PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT MC16-10

Corporation of the Township of McGarry

May 26, 2017

Summary: The Office of the Information and Privacy Commissioner of Ontario received a complaint alleging that the Township of McGarry (the Township) contravened the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) when it disclosed a resident’s personal information to a third-party who in turn contacted the resident to advertise their services. The Privacy Complaint Report concludes that the Township’s use and disclosure of the personal information was not in accordance with sections 31  and 32  of the Act .

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56 , as amended, sections 2(1), 31 (b), 32 (c) and 33.

Orders and Investigation Reports Considered: MC07-64

BACKGROUND:

[1]  The Office of the Information and Privacy Commissioner/Ontario (IPC) received a privacy complaint from an individual (the complainant) under the Municipal Freedom of Information and Protection of Privacy Act (the Act) against the Corporation of the Township of McGarry (the Township).

[2]  The complainant alleges that the Township disclosed her personal information and that of other residents to a third-party warranty provider: The Service Line Warranties of Canada (SLWC) who in turn contacted residents to advertise their services. The complainant states that she received three letters from the SLWC with the Township’s letterhead and signed by the Town Clerk/Treasurer, advising her of their water line warranty program and that the envelope was sent from Miami, Florida. In support of her complaint, the complainant provided a letter addressed to her dated October 5, 2015. This letter, which used the Township’s letterhead and was signed by the then Clerk/Treasurer, stated, in part:

Did you know that necessary repairs to the water line that runs between your home and the public utility connection are the responsibility of the homeowner? These lines have been subjected to the same elements that have caused our public service lines to decay – age, ground shifting, root invasion, fluctuating temperatures and more.

As a McGarry homeowner and township official, I understand the importance of water conservation and protecting the environment. While efforts are underway in many communities to improve public water and sewer systems, these fixes don’t address the water line located on your property. Homeowners can spend from hundreds to upwards of $3,500 to repair a broken or leaking water line on their property – and that can be hard on a budget.

This is why I am pleased to introduce a new voluntary service line repair program which provides repair coverage for your outside water line, up to $5,000 per incident with no deductibles. The Service Line Warranties of Canada (SLWC) Water Line Warranty Program is the only service line protection program for homeowners fully supported by McGarry and endorsed by Local Authority Services (LAS). The program provides coverage 24 hours a day, 365 days a year.

SLWC, an independent organization, administers the program and is a BBB Accredited Business with an A+ rating. SLWC has helped more than 100,000 homeowners across North America save over $64 million in service line repair costs.

[3]  The complainant states that she did not give the Township her consent to provide her personal information to the SLWC, and is further concerned that the SLWC will in-turn disclose her personal information to other parties. The complainant states that her personal information was provided to the Township “only for tax purposes, water and sewage billing (for Town use only).”

[4]  The information provided by the Township is consistent with that provided by the complainant, and included the following additional information. The SLWC is described as a private company that provides water, sewer and in-home plumbing warranty program for homeowners. The Marketing License Agreement, signed by the Township and SLWC, describes the SLWC as a corporation organized under the laws of British Columbia that has entered into a master contract with the Local Authority Services (LAS). The LAS is a non-profit corporation affiliated with the Association of Municipalities of Ontario. In this circumstance, the Township presented information indicating that it was participating in a program being offered to multiple municipalities and involving the LAS.

[5]  The Marketing License Agreement’s objective is to make residents aware of the following services: external sewer line warranty; external water line warranty and in-home plumbing warranty. This agreement permitted the SLWC to use the Township’s logo on letterhead and to send advertising, billing and marketing materials to residential property owners. It also required a signature by a city official. In return, the SLWC agreed to pay the municipality five percent of the revenue from warranty products collected from residents.

[6]  In addition, the Township advised that on March 10, 2015, a resolution was carried at the regular meeting of Council concerning the agreement with SLWC and the marketing of SLWC to residents. The resolution stated, in part:

Therefore, be it resolved that, the Township of McGarry endorses the Sewer and Water Line Warranty service offered by Service Line Warranties of Canada (SLWC), and endorsed by LAS.

And further that, the Council of the Township of McGarry authorizes the Mayor and Clerk Treasurer to enter into an agreement with SLWC related to the marketing of the Sewer and Water Line Warranty Service to municipal residents. [Original emphasis]

[7]  The Township acknowledged that it sent information to a third party mailing house, International Delivery Solutions (IDS), via Sharefile (a file sync and sharing service) on behalf of SLWC which consisted of names, addresses and water account numbers. The Township stated that a total of 365 addresses were provided to IDS and that the water accounts were the source of this information. The Township also confirmed that it was aware of the mailing of marketing letters by IDS to residents using the information it provided.

