PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT MI16-5

City of Toronto

March 12, 2018

Summary: The Office of the Information and Privacy Commissioner of Ontario opened a Commissioner initiated privacy complaint under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ), against the City of Toronto (the city). The complaint relates to concerns regarding the collection of information belonging to licensed body-rubbers by the City of Toronto. In this Privacy Complaint Report I conclude that a body-rubber licensee’s salary, commencement date and termination date is personal information and that the collection of this information is in accordance with section 28(2)  of the Act .

This report recommends that the City of Toronto amend section 545-337 of the Toronto Municipal Code, Chapter 545, Licensing to reflect the City of Toronto’s practice of collecting the written contracts of services when there is a specific bylaw investigation.

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 2, 28(2) and 29, Ontario Regulation 823 section 4.

Orders and Investigation Reports Considered: Order 11, P-257, P-427, P-1412, P-1621, R-980015, MO-1550-F, PO-2225, P-1409, MO-2344, MO-1858, MO-2234, MO-2342, MO-3298, MO-3191-F, MO-3044, MO-2563, MO-2040, PO-3435, PO-3617, I93-044M, MO-1602, M-173, PO-1885, PO-2050, M-16, M-583, MO-1295, PC-010005-1, M-454

Case Considered: Ontario Medical Association v. Ontario (Information and Privacy Commissioner) 2017 ONSC 4090 (Div. Ct.), leave to appeal granted November 8, 2017, (ONCA File nos. M48115, M48116 and M48117).

BACKGROUND:

[1]  The Office of the Information and Privacy Commissioner of Ontario (IPC), received a complaint from a body-rub parlour owner alleging that the collection of information belonging to owners, operators and body-rubber licensees by the City of Toronto (the city) is in violation of the Municipal Freedom of Information and Protection of Privacy Act (the Act).

[2]  A complaint file was opened to review the allegations. During the intake stage of the IPC process, that complaint file was closed, due to the determination that the information collected by the city about the body-rub parlour owners and operators was business information.

[3]  In order to deal with whether the collection of information about individual body-rubber licensees is in violation of the Act , the IPC opened a Commissioner initiated privacy complaint under the Act .

INVESTIGATION:

[4]  By way of background, the city licences and regulates business carried on within the municipality in accordance with the Toronto Municipal Code, Chapter 545, Licensing (the bylaw). This bylaw was issued under the authority of the City of Toronto Act and includes regulations that apply to the services of a body-rubber licensee, the qualifications of a body-rubber licensee and the operations of a body-rub business by owners/operators.

[5]  The city’s Municipal Licensing and Standards’ Business Licensing and Regulatory Services section is responsible for the issuance of business licenses. Enforcement officers employed by the Municipal and Licensing Standards’ Licensing Enforcement Unit are responsible for inspections and investigations of municipal business licenses, including body-rub licensees and body-rub owner/operator licensees, and permitted businesses to ensure compliance with the bylaws, including those of body-rubber licensees and body-rub parlours.

[6]  This investigation reviews two subsections of the bylaw, 545-344A, which requires that particular information be maintained by the body-rub parlour owner/operator, and 545-337, which requires that particular records be filed with the Municipal Licensing Standards Division and that the originals be available upon request.

[7]  Subsection 545-344A of the bylaw states the following:

A. Every owner who operates his or her body-rub parlour business and every operator shall keep proper records and books of account of all business transacted in, by or in respect of the body-rub parlour operated by him or her, which books shall give the amount of gross receipts for all services performed or provided in the said body-rub parlour, the name and license number of every body-rubber or other person performing services in the said body-rub parlour, including the date of commencement and the date of termination of such services, the amount of salary or commission paid to each body-rubber and all amounts paid by the owner to the operator, if any, or by the operator to the owner, in respect of such body-rub parlour or body-rub parlour business.

[8]  The above paragraph of the bylaw requires every owner or operator of a licensed body-rub parlour to maintain information about their business operations, including information about a body-rubber licensee. The information includes: the body-rubber licensee’s name, license number, the date of commencement and date of termination of body-rub services and the salary or commission paid to each body-rubber licensee who provide services at the body-rub parlour.

