Privacy Reports
Decision Information
Summary:
The Information and Privacy Commissioner/Ontario received two related complaints under the
Municipal Freedom of Information and Protection of Privacy Act (the Act). The complainants are the same in both cases and are parents whose son had been a student with the Toronto District School Board (the TDSB).
After their son had ceased as a student with the TDSB, the complainants applied to enrol their son in a school within the Toronto Catholic District School Board (the TCDSB). While the request for admission was being considered, the receiving school’s Vice-Principal contacted his counterpart at the son’s former school to obtain information in order to verify the son’s academic status and to assess whether the receiving school could meet his program needs. This contact was made by telephone.
The bases for the complaints are that a) the TCDSB should not have sought information about the son from the TDSB without the written consent of the parents and b) the TDSB should not have provided information about the son to the TCDSB without the parents’ written consent. The complainants maintain that these actions were contrary to the privacy provisions of the
Act.
Decision Content
PRIVACY COMPLAINT REPORT PRIVACY COMPLAINT NOS. MC-030001-1and MC-030002-1 MEDIATOR: Alex Kulynych INSTITUTIONS: Toronto District School Board Toronto Catholic District School Board SUMMARY OF COMPLAINT: The Information and Privacy Commissioner/Ontario received two related complaints under the Municipal Freedom of Information and Protection of Privacy Act (the Act). The complainants are the same in both cases and are parents whose son had been a student with the Toronto District School Board (the TDSB). After their son had ceased as a student with the TDSB, the complainants applied to enrol their son in a school within the Toronto Catholic District School Board (the TCDSB). While the request for admission was being considered, the receiving school’s Vice-Principal contacted his counterpart at the son’s former school to obtain information in order to verify the son’s academic status and to assess whether the receiving school could meet his program needs. This contact was made by telephone. The bases for the complaints are that a) the TCDSB should not have sought information about the son from the TDSB without the written consent of the parents and b) the TDSB should not have provided information about the son to the TCDSB without the parents’ written consent. The complainants maintain that these actions were contrary to the privacy provisions of the Act. DISCUSSION: The following issues were identified as arising from the investigation: 1. Is the information “personal information” as defined in section 2(1) of the Act? 2. Was the disclosure of the personal information by the TDSB in accordance with section 32 of the Act? [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
- 2 - 3. Was the collection of the personal information by the TCDSB in accordance with section 28 of the Act? 4. Was the manner of collection of the personal information by the TCDSB in accordance with section 29 of the Act? 5. Did the TCDSB provide notice of the collection in accordance with section 29 of the Act? Is the information “personal information” as defined in section 2(1) of the Act? Section 2(1) of the Act states, in part: "personal information" means recorded information about an identifiable individual, including, … (b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved, … (h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; The information at issue relates to the son’s special educational needs, which was used to assess whether the new school could accommodate him. Information about a person’s education is specifically included in paragraph (b) of the definition. Accordingly, I conclude that information relating to the education history of the complainants’ son qualifies as “personal information” under the Act. Was the disclosure of the “personal information” by the TDSB in accordance with section 32 of the Act? Section 32 of the Act sets out the rules for disclosure of personal information other than to the individual to whom the information relates. This section provides that an institution shall not disclose personal information in its custody or under its control, except in the circumstances listed in sections 32(a) through (l). [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
- 3 - Section 32 (c) states: An institution shall not disclose personal information in its custody or under its control except, … (c) for the purpose for which it was obtained or compiled or for a consistent purpose; Section 32(c) therefore allows disclosure for the purpose the information was originally collected to serve, or for a consistent purpose. The meaning of “consistent purpose” is explained in section 33 of the Act as follows: The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31(b) and 32(c) only if the individual might reasonably have expected such a use or disclosure. The complainants and both school boards provided information concerning the circumstances relating to the complaints. It can be summarized as follows: The complainants approached the TCDSB in September 2002 with a request that their son be enrolled for the 2002-2003 school year in a particular school (the “new school”) operated by the TCDSB. Throughout the latter part of September, the complainants pursued this request through telephone communication, at least one e-mail, correspondence and personal attendance at the new school, at which time one of the complainants delivered a copy of their son’s transcript to the