Privacy Reports
Decision Information
Summary:
This Privacy Complaint Report deals with two similar, but unrelated, privacy complaints. Both privacy complaints involve the Toronto Police Service, (the TPS) and its practice of disclosing information in response to Police Reference Checks. In both cases, the complainant was concerned that the actions of the TPS were inappropriate, and constituted a breach of the provisions of the Municipal Freedom of Information and Protection of Privacy Act. The investigation concluded that the personal information was not disclosed in accordance with section 32 of the Act and provided recommendations for the TPS.
Decision Content
PRIVACY COMPLAINT REPORT PRIVACY COMPLAINT NO. MC-050045-1 and MC-050047-1 Toronto Police Services Board Tribunal Services Department Services de tribunal administratif Tel: 416-326-3333 2 Bloor Street East 2, rue Bloor Est 1-800-387-0073 Suite 1400 Bureau 1400 Fax/Téléc: 416-325-9188 Toronto, Ontario Toronto (Ontario) TTY: 416-325-7539 Canada M4W 1A8 Canada M4W 1A8 http://www.i pc.on.ca
PRIVACY COMPLAINT REPORT PRIVACY COMPLAINT NO. MC-050045-1 and MC-050047-1 INVESTIGATOR: Mark Ratner INSTITUTION: Toronto Police Services Board SUMMARY OF COMPLAINT: This Privacy Complaint Report deals with two similar, but unrelated, privacy complaints that were received by the Office of the Information and Privacy Commissioner/Ontario (IPC). Both privacy complaints involve the Toronto Police Service, (the TPS) and its practice of disclosing information in response to Police Reference Checks. In both cases, the complainant is concerned that the actions of the TPS were inappropriate, and constituted a breach of the provisions of the Municipal Freedom of Information and Protection of Privacy Act (the Act). Complaint files MC-050045-1 and MC-050047-1 were opened and the IPC proceeded to investigate the complaints. Since the issues raised in the two complaints were similar and the institution complained against was the same, I decided to issue one report which will comprise the results of my investigation of both complaints MC-050045-1 and MC-050047-1. The complainants in both MC-050045-1 and MC-050047-1 had previously been the subject of detainments by members of the TPS pursuant to section 17 of the Mental Health Act. Under that provision, the police have the legal authority to apprehend a person where the officer in question has reasonable grounds to believe that the individual is acting in a manner where he or she may cause harm to either themselves, or to another person. The purpose of such apprehensions, which are non-criminal in nature, is to enable the police to take an individual that may be at risk to a location where he or she may be examined by a medical professional. In both the cases dealt with in this Report, the complainants had each been the subject of such detainments, and the fact that the detainments had taken place had been recorded by the TPS. Subsequent to their detainments, both complainants had applied for what are known as “vulnerable sector positions.” In this context, the term “vulnerable sector position” is used to describe voluntary or paid positions where an applicant would be in a position of trust over [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 2 - individuals that are deemed to be “vulnerable” (such as children, the elderly, or persons with disabilities). A Police Reference Check is a mandatory component of the application process for each position, and each complainant had signed the TPS form titled “Police Reference Check Program – Consent to Disclosure of Personal Information.” Upon receiving the signed form, the TPS conducted a search of its records, and in both cases identified the complainants’ previous detainment under the Mental Health Act. In both cases, the TPS then sent a letter, signed by the TPS Co-ordinator of Corporate Information Services, to the organization that was the subject of each complainant’s application. In each case, the letter stated: Please be advised that a Police Reference Check has been conducted on [complainant’s name] who has made application with your Agency. As a result of this search the aforementioned applicant has been mailed a summary sheet outlining the information on file with this service. Based on this letter, both organizations learned that the TPS had information on file about each of the applicants. (In cases where nothing turns up as a result of a Police Reference Check, the letter sent would indicate that the individual’s record is clear). As a result of the letter, the organizations realized that information about each of the applicants existed, and consequently, the applications of both complainants were denied by the organizations. With respect to both privacy complaints, the complainants feel that their privacy has been compromised, and that the actions of the Police contravene the privacy protection provisions of the Act. DISCUSSION: The following issues were identified as arising from the investigation: • Is the information “personal information” as defined in section 2(1) of the Act? • Was the collection of the “personal information” in accordance with sections 28(2) and 29(1) of the Act? • Was the disclosure of the “personal information” in accordance with section 32 of the Act? I will deal with each issue below. Is the information “personal information” as defined in section 2(1) of the Act? Under the definition of “personal information,” section 2(1) of the Act states, in part: [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 3 - “personal information” means recorded information about an identifiable individual, including, … (b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved, … (h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual … . In both of these cases, there are two separate sets of information at issue. First, there is the information that was collected by the TPS. In this case, the information in question includes the complainant’s name, his or her date of birth, the fact that the individual had been detained under the Mental Health Act, and the date of that incident in question. I am satisfied that this information clearly falls within the definition of “personal information” under the Act. The second set of information is the information that was disclosed by the TPS in the letters that were sent by the Co-ordinator of Corporate Information Services. The information in question was the name of each complainant, as well as the fact that the TPS had information on file about that individual. In both cases, the TPS did not disclose the specifics of the incident that it had on file. I have reviewed copies of the letters sent making reference to both complainants. I am satisfied that the recipients of these letters would be able to reasonably conclude that the complainant had been involved in some sort of incident involving the police. If there had been no involvement, the letter received would have indicated that no record existed. I am therefore satisfied that the information that was disclosed by the TPS qualifies as the complainants’ personal information under section 2(1) of the Act. Was the collection of the “personal information” in accordance with sections 28(2) and 29(1) of the Act? Having determined that personal information was collected by the TPS, it is necessary to determine whether the collection was in accordance with the provisions of the Act. In the case of both complainants, this information was collected by members of the TPS when they were carrying out their duties to detain individuals under the Mental Health Act. [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 4 - Section 28(2) of the Act states: No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. Under this provision, in order for a given collection of personal information to be permissible, the institution must demonstrate that the activity in question fits into at least one of the three branches of section 28(2) that are set out above. In this case, the branch that most likely applies is the branch that permits disclosure for the purpose of law enforcement. For the purposes of the Act, the term “law enforcement” is defined in section 2(1), which states: “law enforcement” means, (a) policing, (b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, and (c) the conduct of proceedings referred to in clause (b); Clearly, the police officers who collected the information pertaining to the detainments under the Mental Health Act were engaged in policing. I base this conclusion on the wording of section 17 of the Mental Health Act, which expressly states that it is a “police officer” who has the power to detain an individual. Based on this reasoning, I am satisfied the police officer’s collection of the complainants’ personal information took place during the course of law enforcement activities and is therefore permissible under section 28(2) of the Act. Section 29(1) of the Act, which deals with the manner in which personal information is collected, states that institutions should only collect personal information directly from the individual to whom the information relates unless one of the listed exceptions (the provision lists eight such exceptions) applies. In this instance, the information in question was collected directly from the affected individuals. As a result, it is not necessary to examine the section 29(1) exceptions to determine if the collection of personal information was permissible. [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 5 - In both privacy complaints at issue, the complainants have indicated that they were never informed that personal information relating to their detainments was being recorded or retained by the TPS. Based on the particular circumstances of this case, I am satisfied that it was not feasible for the TPS to have provided the complainants with notice of the fact that their personal information was being collected as set out in section 29(2). Was the disclosure of the “personal information” in accordance with section 32 of the Act? The final issue to address in this privacy complaint is the question of whether or not the disclosure by the TPS that a record existed for each complainant constituted an inappropriate disclosure of personal information in contravention of section 32 of the Act. In written materials provided to the IPC, one of the complainants stated: I believe that the Toronto Police Services is breaching my privacy by including Mental Health Act incidents on my police record. The inclusion constructively forces me to reveal my personal information while seeking employment opportunities at agencies that require a police reference check. … The Toronto Police Services Board must remove Mental Health Act incidents from a police reference check, as it reveals personal health information about persons with psychiatric illnesses detained under this Act ... . The disclosure of my personal health information … is in violation of s. 32 of the MFIPPA. This section states that “an institution shall not disclose personal information in its custody or under its control” with certain exceptions. None of the exceptions to this section apply in my situation. … The disclosure of my personal information is not permitted under s. 32(b). I was not given an opportunity to identify my personal information that the police are using and I have not consented to the disclosure of this information. In a letter to the IPC, the complainant