[9]  Subsection 545-337 of the bylaw, titled “Written contracts of service” states the following:

A copy of every written contract of service, contract for services or other document constituting or pertaining to the relationship between the owner and operator of a body-rub parlour or between owner or operator and a body-rubber performing services in a body-rub parlour, shall be filed with the Municipal Licensing and Standards Division, and the original of any such document shall be made available for inspection at any time by the Municipal Licensing Standards Division upon request, and shall be retained by the owner or operator for a period of six months after its termination.

[10]  As part of my investigation, I requested and received written representations from the city with respect to this matter.

[11]  In its representations, the city advised that each of the elements of information collected about the licensed body-rubber relate to specific business operations of the licensee in the context of body-rub parlours. The city’s position is that the information that is collected about the body-rubber licensees, pursuant to the bylaws, is business information.

[12]  In the alternative, should the information be viewed as personal information, the city advised that the collection of information is for the purposes of law enforcement and is necessary for the proper administration of a lawfully authorized activity, in accordance with subsection 28(2) of the Act .

ISSUES:

[13]  The following issues were identified as arising from this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act ?
2. Is the collection of the “personal information” in accordance with section 28(2) of the Act ?
3. Is the manner of collection in accordance with section 29 of the Act ?
4. Is the notice of collection in accordance with section 29 of the Act ?

RESULTS OF INVESTIGATION:

Issue 1:  Is the information at issue “personal information” as defined by section 2(1) of the Act?

[14]  In order to determine whether the city has complied with the Act , it is first necessary to decide whether the information is personal information.

[15]  The information in question is the body-rubber licensee’s name, license number, commencement date and termination date, their salary/commission, their business contact information, the written contract of service which generally includes, in addition to the above information, the status of employment (full-time employee, part-time employee and dependent or independent contractor), the hours of operation and the specific services to be supplied.

[16]  Section 2(1) of the Act  states:

“personal information” means recorded information about an identifiable individual, including:

a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

c) any identifying number, symbol or other particular assigned to the individual,

d) the address, telephone number, fingerprints or blood type of the individual,

e) the personal opinions or views of the individual except if they relate to another individual,

f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

g) the views or opinions of another individual about the individual, and

h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[17]  The list of examples of personal information under section 2(1) is not exhaustive. Therefore, information that does not fall under paragraphs (a) to (h) may still qualify as personal information. [1]

[18]  Sections 2(2.1) and 2(2.2) also relate to the definition of personal information. These sections state:

Business identity information, etc.

(2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

(2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling.

[19]  To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [2]

[20]  However, even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [3]

[21]  The city’s position is that each item of information listed is business information.

[22]  After a careful review of the city’s submissions and previous orders of the IPC, I find that the body-rubber licensee’s name [4] , licensee’s license number [5] , the business contact information [6] , the hours of operation, the specific services to be supplied by the body rubber and the status of employment (e.g. full-time/part-time), is business information.

[23]  The remaining information may be personal information.

[24]  In Order PO-2225 Assistant Commissioner Tom Mitchinson established a two-step analysis in order to determine whether information should be characterized as “personal” or “professional”:

Step 1: In what context do the names of the individuals appear? Is it in a context that is inherently personal, or is it one such as a business, professional or official government context that is removed from the personal sphere?

Step 2: Is there something about the particular information at issue that, if disclosed, would reveal something of a personal nature about the individual? Even if the information appears in a business context, would its disclosure reveal something that is inherently personal in nature?

[25]  In order to distinguish whether the remaining information is personal or professional I will consider the body-rubber licensee’s salary/commission, and the commencement date and termination date, in light of the two-step approach.

The amount of salary or commission paid to each body-rubber licensee:

[26]  The city requires body-rub parlour owners/operators to record and maintain the amounts of salary or commission paid to each licensed body-rubber. This information may also be included on the written contract of service between the body-rubber licensee and the body-rub owner/operator.

[27]  The city explained that the amount of salary or commission paid to a body-rubber licensee only identifies that the body-rubber is a licensee. The city advised that body-rubber licensees are entitled to receive funds from the licensed body-rub parlour owner/operator for the professional services provided as a licensee. Therefore, the amounts received by the body-rubber licensee arise from a business relationship and are not inherently personal since the amount is debt that arises from a business context.