[8]  In response to this investigation, the Township acknowledged that the use and disclosure of the residents’ personal information did not comply with the Act . The Township confirmed that all future campaigns have been canceled and further printing of marketing materials has ceased.

ISSUES:

[9]  The issues raised by the complainant are as follows:

1. Does the information at issue qualify as the complainant’s “personal information” under section 2(1) of the Act?
2. Was the use of the information in accordance with section 31 of the Act?
3. Was the disclosure of the information to IDS in accordance with section 32 of the Act?

DISCUSSION:

1. Does the information at issue qualify as the complainant’s “personal information” under section 2(1) of the Act?

[10]  Personal information is defined in section 2(1) of the Act which states, in part:

“personal information” means recorded information about an identifiable individual, including,

 …

(d) the address, telephone number, fingerprints or blood type of the individual,

 …

(h)   the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[11]  The Township confirmed that the information at issue is the complainant’s name, address and water account number. This information meets the requirements of paragraphs (d) and (h) of the definition of “personal information” in section 2(1) of the Act. This conclusion is not disputed by the parties and therefore I find that the information in question is “personal information” as defined in the Act.

2. Was the use of the information in accordance with section 31 of the Act?

[12]  The information provided indicates that the Township collaborated with SLWC to promote the services offered. Included in the information provided by the Township is a document, authored by the SLWC, addressing frequently asked questions about the Service Line Warranty Program. It explicitly states that it is working with the municipality to make residents aware of the program and acknowledges that it is permitted to use the Township logo, and the signature of a city official.

[13]  There is no dispute that the Township used the names, addresses and water account numbers to assist in marketing the SLWC’s warranty program to municipal residents.

[14]  Section 31 of the Act provides a list of exceptions to the general prohibition against the use of personal information by institutions, as follows:

An institution shall not use personal information in its custody or under its control except,

(a)   if the person to whom the information relates has identified that information in particular and consented to its use;

(b)   for the purpose for which it was obtained or compiled or for a consistent purpose; or

(c)   for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act.

[15]  Section 33 defines consistent purpose as referenced in section 31(b) as follows:

The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31 (b) and 32 (c) only if the individual might reasonably have expected such a use or disclosure.

[16]  In order for a given use of personal information to be permissible under the Act , the institution must demonstrate that the use was in accordance with at least one of the section 31 exceptions. In determining that the use was not in compliance with the Act , I note that neither sections 31(a) and 31(c) are applicable in the circumstances. Section 31(a) only applies when consent is provided by an individual to permit a specific use. No such consent was provided in this circumstance. Likewise, section 31(c) is not applicable as none of the purposes for which the information may be disclosed to the institution described in section 32 apply in the circumstances.

[17]  As explained in Privacy Complaint Report MC07-64, when determining whether a particular use of personal information is in accordance with section 31(b) “it is first necessary to determine the original purpose of the collection. Next, it is necessary to assess whether the use of this information can be properly characterized as being either for the original purpose of the collection, or for a purpose that is consistent with that original purpose.”

[18]  Although the Township initially stated that the use and disclosure of the personal information was in accordance with the Act , it subsequently acknowledged that the use did not comply with section 31(b). It noted that the information used was originally obtained from solicitors in charge of purchase/selling residences in the Municipality in order to create a water account.

[19]  In this circumstance, the Township explained that it collected the information for “water billing purposes.” The residents’ name(s) and address information is provided as part of the purchase/selling of residences to establish water accounts with the Township. There is no indication that notice was provided to purchasers specifying other uses, including marketing services such as those offered by the SWLC.

[20]  The Township acknowledges that the use of personal information to market SLWC’s services is not consistent with the original purpose of the collection.

[21]  As Privacy Complaint Report MC07-64 explained “[t]here must be a rational connection between the purpose of the collection and the purpose of the use in order to meet the ‘reasonable person’ test set out in section 33.” The information provided by the Township included materials prepared by the LAS indicating the purpose of using residents’ personal information. The document labelled “Marketing Approach” identified the objective of promoting the warranty program as a means of protecting residents from the high repair costs and offered three products: external sewer line warranty, external water line warranty, and in-home plumbing warranty.

[22]  As previously indicated, the SLWC used the information obtained from Township to promote its products. The Marketing License Agreement permitted the SLWC to use the Township’s logo on letterhead, advertising, billing and marketing materials to be sent to residential property owners. It also required signature by a city official. In return, the Township would receive a percentage of SLWC’s revenues from warranty products sold to residents.

[23]  Based on the information provided, I conclude that the Township’s use of the personal information is not for the purpose for which it was obtained or compiled or for a consistent purpose. I also conclude that an individual in the complainant’s position would not have reasonably expected the use of their personal information, as set out in section 33, to market the warranty program. Accordingly, the Township’s use of the information was not in accordance with section 31 of the Act .

