PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT MC15-41

Town of South Bruce Peninsula

February 22, 2018

Summary: The Office of the Information and Privacy Commissioner/Ontario (IPC) received a privacy complaint from an individual involving the Town of South Bruce Peninsula (the town). The complainant was concerned that the town had improperly disclosed his personal information to another individual, without notice, in contravention of the Municipal Freedom of Information and Protection of Privacy Act. This Report finds that the town’s disclosure of the complainant’s personal information was not in accordance with section 32 of the Act.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act, Provincial Offences Act

Orders and Investigation Reports Considered: Orders M-777, MO-1540, MO-1550-F, MO-2937, MO-3107F, MO-3148, MO-3445, MO-3455, MO-2363, P-257, P-427, P-1621, PO-1657, PO-1986, PO-2225, R-980015, Investigation Reports I98-018P, MC-000019-1, I95-024M, MC-000014-1.

Cases Considered: Ontario (Attorney General) v. Fineberg, [1996] O.J. No. 67

BACKGROUND:

[1]  On June 9, 2015, the Town of South Bruce Peninsula (the town) received an access to information request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) from an individual. The request read as follows:

Please provide me with number of all legal actions to the Town, Staff, council and volunteer committee members initiated by resident [named individual].

Please provide me with the legal and staff costs to defend these legal actions brought by [named individual].

Please provide me with court costs that were awarded to the Town in these legal actions and verify that they have been paid.

[2]  On June 15, 2015, the town issued a decision in response to the request and stated the following, in part:

…

We have broken your request into three (3) distinct questions. We interpret your request to be asking for numbers and verification only and no physical records. We have performed a search of our records and to the best of our knowledge and at this time, we offer the response which is attached to this decision.

…

[3]  The attachment (“Response”) that the town provided to the requester with its decision read as follows:

Question One

Please provide me with number of all legal actions to the Town, Staff, council and volunteer committee members initiated by resident [named individual].

Response One

There have been twelve (12) actions.

Question Two

Please provide me with the legal and staff costs to defend these legal actions brought by [named individual].

Response Two

The total legal cost of defence is $307,961.98 to date. There is no way to provide a breakdown of staff costs as this was not tracked separately.

Question Three

Please provide me with court costs that were awarded to the Town in these legal actions and verify that they have been paid.

Response Three

The costs awarded by the courts are $27,815.72 to date. It is verified that these costs have been paid to the best of our knowledge based upon our records.

[4]  The individual named in the request and in the town’s Response (now the complainant) takes the position that the disclosure of his personal information to the requester “without his permission and without his knowledge” was inappropriate and in contravention of the Act. Upon learning of this disclosure, the complainant filed a complaint with the Office of the Information and Privacy Commissioner/Ontario (IPC).

ISSUES:

[5]  The following issues were identified as arising from this investigation:

1. Is the information at issue “personal information” as defined in section 2(1) of the Act?
2. Was the town’s disclosure of the information at issue in accordance with section 32 of the Act?

DISCUSSION:

A) Is the information at issue “personal information” as defined in section 2(1) of the Act?

[6]  At issue in this complaint is the information that was provided by the town to the requester in response to an access request. The town’s decision and attached Response reiterates the questions posed in the request, followed by the town’s answers to those questions. I have reviewed the information contained in the Response and note that it includes the following:

• The complainant’s name;
• The number of legal actions against the town, staff, council and volunteer committee members initiated by the complainant;
• The legal and staff costs to defend the legal actions brought by the complainant;
• The court costs that were awarded to date relating to these legal actions; and
• Verification that the costs have been paid.

[7]  Section 2(1) of the Act defines “personal information” in part as follows:

“personal information” means recorded information about an identifiable individual, including,

…

(b)  information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

…

(h)  the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[8]  The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. [1]

[9]  Sections (2.1) and (2.2) also relate to the definition of personal information. These sections state:

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[10]  To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [2]

[11]  The town takes the position that its Response to the requester does not contain the personal information of the complainant. It states that the information released by the town relates to the number of legal actions that were launched against the town, the total legal costs to the town of defending those actions, the costs awarded to the town by the courts in relation to those actions, and whether the town received payment of those costs. The town therefore takes the position that all of this information relates to the town and is the town’s information, and the fact that these legal actions were commenced by the complainant does not make the town’s information the complainant’s personal information.

[12]  The town also refers to the two-stage analysis found in Order MO-2363, [3] and states that previous orders have used this analysis to determine if records contain “personal information.” The town states:

1. the IPC must ask in what context do the names of the individuals appear. Is it a context that is inherently personal, or is it one such as a business, professional or official government context that is removed from the personal sphere?
2. The IPC must go on to ask if there is something about the particular information at issue that, if disclosed, would reveal something of a personal nature about the individual.