[28]  Further, the city argues that the template identified in Order PO-3435, and confirmed in PO-3617, on dealing with financial and other business context information should be applied in this case. The city explained that this template would determine that the information at issue is business information and along with related working conditions, is in the context of the performance of specific professional activities.

[29]  The city also states that the information deals only with the nature of the official relationship between the parties. The information relates to individuals in the context of professional and business services as determined by the IPC in PO-3617. The city noted that the IPC defended PO-3617 on an application of judicial review.

Analysis:

[30]  As noted above, in order to distinguish whether the body-rubber licensee’s salary/commission information is personal or business information I must review it in the context of the two-step approach.

[31]  In considering step one of the two-step approach it appears that the amount of money paid to the body-rubber licensee by the body-rub parlour owner/operator is the result of an employment or service contract. The body-rub parlour owner/operator pays the body-rubber licensee to provide services to a client.

[32]  I am satisfied that the amount of salary or commission paid to each body-rubber licensee appears in a business or professional context for the purpose of the first step of the two-step analysis in Order PO-2225.

[33]  Step two asks whether disclosure of the withheld information would reveal something that is inherently personal in nature.

[34]  In my view, the salary would reveal the amount of income a body-rubber licensee is paid. Many orders of this office have determined that salaries of employees are the personal information of the employees.

[35]  The city referenced Orders PO-3435 and PO-3617 in its arguments. In Order PO-3435, Assistant Commissioner Sherry Liang dealt with a request for access to a list of services provided by a named surgeon on a particular date. The involved surgeon was not billing the Ontario Health Insurance Program (OHIP) but was instead part of an Alternative Payment Plan, whereby the surgeon was compensated on a monthly basis and not directly from the billings to OHIP for services. The order found that disclosure of the record requested would not reveal what the surgeon was paid in relation to the services performed and the information at issue was therefore not considered personal information. [7]

[36]  For the present purpose, I find the facts of this complaint distinguishable from those in Order PO-3435. In that decision the Adjudicator was not dealing with billings in a conventional sense because the physicians were not being paid by the billings but rather a monthly payment that would not reveal what the surgeon was paid in relation to the services performed. In the complaint under review, the information that could be included in the written contracts of services and other records range from the body-rubber licensee’s salary, commission or possibly specific amounts for each service performed by the body-rubber licensee. If salary information is included it would be a reflection of the body-rubber licensee’s personal income.

[37]  In Order PO-3617, the Adjudicator dealt with a request for the names of physicians, billings and specialties of the top 100 billings to OHIP. The Adjudicator concluded that, because the monies received by the physicians is in relation to a business or profession and given that it does not reflect actual income, the monies received from OHIP did not reveal “other personal information about the individual”. The Adjudicator also stated that the payments that are subject to deductions for business expense are clearly business information. Since the OHIP billings were not an accurate reflection of personal income, it did not reveal anything that is “inherently personal in nature”. Therefore, it was determined that the information requested was not personal information. [8]

[38]  In my view, the facts of this complaint are also distinguishable from those in Order PO-3617. In that decision the Adjudicator determined that the billings were not personal information because the monies were received by the physician in a business context and did not reflect the physician’s actual income. Salary information of the licensed body-rubber that is included in the written contract of service and other documents could be the body-rubber licensee’s actual income.

[39]  Based on the information before me, the payment details set out in the written contracts of service are not consistent between all owner/operator’s and licensed body-rubbers. Thus, the information retained could be an amount per service, commission or salary information. Salary information would reveal the amount of income of the body-rubber licensee. Given that salary information would be identified as personal information, I have to proceed with caution and identify this information as personal information.

[40]  I therefore find that the salary/commission information is personal information.

Date of commencement and date of termination of service:

[41]  The city requires the body-rub parlour owner/operator to record and keep a record of the date of commencement and date of termination of each body-rubber licensee that performs body-rubbing services in their establishment. In its correspondence the city clarified that this is the date that the body-rubber licensee started working at a body-rub parlour and the date the body-rubber licensee stopped working at the body-rub parlour.

