PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINTS MC16-7 & MC16-8

Ottawa Police Services Board

July 27, 2017

Summary: The Office of the Information and Privacy Commissioner received identical complaints from two individuals (the complainants), alleging that the Ottawa Police Service (the police) inappropriately disclosed personal information pertaining to criminal charges against the complainants, to their employer, Correctional Services Canada (CSC), contrary to the Municipal Freedom of Information and Protection of Privacy Act  (the Act ). In January 2017, all criminal charges against the complainants were withdrawn. This Privacy Complaint Report concludes that the police’s disclosure of the complainants’ personal information to CSC was not consistent with section 32  of the Act .

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M. 56 , as amended, sections 2(1) and 32 (f) and (g).

BACKGROUND:

[1]  The Office of the Information and Privacy Commissioner (IPC) received identical complaints from two complainants, alleging that the Ottawa Police Service (the police) inappropriately disclosed personal information pertaining to criminal charges against them, to their employer, Correctional Services Canada (CSC), contrary to the Municipal Freedom of Information and Protection of Privacy Act (the Act).

[2]  On or about February 25, 2015, the complainants were among 29 individuals arrested and charged with a number of criminal offences as a result of a province-wide police investigation (police investigation). The police investigation, which was led by the Ontario Provincial Police’s (OPP’s) Organized Crime Enforcement Bureau and Biker Enforcement Unit, received assistance from several local police services, including the Ottawa Police Service.

[3]  Upon being criminally charged, the complainants notified CSC of their criminal charges and, subsequently, were suspended without pay, pending the outcome of disciplinary proceedings.

[4]  The complainants maintain that their criminal charges were unrelated to their employment at CSC.

[5]  On September 2, 2015, as part of their disciplinary proceedings, the complainants received, from CSC, documents relating to their criminal charges (documents). These documents consisted of information collected by the police as part of their investigation into criminal activities that the complainants were alleged to have committed. The complainants maintain that these documents were inappropriately disclosed to CSC by the police as they were ultimately used by CSC as part of the complainants’ internal disciplinary proceedings.

[6]  On October 5, 2015, the complainants raised their concerns about the disclosure of documents to CSC, directly with the police. The police informed the complainants that the disclosure was authorized under section 32(g) of the Act  because it was disclosed to CSC for the purpose of aiding its criminal investigation into a crime that the complainants were alleged to have committed. The complainants maintained that the disclosure was not one permitted by the Act  because CSC does not have the authority to conduct criminal investigations.

[7]  Subsequently, the complainants filed a complaint with this office. During my investigation into this matter, the police explained the circumstances surrounding the disclosure. They stated that the Lead Investigator (Investigator) for the police investigation received a telephone call from an OPP Inspector, informing the Investigator that he would be receiving a call from an employee of CSC.

[8]  The Investigator stated that the OPP Inspector asked him to provide CSC with any information it needs with respect to the police investigation. Shortly after that discussion, the Investigator was contacted by CSC via telephone, and was told CSC was conducting an investigation into a particular crime in a correctional institution, which may involve employees of CSC.

[9]  The Investigator also stated that CSC informed him that, in relation to the complainants’ criminal charges, CSC was in the process of obtaining information from border officials regarding whether CSC employees had been crossing the Canada-United States border while wearing their CSC uniforms.

[10]  Prior to disclosing the documents to CSC, the Investigator spoke briefly with a Crown Attorney to confirm that the disclosure was permissible under the Act . The Crown Attorney confirmed that, provided the documents were being disclosed to CSC as part of a criminal investigation, the disclosure would be allowed under section 32(g) of the Act .

[11]  In early spring 2015, operating on the assumption that the information was being requested by CSC as part of a criminal investigation, the Investigator disclosed the documents to CSC. According to the police, at no time did the Investigator believe that the documents would be used by CSC for disciplinary purposes – the police stated that had the Investigator known that, he would not have disclosed them.

[12]  Throughout the course of this investigation, the police have taken different positions with respect to whether CSC was conducting a criminal investigation at the time the disclosure was made. As noted above, the police initially took the position that the documents were disclosed to CSC as part of a criminal investigation, pursuant to section 32(g) of the Act .

[13]  Since that time, however, the police have acknowledged that, despite acting in good faith at the time the disclosure was made, they later learned that the documents were actually used by CSC for the complainants’ disciplinary proceedings. The police have now acknowledged that its disclosure was not authorized by section 32(g) of the Act .

[14]  As a preliminary matter, section 52(2.1) of the Act  states: “This Act  does not apply to a record relating to a prosecution if all proceedings in respect of the prosecution have not been completed.” Although the complainants were involved in criminal proceedings at the time the documents were disclosed, throughout the course of my investigation neither party has raised the possible application of this section to any of the records at issue. I do not have sufficient evidence to establish whether the requirements for the application of this section have been met with respect to the documents at issue. Both parties proceeded on the basis that the Act  applies to the records, and in the absence of specific evidence as to whether these records may be excluded from the scope of the Act , I find that in the circumstances of this complaint it is not necessary to decide whether section 52(2.1) applies. In any event, this privacy complaint raises important issues regarding an institution’s practices regarding its handling of personal information and there is a public benefit in my issuing findings on the complaint.

ISSUES:

[15]  The following issues were identified as arising from this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act ?
2. Was the disclosure of the information at issue, by the police to CSC, consistent with section 32 of the Act ?

DISCUSSION:

Issue 1:  Is the information at issue “personal information” as defined by section 2(1) of the Act?

