PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-060034-1

 

 

Workplace Safety and Insurance Board

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.  PC-060034-1

 

 

 

INVESTIGATOR:    Mark Ratner

 

 

 

INSTITUTION:  Workplace Safety and Insurance Board

 

 

 

SUMMARY OF COMPLAINT AND BACKGROUND: 

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a complaint under the Freedom of Information and Protection of Privacy Act (the Act).  The complainant was concerned that the Workplace Safety and Insurance Board (WSIB) had inappropriately disclosed his personal information to a Labour Market Re-entry (LMR) Service Provider, who had then further provided the personal information to a secondary LMR Service Provider.

 

The WSIB operates under the authority of the Workplace Safety and Insurance Act, 1997 (WSIA), and is responsible for overseeing Ontario ’s workplace safety education system as well as administering the province’s no-fault workplace insurance for employees and their workers. WSIB also provides disability benefits, monitors the quality of health care, and assists in early and safe return to work for workers who are injured on the job or contract an occupational disease.

 

As part of its mandate to assist in the safe return to work under the WSIA, WSIB is required to arrange LMR assessments and other services in order to enable injured workers to re-enter the labour-market.  The role of LMR service providers is explained on WSIB’s website, which states:

 

LMR service providers are companies, under contract with the WSIB, that provide vocational rehabilitation services designed to help workers develop job skills or obtain new ones for returning to suitable work.

 

Prior to filing this complaint, the complainant was in the process of being provided with LMR services by an LMR service provider (SP#1).

 

On February 20, 2006, the complainant received a letter from the WSIB indicating that WSIB had made changes to its LMR program, which included changes to its Roster of Providers offering assistance to WSIB clients.  The complainant was informed that, as a consequence of these changes, his current LMR service provider had changed, and a different organization would be providing him with LMR services.  The letter also informed the complainant that his LMR file would be securely transferred to the new provider.

 

On March 10, 2006, the complainant received a letter from the new LMR service provider (SP#2) informing him of the change.

 

On April 7, 2006, the complainant (along with his representative) attended a meeting at the offices of the new LMR service provider, SP#2.  At the meeting, the complainant was asked to sign SP#2’s Information Release Authorization form.  The Release form stated, in part:

 

I [name of signatory] hereby authorize that [SP#2] be permitted to obtain and review records which may be relevant to the provision of Labour Market Re-entry services.  Records will be used solely for case coordination purpose and may include, but not be limited to information involving, Rehabilitation, Assessment, Academic, Vocation, Employment, or other documentation provided by WSIB or you. …

 

At this meeting, the complainant was also informed that his file had been discussed with a secondary LMR service provider (SP#3).  A secondary LMR provider is an independent contractor that has been hired by a primary LMR service provider to provide additional services to a specific client.

 

In materials provided to the IPC by the complainant, he expressed the view that the information in his file had been provided to SP#2 and SP#3 in contravention of the Act.  Further, the complainant also expressed the view that SP#2’s use of the Information Release Authorization was inappropriate, as the form requested authorization for an act that had already taken place – i.e., the provision of the complainant’s file to the LMR provider.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

The information at issue is the information contained in the complainant’s LMR file that had been provided by WSIB to SP#2 and then disclosed by SP#2 to SP#3.  According to WSIB, this information would have included the following information relating to the complainant:

 

• contact information,
• employment history, and
• medical information relating to an injury or any work restrictions.

 

Section 2(1) of the Act provides a definition of “personal information” and states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

• (b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

…

 

• (d) the address, telephone number, fingerprints or blood type of the individual,

 

…

 

• (f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

 

…

 

• (h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual

 

… .

 

In my view, the information in question as described above clearly qualifies as “personal information” under the Act.  Neither the complainant nor the WSIB dispute this conclusion.

 

Was the disclosure of the “personal information” in accordance with section 42 of the Act?

 

Disclosure by WSIB to SP#2

 

WSIB confirmed that the information currently in the custody of SP#2 had been provided to it by WSIB.  Prior to WSIB’s disclosure, this information was in the custody of a different LMR service provider (SP#1) who had been working with the complainant in the past.  Once the WSIB’s Roster of service providers had changed, WSIB securely retrieved the file from SP#1 and provided the information to SP#2.

 

 

The rules relating to the disclosure of personal information are addressed in section 42 of the Act. This section sets out a basic prohibition on the disclosure of personal information, but states that personal information may be disclosed in a number of exceptional circumstances.