[42]  The city’s position is that the body-rubber licensee’s date of commencement and date of termination of service is business information as it arises in a business context and merely confirms the specific location that the body-rubber licensee performed the licensed services. The city has referenced IPC Order M-454, which determined that the location of where an individual carries on a business is not personal information. [9]

Analysis:

[43]  In considering step one of the two-step approach I am required to look at the context that the date of commencement and the date of termination of body rubbers appear. The dates of commencement and the date of termination are the dates that a particular body-rubber licensee started and stopped providing body-rub services at a particular location. This information appears to be in the context of a business activity. This information exists as a result of a body-rubber licensee starting and ending work at a particular body-rub parlour.

[44]  I am satisfied that the date of commencement and the date of termination appears in a business or professional context for the purpose of the first step of the two step analysis in Order PO-2225.

[45]  Step-two of this analysis looks at whether disclosure of the withheld information would reveal something that is inherently personal in nature.

[46]  The dates on which a body-rubber licensee started or stopped providing body-rub services at a particular location appears to be information that could relate to an individual’s employment history. Employment history qualifies as personal information pursuant to section 2(1)(b). Previous orders of the IPC have determined that the start and termination dates of employment or an agreement is personal information [10] . The commencement date and termination date would identify the length of service for the body-rubber licensee and as such, I find that this information is the personal information of the body-rubber licensees.

[47]  In light of the fact that I found that the salary/commission, date of commencement and date of termination qualify as personal information, I must now determine whether the collection of this information is in accordance with section 28(2) of the Act .

Issue 2:  Is the collection of the “personal information” in accordance with section 28(2) of the Act?

[48]  Section 28(2) of the Act  states:

Collection of Personal Information

28 (2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

[49]  This section of the Act  sets out the circumstances under which personal information may be collected by an institution. In order for such a collection to be permissible it must satisfy one of the following conditions: it must either be (1) authorized by statute; (2) used for the purposes of law enforcement; or (3) necessary to the proper administration of a lawfully authorized activity.

[50]  In order for a given collection of personal information to be permissible under the Act , the institution in question must demonstrate that the collection was in accordance with at least one of the above noted exceptions.

[51]  The city explained that the collection of information is pursuant to the Act  because it is used for the purposes of law enforcement and is necessary to the proper administration of a lawfully authorized activity.

[52]  In order for the city to be able to claim that the collection is to be used for the purpose of law enforcement, the city must qualify as a law enforcement body in accordance with the Act .

[53]  The term “law enforcement” is defined in section 2(1) of the Act , as follows:

“law enforcement” means,

(a) policing,

(b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, and

(c) the conduct of proceedings referred to in clause (b);

[54]  Previous orders of the IPC have determined that a municipality’s bylaw enforcement process qualifies as a “law enforcement” matter for the purposes of section 2(1) of the Act  [11] . The city’s bylaw inspector can investigate possible violations of its bylaws and if a violation is confirmed, it could lead to proceedings at the Toronto Licensing Tribunal (the tribunal). The proceedings of the tribunal could result in a license being revoked, have conditions placed on the license or a license could fail to be renewed. In the circumstances of this case, I find that the city’s bylaw investigation would qualify as a law enforcement matter in accordance with the Act .

[55]  I will now consider the circumstances in which the collection is used for the purposes of law enforcement.

[56]  In response to the investigation, the city advised that under the bylaws the body-rub owners/operators are required to maintain records that include the information set out in the bylaw. The city advised that it collects the information, including the commencement date, termination date and salary/commission, from the body-rub parlour owners/operators when there is an investigation by a bylaw officer into an alleged violation of the bylaws.

[57]  The city explained that this information is necessary for its investigations into bylaw violations. For example, the city advised that the bylaw requires that all body-rubber licensees have a certificate from a medical practitioner certifying that the body-rubber licensee applicant is free from communicable disease and is medically fit to perform body-rubs. The city explained that should there be a health concern, such as an outbreak of a communicable disease, the date of commencement and date of termination would be collected and used as part of the bylaw officer’s investigation. Such information would assist in identifying body-rubber licensees working in a body-rub parlour who may have been affected and the individual customer with whom the workers may have been in contact.

[58]  With respect to salary information, the city explained that it has the authority to collect a body-rubber licensees salary/commission information because this information is also used for purposes of law enforcement.

[59]  For example, the city advised that it would collect and use salary/commission information during investigations into services being performed that are not listed (the bylaw requires that only listed services be provided) as well as complaints that a non-licensed body-rubber is providing services at a body-rub parlour (the bylaw requires all body-rubbers to be licensed).