[13]  The town takes the position that the context in which the complainant’s name appears is not inherently personal, but is about legal actions commenced by the complainant against the town.

[14]  The town also states that it did not disclose any details regarding the complainant’s allegations or positions in the referenced legal actions, and that it “did not even indicate who had paid the court costs or the dates on which they were paid,” just that they had been paid to the best of the town’s knowledge.

[15]  The town also takes the position that court files, unless sealed by the court, are publicly accessible and that anyone could have attended at the court offices and reviewed the legal files themselves including all pleadings, endorsements and orders contained in them. In addition, the town states that much of this information is also located on the complainant’s blog and other online publications, as well as the public websites of various media outlets.

[16]  The town states that the fact that the complainant’s name is on the actions as an identified party does not make the information “personal.” It acknowledges that the complainant was named in the request, but that this was done simply to “clarify which legal proceedings” the request was about.

[17]  Lastly, the town refers to the accountability it has to the public about how it spends its money, and that although the complainant is named in the request and the proceedings, this should not prevent the town from fulfilling its duty of accountability to the public or transform the town’s information into the complainant’s “personal information”.

[18]  On my review of the information at issue contained in the town’s Response, I am satisfied that it contains the personal information of the complainant.

[19]  The information in question includes the complainant’s name, the fact that he had filed legal actions against the town and the number of actions filed, the fact that his actions resulted in certain legal fees being incurred by the town, the court costs awarded against him as a result of those actions, and whether or not those court costs had been paid. I find that this information fits within the definition of personal information found in paragraph (h) of the definition set out above, as the Response includes the individual’s name as it appears with other personal information relating to him. I also find that disclosing the amount of the court costs awarded against him, and that these costs have been paid, reveals personal information about the complainant. [4]

[20]  The fact that the requested information also relates to the town, including what legal actions the town was involved with, the total legal costs to the town of defending those actions, the costs awarded to the town by the courts and whether the town received payment of those costs, does not mean that it cannot also consist of the personal information of the complainant.

[21]  I have also considered the town’s reference to the two-stage test in Order MO-2363. I note that this test is used to determine whether information contained in a record consists of an individual’s personal information as opposed to their business or professional information. It does not replace the definition of personal information set out in the Act. In that regard, I have not been provided with any information to suggest that the complainant commenced or brought these legal actions in any “business, professional or official capacity,” and the two-stage analysis referenced by the town is therefore not engaged. I also note that the requester sought information about the complainant as a resident and referred to him as such in the request.

[22]  Lastly, the town argues that much of the information contained in the Response is already public or accessible to the public. These considerations impact the issue of whether the disclosure of personal information is an unjustified invasion of privacy, which I review below. This does not affect the question of whether information fits within the definition of personal information under section 2(1).

[23]  Accordingly, I find that the information at issue qualifies as “personal information” as defined in section 2(1) of the Act.

B) Was the town’s disclosure of the information at issue in accordance with section 32 of the Act?

[24]  Section 32 of the Act prohibits the disclosure of personal information in the custody or under the control of an institution except in certain circumstances enumerated in paragraphs (a) through (l). In order for a disclosure of personal information to be permissible under the Act, it must be demonstrated that the disclosure was in accordance with section 32 of the Act.

[25]  The town submits that:

As outlined above, the Town’s position is that the released information was about the Town’s legal expenses and that its Response did not contain any personal information about [the complainant].

In the alternative, if the Response is found to have contained personal information about [the complainant], or any other individual, the Town maintains that considering the totality of the circumstances, disclosure was done in accordance with section 32(a).

[26]  Section 32(a) reads as follows:

An institution shall not disclose personal information in its custody or under its control except,

(a) in accordance with Part I;

[27]  In order to rely on section 32(a), an institution must demonstrate that the disclosure took place in response to a request and that, in disclosing the personal information, it met all of the procedural requirements under Part I.

[28]  Because the request did not involve the requester’s own personal information, it is properly considered as a Part I request, and once it was received and acknowledged by the town, all substantive and procedural requirements of Part I apply.

[29]  The town did not notify the complainant prior to disclosing his personal information.

[30]  The Act provides a process that the town must follow before determining whether disclosure of personal information would be an unjustified invasion of privacy. Specifically, section 21(1)(b) of the Act states:

A head shall give written notice in accordance with subsection (2) to the person to whom the information relates before granting a request for access to a record,

…

(a) That is personal information that the head has reason to believe might constitute an unjustified invasion of personal privacy for the purposes of clause 14(1)(f)

[31]  Where a requester seeks personal information of another individual, section 14(1) prohibits an institution from releasing this information unless one of the exceptions in paragraphs (a) to (f) of section 14(1) applies. If the information fits within any of these exceptions, it is not exempt from disclosure under section 14. The town takes the position that disclosure of personal information was permitted as it did not constitute an unjustified invasion of personal privacy.