[16]  Section 2(1) of the Act  states, in part:

“personal information” means recorded information about an identifiable individual, including:

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(d) the address, telephone number, fingerprints or blood type of the individual,

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

[17]  The information contained in the documents included the complainants’ names and details of their criminal charges. Accordingly, I find that the information at issue qualifies as “personal information” as set out under section 2(1) of the Act . The police and the complainants do not dispute this finding.

Issue 2:  Was the disclosure of the information at issue, by the police to CSC, consistent with section 32 of the Act?

[18]  There is no dispute that the police disclosed the complainants’ personal information to CSC. The question, however, is whether this disclosure was consistent with section 32 of the Act . The complainants assert that it was not.

[19]  Section 32 of the Act  provides a list of exceptions to the general prohibition against the disclosure of personal information by institutions. In order for a given disclosure of personal information to be authorized under the Act , the institution must demonstrate that the disclosure was in accordance with at least one of the exceptions listed in section 32 of the Act .

[20]  In the early stages of the IPC’s investigative process, the police stated that section 32(g) of the Act  applied to permit its disclosure of the documents to CSC. As part of my investigation, I also sought representations from the police on the possible application of section 32(f) of the Act .

[21]  Sections 32(f) and (g) of the Act  state the following:

An institution shall not disclose personal information in its custody or under its control except,

…

(f) if disclosure is by a law enforcement institution,

(i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or

(ii) to another law enforcement agency in Canada;

(g) if disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;

[22]  In order for the disclosure to have been authorized under section 32(f), the disclosure of the complainants’ personal information to CSC must have been made by a law enforcement institution to either “(i) a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or (ii) another law enforcement agency in Canada.”

[23]  There is no dispute that the police are a “law enforcement institution” for the purposes of section 32 of the Act . Clearly, because CSC is not an “agency in a foreign country,” section 32(f)(i) of the Act  does not apply.

[24]  Looking next to section 32(f)(ii) of the Act , in order for the disclosure to have been authorized under this section, CSC would have to be “another law enforcement agency in Canada.”

[25]  Under section 2(1) of the Act , “law enforcement” is defined to mean:

(a) policing,

(b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, or

(c) the conduct of proceedings referred to in clause (b);

[26]  According to its website [1] , CSC is the federal government agency responsible for administering sentences to individuals who have been found guilty of a crime and who have been sentenced to two or more years in a correctional facility. CSC is responsible for managing correctional institutions of various security levels and supervising offenders under conditional release in the community.

[27]  Earlier in this investigation, the police stated that they believed CSC was a “law enforcement agency” based on its understanding that CSC could conduct criminal investigations. The complainants disagreed.

[28]  In later submissions, the police acknowledged that they had come to learn that CSC was not a “law enforcement agency.” Its assumption that CSC intended to use the information for the purpose of a criminal investigation was incorrect. Based on the evidence before me, including the mandate and responsibilities of CSC and the police’s submissions, I am unable to find that CSC is a “law enforcement agency in Canada.” Accordingly, section 32(f)(ii) of the Act  does not apply.

[29]  Turning now to section 32(g) of the Act , in order for the disclosure to have been authorized, the disclosure by the police to CSC would have had to have been “an institution or a law enforcement agency in Canada to aid in an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result.”

[30]  “Institution” is a defined term under the Act , and it does not include the CSC. I found above that the CSC is not a “law enforcement agency” for the purpose of section 32(f). Likewise, based on the information set out above, I find that the disclosure of the complainants’ personal information by the police to CSC, which information was ultimately used by CSC in its internal disciplinary proceedings against the complainants, did not meet the requirements of section 32(g) of the Act .

[31]  In this case, the request for access to the documents containing the complainants’ personal information was made by way of a phone call between staff at the police and CSC. Given the sensitivity of personal information that may be in the police’s custody or control, it is important that requests for disclosure be made in writing – that way, there is a detailed record of both the information requested as well as the legislative authority under which the information is being sought.

[32]  It is also important for disclosure requests to be reviewed through institutions’ Freedom of Information (FOI) Offices. Staff in these offices have received specialized training in the application of the Act and, as a result, are in the best position to clarify details surrounding access requests to ensure that any disclosures that are made are authorized by the Act .

[33]  In response to the police’s inadvertent disclosure in this case, they have sent out correspondence to all staff, reminding them of their obligations under its General Order – Release of Information – which states:

All requests for Police reports received from the public and outside agencies are processed through the Freedom of Information (FOI) Unit in Records Management Services. The Freedom of Information Unit ensures that all information is consistently released in accordance with the law. The staff in FOI are trained to process and apply the Municipal Freedom of Information and Protection of Privacy Act  to all requests.

[34]  In addition, the police have confirmed that, as part of their training at the time of hire, all staff are provided with privacy training.

[35]  While the public rightly expects government agencies to work together, such collaboration cannot come at the expense of robust privacy practices which ensure that requested disclosures are only made when they are in compliance with the Act .

[36]  In light of the police’s acknowledgement that the disclosure was not consistent with the Act and its subsequent response to the complaint, I am satisfied that the police have taken the appropriate steps to prevent a similar breach from occurring in the future.

CONCLUSIONS:

1. The information at issue is “personal information” as defined by section 2(1) of the Act .
2. The disclosure of the information at issue was not consistent with section 32 of the Act .

Original Signed by:		July 27, 2017
Trish Coyle
Investigator