[60]  The city advised that the requirement to keep business records is needed for its investigations and assists the city to ensure that the bylaw’s objective, to promote consumer protection, and the health and safety of body-rubber licensees and their customers, is achieved.

[61]  Section 545-337 of the bylaw states that a copy of every written contract of service, which could include salary/commission information, between the body-rub parlour owner/operator and the body-rubber licensee shall be filed with the Municipal Licensing and Standards Division. The city advised that although the bylaw states that a copy be filed, the city’s current approach is to obtain a copy, if needed, only in the context of conducting an investigation. The written contract of service is not filed with the city beforehand.

[62]  The city explained that the written contract of service is a document that establishes the legal parameters of the professional relationship between the various licensed professionals. The City advised that it would need to access the written contract of service during an investigation to confirm the accuracy of other information maintained under the licensing requirements of Municipal Code Chapter 545.

[63]  Section 28(2) of the Act  allows personal information to be collected on behalf of an institution if the information is used for purposes of law enforcement. The city advised that the transmission of information from the body-rub owner/operator to the city does not take place without an investigation by a city bylaw officer into whether there was a violation of the bylaw.

[64]  Given that the information is used for bylaw investigations and collected when there is an investigation, I find that the city is able to collect the information during an investigation pursuant to section 28(2). The information should only be collected and used when the purpose is for a specific investigation and not routinely, in the absence of any investigation. To collect personal information without a specific investigation to which it relates would contravene and undermine the purpose of section 28(2).

[65]  Although the city advised that its practice is to only collect the written contract of service when there is a bylaw investigation, the current bylaw indicates that the written contract of service is to be collected in advance. I will recommend that the city amend section 545-337 of the bylaw to reflect the city’s practice of collecting this information only when it relates to a specific bylaw investigation.

[66]  In light of my conclusion above, it is not necessary for me to consider whether the collection of personal information is necessary to the proper administration of a lawfully authorized activity.

Issue 3: Is the manner of collection in accordance with section 29 of the Act?

[67]  Section 29(1)(f) & (g) state:

Manner of Collection

29 (1) An institution shall collect personal information only directly from the individual to whom the information relates unless,

…..

 (f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or judicial or quasi-judicial tribunal;

(g) the information is collected for the purpose of law enforcement; or

…..

[68]  Section 29(1) of the Act  deals with the circumstances under which an institution may indirectly collect personal information. This provision establishes a basic prohibition on the indirect collection of personal information, but states that personal information may be collected indirectly where at least one of the statutory exceptions applies. If an exception applies, the indirect collection is permissible. In this complaint, the city takes the position that its collection of personal information through its licensing process is in accordance with section 29(1)(f) and (g).

[69]  Under Issue 2 of this report I have concluded that the city’s collection of body-rubber licensee’s personal information is collected for the purpose of law enforcement. Accordingly, I find that the city is exempt from the requirement to collect the personal information directly from the individual to whom the information relates and may collect the information indirectly, that is, during an investigation by a bylaw officer. I conclude that the city’s manner of collection is in accordance with section 29(1)(f) & (g) of the Act .

Issue 4: Is the notice of collection in accordance with section 29 of the Act? 

[70]  Under the Act, an institution is required to provide individuals with formal notice of the collection of their personal information. The purpose of the notice is to ensure that an institution’s practices with respect to personal information are transparent and that an institution is accountable to the individual. In addition, the notice of collection may serve to reduce any concerns regarding the collection and use of personal information.

[71]  The notice requirements and the necessary elements of the notice are set out in section 29(2) of the Act :

Notice to the individual

(2) If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,

(a) the legal authority for the collection;

(b) the principal purpose or purposes for which the personal information is intended to be used; and

(c) the title, business address and business telephone number of an officer or employee of the institution who can answer the individual’s questions about the collection

[72]  Section 29(3) sets out exceptions to the notice requirements:

Exception

(3) Subsection (2) does not apply if,

(a) the head may refuse to disclose the personal information under subsection 8 (1) or (2) (law enforcement), section 8.1 (Civil Remedies Act, 2001) or section 8.2 (Prohibiting Profiting from Recounting Crimes Act, 2002);

(b) the Minister waives the notice; or

(c) the regulations provide that the notice is not required.