[32]  Section 14(1)(f) states the following:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

(f) if the disclosure does not constitute an unjustified invasion of personal privacy.

[33]  Sections 14(2), (3) and (4) provide guidance in determining whether the disclosure of personal information would constitute an unjustified invasion of personal privacy.

[34]  The town submits that written notice was not required in this case as the head had no reason to believe that this might be an unjustified invasion of personal privacy for the purposes of clause 14(1)(f) of the Act. The town states that, in coming to this conclusion, it considered all of the factors outlined in section 14(2), as well as the presumption at section 14(3)(f). The town determined that the information contained in the Response was not highly sensitive and was publicly available through court files, the complainant’s online publications, and media websites. The town also determined that the disclosure was desirable for subjecting the activities of the town and the town’s legal expenses to public scrutiny. The town submits that section 14(3)(f) of the Act is also not applicable in these circumstances, as it is the town’s belief that the Response did not contain any information regarding the complainant’s finances. Finally, the town noted that “… if section 14(3)(f) was found to apply, the presumption of an unjustified invasion of personal privacy is rebutted by the compelling public interest override in section 16.”

[35]  The complainant, on the other hand, outlines factors supporting why he believes the disclosure of his personal information constitutes an invasion of privacy. The complainant takes the position that whether he has paid costs awarded to the town is personal information. He also submits that the Response contains inaccurate information with respect to the amount of money awarded to the town, as the town incorrectly included amounts awarded to private parties. The complainant argues that the costs he has paid to private individuals is personal information, and that the Response contains some information associated with private proceedings in which the town was not a party, “even though aggregated with proceedings with the town.” The complainant believes that he should have been notified by the town and that disclosure was done wilfully or “wilfully blind to the impropriety of the act.”

[36]  Given the public nature of some of these matters, it may be that disclosure of the complainant’s personal information by the town would not have constituted an unjustified invasion of the complainant’s privacy within the meaning of section 14(1)(f). The town’s arguments ultimately may have supported a decision to disclose under Part I. However, it is also possible that one or more factors could have weighed against disclosure, as submitted by the complainant.

[37]  Since the information has already been disclosed, I see no useful purpose in making a determination on this issue. However, the town’s Response contained personal information of the complainant, and in these circumstances, I find that the town should have notified the complainant and given him an opportunity to make representations on the issues prior to disclosure.

[38]  The purpose of the notification obligation has been reviewed in a number of IPC orders and privacy complaint reports issued by this office. Although the wording of section 21(1)(b) leaves open the possibility that disclosure can take place without notification in circumstances where an institution does not have reason to believe that disclosure might constitute an unjustified invasion of privacy, the use of the word “might” in this section imposes a low threshold for triggering an obligation to notify.

[39]  The purpose of the notification obligation was reviewed by former Senior Adjudicator David Goodis in Order PO-1657 in a case where records containing personal information were disclosed without notification under section 28(1) of the Freedom of Information and Protection of Privacy Act, [the equivalent of section 21(1) of this Act].

He stated:

In my view, the purpose of these provisions of section 28 is to ensure that procedural fairness is accorded to individuals whose privacy interests may be at stake. Adherence to these provisions permits the subject individual to make representations as to whether or not the information should be disclosed and, if the head decides to disclose information, to appeal the matter to the Commissioner before disclosure actually takes place.

[40]  Adjudicator Goodis also referred to Investigation Report I98-018P, in which former Commissioner Ann Cavoukian made the following comments with respect to the notice requirements relating to disclosure of personal information:

I should also note that institutions are not the only bodies with a statutory obligation to provide notice to affected persons. Section 50(3) of the Act also imposes an obligation on the Commissioner to provide notice during the course of an appeal. In Ontario (Attorney General) v. Fineberg, [1996] O.J. No. 67, the Divisional Court interpreted this obligation. The Court quashed Order P-676 for breach of natural justice because this office had not provided an affected person with notice on the basis that the record at issue had not contained his personal information. The Court found that the affected person should have been given the opportunity to make submissions on the threshold question of whether the record contained his personal information and, if so, whether the disclosure would constitute an unjustified invasion of personal privacy.

The Court’s judgment suggests that notice is required under section 50(3) where the outcome of a threshold decision may result in disclosure of a record containing personal information. In my view, similar considerations of fairness should apply where information qualifies as personal information and a reasonable doubt exists as to whether disclosure would fall within one of the exceptions at sections 21(1)(a) through (e).