3. Was the disclosure of the information at issue to IDS in accordance with section 32 of the Act?

[24]  There is no dispute that the Township disclosed personal information of its residents to IDS.

[25]  Section 32 of the Act provides a list of exceptions to the general prohibition against the disclosure of personal information by institutions. In order for a given disclosure of personal information to be permissible under the Act , the institution must demonstrate that the disclosure was in accordance with at least one of the section 32 exceptions. After careful consideration, the only exception of potential relevance to this case is section 32(c), which states:

An institution shall not disclose personal information in its custody or under its control except,

(c)   for the purpose for which it was obtained or compiled or for a consistent purpose;

[26]  The Township recognized that the disclosure of the residents’ personal information did not comply with the Act . The Township explained that the names, addresses and water account numbers were provided to the third party mailing house, IDS. The Township elaborated that IDS did not share residents’ personal information with SLWC. Instead, SLWC provided the written materials to IDS while IDS received the personal information from the Township. IDS assembled the information and mailed it to residents.

[27]  The Township provided the IPC with a copy of the SLWC “Customer Mailing List Protocol” that was included as part of the LAS information package for municipalities. The “Customer Mailing List Protocol” acknowledges the privacy considerations, stating:

… privacy restrictions related to public records in Canada do not allow for companies such as SLWC to acquire mailing lists of eligible properties directly from the municipality for the purposes of soliciting a product or service. Therefore, to ensure an accurate and effective information campaign, it is necessary for the participating municipality to provide a limited amount of municipal customer data information (i.e. name and service address) to Service Line Warranties of Canada through a Canadian Postal Service approved mail house.

[28]  The document then outlines the “Information Sharing Protocol” as follows:

1. Participating municipality releases a water/sewer customer list directly to a Canadian based mail house. The customer list itself is uploaded directly to the Canadian based mail house’s secure FTP site, which the municipality will be provided login credentials to.

2. Canadian mail house will prepare the municipality’s mailing list according to Canada Post standards and provide it directly to SLWC’s print house.

3. SLWC’s print house will print the SLWC information letters including:

a. Customer name and address.

b. Two non-human readable, encrypted bar codes on the letter that contain customer name, address and warranty service information. It cannot be read by the human eye, bar code scanning equipment or smart phone app.

4. SLWC’s print house will mail the letters directly to municipal residents via Canadian mail house.

5. The municipal homeowner receives the letter and has three enrollment options:

a. Web enrollment by directly creating a web account by entering name and address information.

b. Telephone enrollment using the toll free number provided. They will have to provide name and address information as it is not preloaded into the SLWC system. The SLWC call center will be able to look up the warranty product and price information as long as the customer provides a valid postal code from the participating municipality.

c. Mail enrollment by returning the provided business reply card in the enclosed, postage paid envelope.

At NO time does SLWC have access to both the customer name and address information until and unless the customer provides it via the enrollment process. [Original emphasis]

[29]  As described above, the personal information was collected for water billing purposes. Therefore, I conclude that the disclosure of residents’ names, addresses and their water account numbers to assist SLWC in marketing their products falls outside the purpose for which this personal information was collected.

[30]  Even if the disclosure was not made for the purpose for which the personal information was obtained, it may be permitted if done for a “consistent purpose” within the meaning of section 32(c). The LAS “Marketing Approach”, as provided by the Township, identified the objectives of the warranty program as a means of protecting residents from the high repair costs. As described above, the Township disclosed the names, addresses and water account numbers to IDS, without notice to its residents, in order to enable SLWC to promote these products. The warranty program was not a service offered by the Township. Nor was the warranty program a mandatory requirement by the Township prior to providing water services.

[31]  I conclude that an individual in the complainant’s position would not have reasonably expected the disclosure of their personal information including name, address and water account number to a third party, for the purpose of marketing an optional warranty service. The Township acknowledges that providing IDS with the resident’s personal information did not comply with section 32(c) of the Act . Accordingly, I conclude that the disclosure of the information at issue was not in accordance with section 32 of the Act .

[32]  As the Township has acknowledged the conclusions of this investigation, and has cancelled all future marketing campaigns and ceased printing of marketing materials, I am satisfied that it has responded adequately to this particular complaint.

[33]  Despite the findings in this Report, this office recognizes there may be beneficial services that the Township may want to make residents aware of. In achieving this, the Township should be aware of the consent and notice provisions of the Act and I encourage the Township to consult with the IPC about a manner of implementing a program like this that complies with the Act .

CONCLUSION:

1. The information at issue is “personal information” under section 2(1) of the Act.
2. The Township’s use of the information was not in accordance with section 31 of the Act.
3. The Township’s disclosure of the information to IDS was not in accordance with section 32 of the Act.

Original Signed by:		May 26, 2017
Jeffrey Cutler
Investigator