Vice-Principal. Also provided to the TCDSB was an e-mail excerpt from a TDSB guidance teacher containing suggested courses for the son to take to address his special needs. Copies of written communications from the complainants to the new school, provided to this office by the complainants, indicate that the complainants expressed a sense of urgency concerning their son’s enrolment, presumably because the school year had already commenced. In two of the written communications, the father wrote, “Please provide me in writing immediately; what other documents are required according to TCDSB admission requirements to facilitate the transfer of my son into the TCDSB high school at [the new school]”. In one of these documents (an e-mail), the father asks that this information be provided to him by the end of the working day two days hence. The e-mail is addressed to a TCDSB representative, copied to that board’s Senior Manager, Corporate and Business Services, with a request that a copy of the e-mail be forwarded to the TCDSB Superintendent immediately. In response to the enrolment request, the Vice-Principal of the new school, who was responsible for admissions, telephoned the Vice-Principal of the son’s former school. Because the school year had already begun, to facilitate the application, this contact was made via telephone, as opposed to an exchange of documentation. The conversation centred on the son’s program needs and related issues. It was subsequently decided that the new school could not accommodate the [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
- 4 - son’s special needs and the application was denied. The son was under the age of sixteen at the time. The TDSB provided this office with a detailed summary of the son’s academic history, including his attendance in various schools within both boards, as well as his special needs. The TDSB relies on sections 32(b), (c) and (e) of the Act to justify its disclosure of the son’s personal information to the TCDSB. Under the circumstances, it is only necessary to deal with section 32(c). In its response to the complaint, the TDSB described the scheme under the Education Act and the related Regulation for dealing with “exceptional pupils”: As described above, [the son] has very significant special needs. Information about a student’s special needs is compiled pursuant to a school board’s statutory duty to provide education to its “exceptional pupils”. Specifically, section 170(1), para. 7 of the Education Act requires that: “Every board shall…provide…in accordance with the regulations special education programs and special education services for its exceptional pupils”. The term “exceptional pupil” is defined by s. 1(1) of the Education Act as: A pupil whose behavioural, communicational, intellectual, physical or multiple exceptionalities are such that he or she is considered to need placement in a special education program by a committee, established under subparagraph iii of paragraph 5 of subsection 11(1)… In turn, subsection 11(1)(5)(iii) permits the Minister of Education to make regulations “governing the provision, establishment, organization and administration of…committees to identify exceptional pupils and to make and review placements of exceptional pupils”. To that end, the Minister issued Ontario Regulation 181/98, “Identification and Placement of Exceptional Pupils” (the “Regulation”), which provides for the establishment of an “identification, placement and review committee” (IPRC) and which sets out the process by which the IPRC performs its task of identifying the special needs of exceptional pupils and make decisions regarding appropriate placement. Section 17(1) of the Regulation provides that, in assessing the appropriate program and support services for a student, the IPRC is required to consider, inter alia: (1) the student’s needs; and (2) parental preferences. In addition, section 15(1) provides that the IPRC must “obtain and consider an educational assessment of the pupil”. Parental consent is not required in order to conduct the educational assessment. [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
- 5 - … Section 6 of the Regulation requires that the Principal of the school within which an exceptional pupil is ultimately placed, in consultation with the parent, staff and professionals, develop an Individual Education Plan (IEP), identifying specific objectives and outlining educational services to be provided to the student. Part V of the Regulation provides for, inter alia, ongoing review of the students’ circumstances, needs and placement. Given [the son’s] unique circumstances, any disclosure to the Catholic Board by [the Vice-Principal] about [the son] having special needs was solely for the purpose of assisting the Catholic Board in providing [the son] with an appropriate educational placement, the same (or at least consistent) purpose for which the information was first compiled by the TDSB. Upon applying to re-enrol with the Catholic Board, [the son] and his parents ought reasonably to have expected that there would be contact and discussion between the Catholic Board and the TDSB about [the son’s] academic circumstances and needs necessarily involving some disclosure of [the son’s] personal information. Otherwise, [the son] could not be assured of receiving an appropriate educational placement, something both boards are obliged to provide, especially to special needs students. [emphasis in the original] Based on the information provided to me, I conclude that section 32(c) of the Act applies in the circumstances of these complaints. In my view, the disclosure by the TDSB to the TCDSB of the complainants’ son’s personal information was for the original purpose for which it was obtained or compiled, namely the proper assessment and accommodation of the son’s special needs. Furthermore, in my view, the complainants should have reasonably expected that under the circumstances, there would be contact between the two boards to address the enrolment request. The urgency expressed in the complainants’ communication with the TCDSB in their application to have their son admitted to a school within that board, the timing of the application (after the school year had begun) and their apparent persistence in pursuing the application supports this view. Was the collection of the personal information by the TCDSB in accordance with section 28 of the Act? Section 28(2) of the Act reads: No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