[41]  In IPC Investigation Report MC-000019-1, former Assistant Commissioner Tom Mitchinson also reviewed the notice obligations with respect to disclosure of personal information by a police services board. In this report, he referred to the following comments of former Commissioner Cavoukian in Investigation Report I95-024M:

It is not our intention to suggest that the complainant’s personal information would or would not have been exempted under section 14(1) of the Act. Rather, it is our view that since the disclosure of the complainant’s personal information might have constituted an unjustified invasion of personal privacy, the complainant should have been notified and given an opportunity to make representations on the issue of disclosure, as well as the opportunity to appeal the Board [of Education’s] decision to our office. In our view, except in the clearest of cases, fairness requires that the person with the greatest interest in the information, the data subject, be given a chance to be heard.

[42]  I agree with the approach taken in the decisions set out above. In this case, given the nature of the personal information of the complainant contained in the Response, I am satisfied that the disclosure of at least some of this information might have constituted an unjustified invasion of his personal privacy. In these circumstances, the complainant should have been notified and given an opportunity to make representations on the issue of disclosure. As noted in Investigation Report MC-000019-1, except in the clearest of cases, fairness requires that the person with the greatest interest in the information (in this case, the complainant), be given a chance to be heard. In this case, the complainant was not given that opportunity.

[43]  I therefore conclude that the town did not comply with the procedural requirement of notifying the complainant under section 21(1)(b) of the Act. On this basis, I find that the town’s disclosure was not in accordance with Part I and, therefore, did not comply with section 32(a) of the Act.

[44]  The complainant and the town both received a draft version of this privacy complaint report for a review of any factual errors or omissions. Upon reviewing the draft, the complainant and the town both provided additional submissions.

[45]  The complainant’s primary concern was that I had not addressed his complaint about whether the town wilfully disclosed his personal information in contravention of section 48 of the Act. The complainant references section 48(1)(a) of the Act, which states:

48. (1) No person shall,

(a) wilfully disclose personal information in contravention of this Act;

[46]  The complainant asserts that the actions of the individual who released the records at issue constitute an offence, as he believes this individual wilfully disclosed his personal information in contravention of the Act. This section requires the consent of the Attorney General to commence a prosecution. This investigation is not an appropriate forum to consider whether a person has committed an offence under the Act and the IPC has no jurisdiction to conduct a trial of a provincial offence. That jurisdiction is with the Ontario Court of Justice, and I therefore decline to make a finding on this issue. If the complainant is of the view that an offence has been committed, the process for laying an information to commence a prosecution is set out in the Provincial Offences Act. [5]

[47]  I have also reviewed the town’s response to the draft version of this report. In my view, the town does not raise any new issues or arguments that cause me to revisit my original findings with respect to this report. The town’s correspondence essentially repeats the substance of its earlier submissions with respect to whether the information at issue is the complainant’s personal information. These arguments were already considered when I found that the information at issue qualifies as the complainant’s “personal information” as defined in section 2(1) of the Act. In its response, the town also refers to recent orders issued by this office, which have addressed similar information requested by the complainant in the context of access requests [6] . All of these orders upheld the town’s decision to withhold the requested information from the complainant. I also note that in all of these orders, records containing the complainant’s name and the fact that he was involved in legal proceedings were found to contain the personal information of the complainant within the meaning of paragraph (h) of section 2(1) of the Act.

[48]  The town also re-submits its arguments that the section 16 public interest override applies in these circumstances, and asserts that disclosure of the information at issue does not require notice to the complainant. The public interest override in section 16 can only apply in situations where an exemption applies to information and the public interest overrides the exemption. Section 16 presupposes that an exemption applies (in this case, the unjustified invasion of privacy). If the town’s position is that it chose to disclose the information on the basis that the public interest override applied to the information, it should have notified the complainant and given him the opportunity to address both whether disclosure constituted an unjustified invasion of privacy and, if it did, whether the public interest override applied.  

[49]  My findings in this matter relate simply to the notification obligations of the town. As I stated earlier, I find that the Town should have notified the complainant and given him an opportunity to make representations on the issues prior to disclosure, and I find no reason to revisit my findings in this regard.

CONCLUSIONS:

1. The information at issue qualifies as the complainant’s “personal information” as defined in section 2(1) of the Act.
2. The town’s disclosure of the information at issue was not in accordance with section 32 of the Act.

RECOMMENDATION:

I recommend that the town take steps to ensure that in future, disclosures of personal information are made in accordance with the provisions of the Act. In particular, when responding to requests under Part I of the Act, I recommend that the town adhere to the notification requirements of section 21 of the Act, in accordance with the direction provided by this Report.

Original Signed by:		February 22, 2018
Nathalie Rioux
Investigator