 

In this case, WSIB has taken the position that the disclosure in question was in accordance with section 42(1)(e) of the Act.

 

I have reviewed section 42 and note that the exception that may be most appropriate to apply to this disclosure is section 42(1)(c), which states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

…

 

• (c) for the purpose for which it was obtained or compiled or for a consistent purpose;

 

… .

 

This provision prohibits the disclosure of personal information unless the disclosure takes place for the original purpose for which the information was originally collected, or where the information in question was disclosed for a purpose that is consistent with the original purpose.

 

In this case, the information in question was collected by WSIB for the purpose of administering its responsibilities under the WSIA.  The WSIB’s disclosure of client personal information to an LMR provider was also for the purpose of administering its WSIA responsibilities.

 

Accordingly, in this sense, WSIB’s disclosure to SP#2 was for the original purpose of the collection, and therefore in accordance with section 42(1)(c).

 

Although I have concluded that WSIB’s disclosure was for the original purpose of the collection and therefore in accordance with section 42(1)(c) of the Act, and this is all that is required to be in compliance with this section of the Act, I will also discuss whether the disclosure was for a purpose that was consistent with the original collection.

 

The term “consistent purpose” is explained in section 43, which states:

 

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41 (b) and 42 (c) only if the individual might reasonably have expected such a use or disclosure. [1]

Read together, these two provisions entail that a particular disclosure of personal information by an institution would be deemed to be permissible if the individual in question would have reasonably expected the disclosure in question to have taken place.

 

As applied to this privacy complaint, these provisions mean that WSIB’s disclosure of client information to an LMR service provider (SP#2) would be permissible if the complainant would have reasonably expected the disclosure to have taken place.

 

In support of the position that the disclosure to SP#2 was permissible, WSIB explained the reason why it discloses client information to LMR service providers and has stated:

 

… [i]n specific circumstances the WSIB is required to arrange LMR assessments and other services that would enable injured workers to re-enter the labour market. … To fulfill our LMR mandate WSIB uses external providers that we refer to as Primary LMR Service Providers.  The WSIB has a roster of Primary LMR Service Providers and has service agreement with this select group … . The service agreement describes our service arrangement with Primary LMR Service Providers and outlines their restrictive use, disclosure and retention of confidential information they become privy to.

 

Further, WSIB states on its Notice of Collection appearing on the Worker’s Report of Injury/Disease form:

 

Personal information about you will be collected throughout your claim under the authority of the Freedom of Information and Protection of Privacy Act and will be used to administer the Workplace Safety and Insurance Act, 1997. … Information may only be disclosed to … service providers … as authorized by the Workplace Safety and Insurance Act and the Freedom of Information and Protection of Privacy Act.

 

WSIB has also stated that these types of service provider arrangements are required by the Workplace Safety and Insurance Act, which states, at section 42(1):

 

42. (1) The Board shall provide a worker with a labour market re-entry assessment if any of the following circumstances exist:

 

1. If it is unlikely that the worker will be re-employed by his or her employer because of the nature of the injury.

 

2. If the worker’s employer has been unable to arrange work for the worker that is consistent with the worker’s functional abilities and that restores the worker’s pre-injury earnings.

 

3. If the worker’s employer is not co-operating in the early and safe return to work of the worker.

 

WSIB has provided the IPC with a copy of the agreement between WSIB and SP#2.  I have reviewed this agreement and note that it contains provisions mandating the protection of the personal information in the custody of the LMR service provider.

 

WSIB noted that it provides a notice of collection of personal information to all injured workers that are WSIB clients.  This notice, which is excerpted above, is contained in the initial application form (Form 6) that is completed by injured workers and among other things, states that client information may be disclosed to service providers.  Furthermore, WSIB has also stated that it has a privacy statement available on its website in 11 different languages, which explains what information the WSIB collects, how it is used, retained, and protected.  It also explains the potential that WSIB may need to share their personal information with LMR service providers. Specifically, in this regard, it states:

 

… Your personal information may be shared with your treating health care professionals and labour market re-entry service providers to ensure that appropriate medical, and labour market resources are applied to your case.

 

The privacy statement for workers is not only available on the WSIB website.  Upon request, a hard copy would be mailed.  I have been provided with a copy of the statement and have reviewed and considered it for the purpose of this complaint.

 

In determining whether the disclosure to SP#2 constitutes a consistent purpose under the Act, I have considered the information provided by both parties with a view to determining whether the disclosure to SP#2 would have been “reasonably expected”.