in the second privacy complaint expressed similar sentiments. The TPS responded to this aspect of the privacy complaint, and expressed its view that the disclosure, in both instances, was permissible under the Act: [The complainants] signed a “Consent to Disclosure of Personal Information”… . The waiver and release provides this Service with the authorization to search “all record databases” and disclose the results of this search pursuant to the Police Services Act, the Criminal Records Act, and the Municipal Freedom of Information and Protection of Privacy Act. The waiver and release [the complainants] signed also authorizes that “In the event that pertinent information [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 6 - is provided to me, I consent to the Toronto Police Service disclosing that fact to the organization identified below.” The results of the criminal records check were sent directly to [the complainant] and not to the employer. The employer, who required that this check be conducted, was advised in writing by this Service that the records check had been completed and the results had been mailed directly to [the complainants]. … In so much as [the complainants] consented in writing to the search and to the employer being made aware that information was provided to [the complainants], no privacy rights have been breached. In order for a given disclosure of personal information to be permissible under the Act, the institution disclosing the information must demonstrate that the disclosure is permissible under section 32. I have reviewed the provisions of section 32, and I am of the view that sections 32(b), 32(c) and 32(e) are potentially the most applicable to the disclosure in question. In order to determine whether the actions of the TPS were permissible, I will address these provisions more closely. Section 32 of the Act states, in part: An institution shall not disclose personal information in its custody or under its control except, … (b) if the person to whom the information relates has identified that information in particular and consented to its disclosure; (c) for the purpose for which it was obtained or compiled or for a consistent purpose; … (e) for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act or a treaty; … Section 32(b) Section 32(b) of the Act permits an institution to disclose personal information where the person to whom the information relates has identified that information in particular and consented to its disclosure. [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 7 - In order to determine whether the disclosures that have taken place are in accordance with section 32(b), it is helpful to analyze the wording of the consent form that had been signed by both complainants, which states: I hereby request the Toronto Police Service to undertake a Police Reference Check on me by searching all record databases identified in the Memorandum of Understanding, and provide me with a summary of any information revealed pursuant to the Police Reference Check Program. In the event that no information about me is found as part of that check, I consent to the Toronto Police Service disclosing that fact to the organization identified below. In the event that pertinent information is provided to me, I consent to the Toronto Police Service disclosing that fact to the organization identified below. The form at issue provides that the individual signing agrees to have the TPS conduct a search of all information it may have on file relating to that individual, which may be located in a prescribed set of databases, and to provide a letter addressing the results of the search to the organization in question. In a statement provided to the IPC, the representative for both complainants (both complainants have the same representative) has stated: It is the position of the complainants that they did not consent to the disclosure of the information in question as they did not identify the information in particular, i.e., they did not identify and consent specifically to the disclosure of police records related to the Mental Health Act. The consent provided was not informed consent. … The consent form used by the Toronto Police Service is very broad and makes no indication that anything other than criminal records would be included. The wording of the consent refers to a search of “all records databases identified in the Memorandum of Understanding”. It is not reasonable to expect that regular members of the public be aware of what type of records would be included in such a broad description or that they be familiar with the Memorandum of Understanding in question [emphasis in original]. In this case, I agree with the position taken by the complainants. I note that, section 32(b) of the Act, by stating that the person in question must “identify the information in particular” and consent to its release, is implicitly contemplating that applicants provide their informed consent prior to the disclosure of their information to third parties. In my view, the wording of the consent form does not adequately describe the type of information that lead to the disclosure in this case by the TPS. The consent does not satisfy the requirement in section 32(b) that the individual providing their consent must identify the information in particular before it may be disclosed. [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 8 - As such, I am not satisfied that the disclosure was in accordance with section 32(b). It is notable that in response to its receipt of a Draft Report, the TPS has provided our office with a more recent version of its consent form. This more recent version does not contain a reference to the “Memorandum of