- 6 - enforcement or necessary to the proper administration of a lawfully authorized activity. Section 265 of the Education Act outlines the duties of a school principal. Section 265(1)(c) states: It is the duty of a principal of a school, in addition to the principal’s duties as a teacher, to register the pupils and to ensure that the attendance of pupils for every school day is recorded either in the register supplied by the Minister in accordance with the instructions contained therein or in such other manner as is approved by the Minister; Having received a request from the complainants to enrol their son in the school, the Principal, through the Vice-Principal, took steps to assess the pupil and the school’s ability to accommodate him, for the purpose of registering the son. Registration could not take place without first collecting relevant information about the student seeking admission. In my view, the TCDSB’s collection of the son’s information was necessary to the proper administration of a lawfully authorized activity namely, to the son’s registration as outlined in section 265(1)(c) of the Education Act. I conclude, therefore, that the collection of the son’s information by the TCDSB was in accordance with section 28 of the Act. Was the manner of collection of the personal information by the TCDSB in accordance with section 29 of the Act? Section 29 of the Act describes the manner in which personal information is to be collected. Section 29(1)(b) reads: An institution shall collect personal information only directly from the individual to whom the information relates unless, the personal information may be disclosed to the institution concerned under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act; As described above, the TCDSB collected the personal information of the complainant’s son from a Vice-Principal of the son’s former school. Disclosure under section 32 of the Act is one of the exceptions under section 29(1) whereby an institution is not required to collect personal information directly from the individual. I concluded above that the TDSB disclosed the son’s personal information in accordance with section 32(c) of the Act. Accordingly, it is my view that the TCDSB collected the son’s information in accordance with section 29 of the Act. [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
- 7 - Did the TCDSB provide notice of the collection in accordance with section 29 of the Act? The provisions of the Act relating to the requirement that an institution notify individuals of personal information collection are found in Section 29. Sections 29(2) and 29(3) of the Act read: (2) If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of, (a) the legal authority for the collection; (b) the principal purpose or purposes for which the personal information is intended to be used; and (c) the title, business address and business telephone number of an officer or employee of the institution who can answer the individual's questions about the collection. (3) Subsection (2) does not apply if, (a) the head may refuse to disclose the personal information under subsection 8(1) or (2) (law enforcement) or section 8.1 (Remedies for Organized Crime and Other Unlawful Activities Act, 2001); (b) the Minister waives the notice; or (c) the regulations provide that the notice is not required. No information was presented during my investigation which would indicate that any of the three conditions of section 29(3) of the Act were present. I am not satisfied that there was any provision under the Act exempting the TCDSB from notifying the complainants of the collection of the son’s personal information. I conclude that failure to give notice of the collection was not in accordance with section 29 of the Act. CONCLUSIONS: I have reached the following conclusions based on the results of my investigations: • The information in question is “personal information” as defined by section 2(1) of the Act; [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
- 8 - • The disclosure of the personal information by the TDSB was in accordance with section 32 of the Act; • The collection of the personal information by the TCDSB was in accordance with section 28 of the Act; • The manner of collection of the personal information by the TCDSB was in accordance with section 29 of the Act; and • The TCDSB did not provide notice of collection in accordance with section 29 of the Act. RECOMMENDATION: I recommend that the TCDSB ensure that in the future where an indirect collection has taken place under section 29(1) of the Act, notice be given under section 29(2), unless an exception under section 29(3) applies. February 24, 2004 Alex Kulynych Mediator [IPC Privacy Complaint MC-030001-1 and MC-030002-1/February 24, 2004]
You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.