 

I have also reviewed IPC Investigation Report PC-990041-1, which also dealt with the disclosure of personal information to a WSIB service provider.  In PC-990041-1, the IPC concluded that the disclosure to the service provider was a “consistent purpose” and therefore in accordance with the Act.

 

In this case, I note that there are several factors that would have made the disclosure to SP#2 “reasonably expected” to the complainant including:

 

• The fact that the complainant had been previously working with a different LMR service provider (SP#1) that had access to his personal information;

 

• The fact that the complainant had been provided with a letter informing him that the LMR service provider would be changing, and that his file would be securely transferred; and

 

• The Notice of Collection and Privacy Statement made available to WSIB clients informing clients that information is provided to LMR service providers.

 

Based on all of the above factors, I am satisfied that the disclosure by WSIB to SP#2 was consistent with the purpose for which it was collected, i.e., for the purposes of administering its responsibilities under the WSIA.  I am also satisfied that an individual in the complainant’s position should have reasonably expected the disclosure to SP#2 as contemplated by section 43.

 

Accordingly, I am satisfied that the disclosure in question was also in accordance with section 42(1)(c) of the Act as a “consistent purpose.”  Having reached this conclusion, it is not necessary to consider the applicability of section 42(1)(e).

 

Disclosure by SP#2 to SP#3

 

In the complainant’s letter to the IPC, the complainant also noted his objection to the disclosure of his claim file information by SP#2 to a secondary LMR service provider (SP#3).  As indicated above, a secondary LMR service provider is a contractor that is hired by a primary LMR service provider (in this case SP#2) to provide additional services to the client.

 

With respect to the disclosure to SP#3, WSIB has stated that the disclosure of file information by a primary LMR provider to a secondary LMR provider is not unusual and is contemplated by the agreement in place between SP#2 and WSIB.  With respect to this issue, WSIB has stated:

 

In order to adequately serve injured workers the Primary LMR Service Provider may require the expertise of another corporation or agency.  The WSIB refers to these subcontracted firms as Secondary LMR Service Providers.  …  Primary LMR Service Providers are required to ensure that subcontractors agree to be bound by and comply with all relevant requirements set in the service agreement they hold with us.

 

I have reviewed the agreement between WSIB and SP#2.  This service agreement contains a section entitled “Confidentiality”.  This section speaks to the responsibility of SP#2 with respect to the handling of information concerning injured workers that it receives from WSIB, including disclosure to any third party, which, in my view, could include a secondary LMR service provider.  This section also restricts SP#2 from disclosing any information “to any third party, except to those of its employees, agents or subcontractors who have a need to know such information, and then only in connection with the exercise of rights or the performance of obligations under the Agreement”.

 

In this regard, WSIB has stated that “[SP#3] is a secondary LMR service provider and any information that may have been disclosed to them would have been provided by [SP#2] in accordance with providing LMR services.”

 

Therefore, based on the above, I am satisfied that the disclosure by SP#2 to SP#3 does not constitute a violation of the provisions of the Act.

 

ADDITIONAL ISSUE

 

Use of Information Release Authorization form

 

An additional issue that was brought to the attention of the IPC during this privacy complaint involves the Information Release Authorization form that clients of SP#2 are required to sign prior to receiving LMR services.  Portions of this form have been excerpted above.

 

In the complainant’s opinion, the current form is misleading as it requests the client’s authorization to “obtain and review records which may be relevant to the provision of Labour Market Re-entry services.”  The complainant has pointed out that aspects of the Information Release Authorization form appear to be inaccurate as it requests that clients provide their authorization to an event that has already taken place (i.e., provision of claim file information to the LMR service provider).

 

Based on this concern, I contacted WSIB to determine whether SP#2 would be willing to consider amending the form to clarify that it collects claim information prior to receiving client authorization.  WSIB acknowledged that SP#2 is bound by the privacy provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA), and that it understands that SP#2 is subject to PIPEDA.  However, WSIB has stated that SP#2 has been contacted and has indicated a willingness to review the form in question.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

• The information in question qualifies as “personal information” under section 2(1) of the Act.

 

• The disclosure of personal information by WSIB to SP#2 was in accordance with section 42(1)(c) of the Act.

 

• The disclosure by SP#2 to SP#3 does not constitute a violation of the Act.

 

 

 

 

 

 

Original Signed by:  February 6, 2007

Mark Ratner Investigator