Understanding”. Section 32(c) Section 32(c) provides that an institution may disclose personal information for the same purpose for which it was obtained or compiled, or for a consistent purpose. Section 33 provides guidance for determining whether a disclosure of personal information is a consistent purpose under the Act. This provision states: The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses … 32 (c) only if the individual might reasonably have expected such a use or disclosure. Therefore, in order to assess whether the TPS’ actions are in accordance with section 32(c) it is necessary to first determine the purpose underlying both the collection, (i.e., the reason why it was obtained or compiled) and the disclosure of the information in question. The second step is to determine whether these purposes are consistent with one another. As discussed above, the TPS lawfully collected this mental health information while carrying out its policing duties to apprehend individuals under the Mental Health Act. Therefore, the purpose of the collection of information was to properly document a police incident. The information was disclosed in response to both complainants’ applications for positions requiring a Police Reference Check. The purpose of the disclosure, therefore, was to provide a response to the Police Reference Check. To paraphrase the meaning of section 33, a disclosure of personal information would only be considered to be a “consistent purpose” if the person in question might reasonably have expected the disclosure to have taken place. In the case of both complainants, I am not satisfied that the fact that they had been involved in a mental health incident in past would reasonably lead them to expect the disclosure of the information in question. I base this conclusion on a number of factors, including: • that the complainants were not notified that the information would be retained at the time of the incident; • that the incidents in question were non-criminal, and not of the sort that people would normally expect to come up in a Police Reference Check; and [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 9 - • that the consent form does not state that incidents under the Mental Health Act may form the basis of a letter indicating that a record exists. Based on these factors, I am not satisfied that the disclosure would have been “reasonably expected” by the complainants within the meaning of section 33 of the Act. As such, I conclude that the disclosure was not in accordance with section 32(c). Section 32(e) Section 32(e) provides that an institution may disclose personal information where that disclosure is legally required under “an Act of the Legislature or an Act of Parliament … .” In order to determine whether section 32(e) applies, I have reviewed the Police Services Act (the PSA), as well as the Regulations made under the PSA to determine whether the disclosure of mental health information would be required pursuant to a police records check. I note that sections 41(1.1) and 41(1.2) of the PSA confer a broad discretion on Chiefs of Police to disclose personal information in a variety of circumstances, as long as the disclosure is in accordance with the regulations. These provisions state: 41(1.1) Despite any other Act, a chief of police, or a person designated by him or her for the purpose of this subsection, may disclose personal information about an individual in accordance with the regulations. 41 (1.2) Any disclosure made under subsection (1.1) shall be for one or more of the following purposes: 1. Protection of the public. 2. Protection of victims of crime. 3. Keeping victims of crime informed of the law enforcement, judicial or correctional processes relevant to the crime that affected them. 4. Law enforcement. 5. Correctional purposes. 6. Administration of justice. 7. Enforcement of and compliance with any federal or provincial Act, regulation or government program. [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 10 - 8. Keeping the public informed of the law enforcement, judicial or correctional processes respecting any individual [emphasis added]. Further, section 41(1.3) of the PSA states that any disclosure made under section 41(1.1) will be deemed to be in accordance with section 32(e) of the Municipal Freedom of Information and Protection of Privacy Act. Ontario Regulation 265/98, made under the PSA, clarifies the circumstances under which a police service may disclose personal information under section 41(1.1) of the PSA. Regulation 265/98 contains 5 sections, each describing situations where such disclosures may take place. I have carefully reviewed the wording of Ontario Regulation 265/98, and note that all of the disclosures permitted under that Regulation relate to situations where the individual in question has either been charged, convicted, or under investigation with respect to an offence under a federal or a provincial Act. I note that in the case of the complainants, neither has been charged, convicted or been under investigation with respect to an offence. Rather, both have been the subject of a non-criminal detainment under the Mental Health Act. As such, I am not satisfied that the disclosure that took place was in accordance with any of the provisions of Ontario Regulation 265/98, which leads to the conclusion that the disclosure was not in accordance with section 41(1.1) of the PSA. As such, I am not satisfied that the disclosure was in accordance with section 32(e) of the Act. Conclusion – Section 32 In light of the above discussion, I am not satisfied that the disclosure of personal information that took place was in accordance with section 32 the Act. CONCLUSION: I have reached the following