’s identity and the request should remain confidential.  This information can be disclosed to co-workers, managers, supervisors or officers of the institution only if they need it to perform their duties and carry out a function of the institution.

 

In this case, the personal information of the Complainant was disclosed to the CEO. While I recognize that there is a reporting relationship between the CFRO and the CEO, there is insufficient information before me to demonstrate that the CEO required the identity or other personal information of the Complainant in order to perform his duties. The mere existence of a reporting relationship is not sufficient to establish a “need to know” the Complainant’s personal information.  Nor is there any information to indicate that it was necessary and proper to disclose the Complainant’s personal information to the CEO to carry out the institution’s functions.

 

Even if I accept that the CEO was entitled to know how the CFRO was carrying out his duties in relation to FOI matters generally, there is no information to suggest that this necessitated the disclosure of the Complainant’s personal information.  At most, the CEO was entitled to know that a request for information had been received, responsive information would be disclosed or withheld and the decision was responded to in an appropriate manner as set out in the Act. 

 

While there may be circumstances where one’s superior might have the need for additional information about an FOI request, that was not the case here.  By the time the email of November 6, 2007 was sent, the decision regarding disclosure had already been made by the CFRO.  There was no suggestion that there was a need to inform or consult with the CEO at that time other than as part of his reporting obligations to the CEO.  That, in my view, is not a sufficient basis to satisfy the requirement that the CEO “need the information in the performance of [his] duties.”

 

For these reasons, I conclude that the disclosure of the Complainant’s personal information to the CEO was not in accordance with section 32(d) of the Act.

 

(b)               Disclosure to the Municipality’s FOI Coordinator

 

In its submissions, CKE explained that it has a shared services arrangement with the Municipality, which is set out in a Shared Services Agreement, a copy of which it attached to its response to the request for information.  Pursuant to this agreement certain administrative and technical support services are provided by the Municipality to CKE in exchange for a fee.  CKE also explained that it had not appointed a FOIC and was using the Municipality’s FOIC for advice and assistance in responding to requests.  Specifically, CKE stated:

 

CKE relied upon [a named individual], the FOIC of the Municipality to provide assistance with respect to requests for information and disclosure of information pursuant to the provisions of the MFIPPA.  There is no specific agreement or specific resolution of the Board of CKE in this regard since CKE believed that it could rely upon the provisions of the Services Agreement in this regard.

 

CKE states that it provided a copy of the email, decision letter and the attachments to the FOIC:

 

“not only because the request had come through her office but also because she was the administrative person who handled freedom of information requests for CKE pursuant to the services agreement.”  

 

Applying the same approach to the application of section 32(d) as I did above in relation to the CEO of CKE, I must first determine whether or not the FOIC was an officer, employee, consultant or agent of CKE.  CKE’s position is that at the time that this FOI request was processed, the Municipality’s FOI Coordinator provided advice and services to CKE regarding the FOI requests pursuant to the Shared Services Agreement.

 

I have carefully reviewed the Shared Services Agreement, and while it is not clear that the agreement applies to the services of the Municipality’s FOI Co-ordinator, for the purposes of the analysis that follows, I will assume that it does.  I will also assume that for the purposes of this analysis that the FOI Co-ordinator was an agent of CKE.

 

I have made the assumptions above because regardless of the nature of the relationship with the FOI Co-ordinator, CKE states that the only involvement the FOI Co-ordinator had with the request was to provide advice. In addition, the FOI Co-ordinator did not provide any administrative services in relation to processing the request.  Indeed, contrary to what is suggested by CKE, the FOI Co-ordinator for the Municipality did not “handle” this request. 

 

On that basis, CKE has not demonstrated that the FOI Coordinator had a “need to know” what CKE’s decision was and did not need to know what records were being disclosed as a result of that decision.  The CFRO had already made the decision regarding the disclosure by the time that the email of November 6, 2007 was sent. In addition, I have been advised that the CFRO also maintained a file regarding the request and utilized the services of CKE staff, in particular an administrative assistant with CKE, who authored and sent the November 6, 2007 email, and not the services of the FOI Co-ordinator.

 

While it may be common practice for institutions to rely upon expertise from outside of an organization to assist in a general manner in processing FOI requests, such relationships do not entail disclosing personal information to such parties unless it can be established that the disclosure was permitted pursuant to section 32(d).  In other words, it is not enough to say that an agent or other party was assisting in the processing of the request.  It must be established that all the requirements of section 32(d) have been met including the fact that the agent or other party needs the information to perform their duties.

 

It should also be noted here that there is no requirement under the Act to inform an institution that transfers an FOI request regarding the processing of the request and, therefore, CKE cannot justify its decision to disclose the personal information to the FOI Co-ordinator on that basis.

 

In summary, there is insufficient evidence before me to support a finding that the FOI Co-ordinator needed the Complainant’s personal information to perform any services in relation to the Complainant’s FOI request and therefore, on that basis, I find that section 32(d) does not apply.

 

In the circumstances, before me I am satisfied that none of the exceptions set out in section 32 of the Act apply to permit CKE to make the disclosure of the Complainant’s personal information to the Municipality’s FOI Coordinator.

 

(c)  Disclosure to the Mayor

 

In its submissions, CKE acknowledged that it provided a copy of the November 6, 2007 letter which contained the personal information of the Complainant on the mistaken understanding that since the FOI request was made through the Municipality and that the Mayor was Head of the Municipality, then the Mayor should be copied on the response. It is apparent that CKE now understands that there is no such requirement.

 

CKE also submits that the Board of CKE was the Head of CKE pursuant to section 3(3) of the Act, and that as the Mayor was also a member of the Board at the time that the request was made, he would have been entitled to receive a copy of the decision letter and the responsive information in that capacity. 

 

I note that there is no information before me to indicate that the Mayor was copied on the November 6, 2007 email in his capacity as a member of CKE’s Board.  If it had been necessary to copy the Mayor given his status as a member of the Board of CKE, I would have expected that the other members of the Board would also have been copied on the email.  This did not appear to take place. 

 

In addition, it does not follow that merely because you are the Head of an institution under the Act, or a member of a board which is the Head of the institution, that you are entitled to receive personal information relating to FOI requests.  CKE is still required to establish that the exception in section 32(d) applies.

 

I find that CKE has not provided sufficient information to support a finding that any of the exceptions in section 32 would justify the disclosure of the Complainant’s personal information to the Mayor.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigations:

 

1.      The records in question, the November 6, 2007 email and attachments, contain information that qualifies as “personal information” under section 2(1) of the Act.

 

2.      In responding to the FOI request, CKE improperly disclosed the Complainant’s personal information to the Municipality and the CEO of CKE.

 

3.      There is insufficient evidence to establish that the personal information in the anonymous letter referred to by the Complainant was inappropriately disclosed by CKE.

 

RECOMMENDATIONS:

 

1.      CKE should develop guidelines for the processing of FOI requests that are in accordance with the Act.

 

2.      CKE should ask the Municipality to fully delete all electronic copies of the November 6, 2007 email and attachments and to securely shred any paper copies in its possession.

 

By January 3, 2012, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

                                                                                                            September 21, 2011

Jeffrey Cutler Investigator