conclusions based on the results of my investigation: • The information in question qualifies as “personal information” as defined in section 2(1) of the Act. • The personal information was collected in accordance with sections 28(2) and 29(1) of the Act, and notice under section 29(2) was not feasible in the circumstances of this case. • The personal information was not disclosed in accordance with section 32 of the Act. RECOMMENDATIONS: In light of the fact that I have concluded that the consent form currently in use does not satisfy the requirements for consent established in section 32(b), I recommend that the TPS amend its [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 11 - form so that it fully complies with the statutory requirement to obtain informed consent prior to disclosing personal information. As a result of the foregoing, I recommend: 1. That the TPS amend its consent form to explicitly state that prior detainments under the Mental Health Act may be included within the scope of the Police Reference Check process. 2. That the TPS remove the reference to the “Memorandum of Understanding” in the consent form and expressly state which databases, as well as the type of information, that would potentially be subject to disclosure. By February 2, 2007, the institution should provide the Office of the Information and Privacy Commissioner/Ontario with proof of compliance with the above recommendations. OTHER MATTERS During the course of this privacy investigation, I reviewed a similar form that is used by the Ottawa Police Service for vulnerable sector screenings. 1 I note that this form contains an express statement that reports resulting from incidents under the Mental Health Act may be released where appropriate. I have also reviewed the September 1997 Guidelines for the Volunteer/Applicant Screening Process (the Guidelines) prepared by the Ontario Association of Chiefs of Police, which contains an example of a “consent to disclosure” form that could be used by police services to obtain an individual’s consent to a Police Reference Check. I note that the form contained in the Guidelines contains a precise description of all of the types of information that would be disclosed to agencies pursuant to a Police Reference Check. In my view, the form contemplated by the Guidelines, as well as the form being used by Ottawa Police Service, could satisfy the consent requirement under section 32(b) of the Act. Having reached the conclusion above, I realize that the act of amending the consent form will not directly address the complainants’ concerns, as a record of their incidents are still on file with the TPS. As well, the fact that such a record exists will still be provided to outside agencies, after informed consent has been obtained. Both complainants are interested in pursuing careers working with people in the vulnerable sector, and in both cases, the existence of Mental Health Act detainments on file with the police limits their ability to pursue these career goals. As indicated above, Police Reference Checks are a customary component of the application process for such positions. 1 This form is available online (accessed June 2, 2006): http://www.ottawapolice.ca/en/serving_ottawa/support_units/pdf/police_records_check.pdf [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
- 12 - Currently, it is the policy of the TPS to send a letter noting prior contact in all cases involving detainments under the Mental Health Act. Although I have concluded that this practice is not a violation of the provisions of the Act (provided that informed consent has been received), I do have concerns that this policy may unfairly impact upon the employment prospects of individuals that may not pose any risk to the vulnerable sector. I note that the difficulties posed by Police Reference Checks discussed in this Privacy Complaint Report are not unique to the TPS, nor are they unique to Ontario. Other police services and jurisdictions in Canada have also attempted to facilitate Police Reference Checks in a manner that protects vulnerable persons while providing some privacy protections to individual applicants. In Ontario, some police services have also attempted to create processes where an assessment of the potential risk posed by the individual is considered prior to disclosing the fact that a record exists. I note that at least one other police service in the province of Ontario appears to be introducing a process whereby risk is assessed on a case-by-case basis for each applicant. In my view, adding a discretionary risk assessment component to the process is an approach that is preferable to the current TPS process. Individuals who have previously been detained by the police under the Mental Health Act may have been detained for a myriad of reasons, and in many cases, such detainments are not necessarily indicative of the person posing a risk. (At least, the individual may pose no greater risk than other members of the public). As such, I would recommend that the TPS reconsider its policy of automatic disclosure of records of a non-criminal detainment under the Mental Health Act pursuant to Police Reference Checks. As an alternative approach, I would recommend that the TPS consider implementing a discretionary process of assessing risk on a case-by-case basis before sending a letter to an organization indicating prior contact with the police. In making this assessment, the TPS should consider the events relating to the original detainment, and whether such events are indicative of a potential risk. November 2, 2006 Mark Ratner Investigator [IPC Privacy Complaint MC-050045-1 and MC-050047-1 / November 2, 2006]
You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.