[73]  The city explained that the Notice of Collection statement required under s. 29(2) is not necessary in the circumstances of this complaint as the collection of information is for the purpose of a law enforcement investigation and they are exempt under 29(3)(a).

[74]  The city explained that the information is collected and used during bylaw investigations to determine specific facts relevant to potential violations of the bylaws. The information could also be used in proceedings of the Toronto Licensing Tribunal, related to revocation of a license, refusal to issue a license, impose conditions on the license, or proceedings before the Ontario Court of Justice. The City advised that the information collected could be used in proceedings of a court or judicial or quasi-judicial tribunal.

[75]  Although I have determined that the City’s collection is for law enforcement purposes, this does not necessarily mean that the exception to the notice provided by section 29(3)(a) would automatically apply.

[76]  In Investigation Report PC-010005-1, this office considered the application of a similar section of the Freedom of Information and Protection of Privacy Act. While the issues in that complaint differ from the issues of this complaint the analysis is relevant in these circumstances. The IPC found that in order for the equivalent section, 39(3), to apply, the head must demonstrate that disclosure of a record could reasonably be expected to cause harm to an ongoing enforcement matter or investigation. Former Commissioner, Ann Cavoukian, stated the following:

However, in order to fall within the section 39(3) exemption from the notice requirement, the head must be in a situation where he or she could “refuse to disclose the personal information under section 14(1) or (2).” These provisions are not blanket exemptions but incorporate injury elements. The head must demonstrate that disclosure of a record could reasonably be expected to cause harm to an ongoing law enforcement matter or investigation.

In our view, subsections 14(1)(a) and (b) would not apply to exempt an institution from a requirement for a general notice to inform members of the public who are entering a casino that the OPP may be collecting their personal information through the use of face recognition technology. We do not believe that such a notice could reasonably be expected to interfere with a law enforcement matter or interfere with an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result. An individual’s face displays unique and highly personal information about that individual, including his or her race, colour, age, and sex. In our view, members of the public should be made aware that this information could be collected if they choose to enter a casino in Ontario

[77]  I agree with the former Commissioner’s finding. In my view, I do not think that section 8(1) or (2) of the Act  would exempt the city from providing a general notice to inform licensed body-rubbers that the city may collect their personal information when the city investigates compliance with its municipal bylaws.

[78]  Section 29(3)(c) indicates that 29 subsection (2) of the Act  does not apply if the regulations provide that the notice is not required. Ontario Regulation 823 provides an exception to the requirement to give notice of the collection of personal information. Section 4 of Ontario Regulation 823 states:

4. (1) An institution is not required to give notice of the collection of personal information to an individual to whom it relates if the head complies with subsection (2) and if,

(a) providing notice would frustrate the purpose of the collection;

(b) providing notice might result in an unjustifiable invasion of another individual’s privacy; or

(c) the collection is for the purpose of determining suitability or eligibility for an award or honour.

(2) For the purpose of subsection (1), the head shall make available for public inspection a statement describing the purpose of the collection of personal information and the reason that notice has not been given.

[79]  In Investigation Report I93-044M, former Assistant Commissioner Ann Cavoukian found that notifying an individual prematurely that they are under investigation may result in interference with the investigation and thus frustrate the purpose of collection. In the case of bylaw investigations related to possible violations of the bylaws and requirements for a body-rubber license, it is reasonable that a notice of collection of personal information at the time of collection could frustrate the purpose of collection.

[80]  Where an institution is not required to provide notice under section 4(1) of the above regulation, section 4(2) requires that a statement be available to the public. The city advised that during the licensing process all applicants for a license are required to complete an application which includes a Notice of Collection. The Notice of Collection advises all applicants of the authority for collection, the reason for collection and provides a contact person that can be reached should the applicant have questions.

[81]  Given that the city provides a general notice on its application forms that sets out the authority for collection, the reason for collection and the contact information of someone who can answer questions, I have determined that its notice complies with section 29(3)(c) of the Act and section 4(1) and (2) of Ontario Regulation 823. It should be noted that the notice cites the Toronto Act, 2006 rather than the City of Toronto Act, 2006. The city should update its notice to reflect the correct name of the legislation.

CONCLUSIONS:

I have reached the following conclusions based on the results of my investigation:

1. The salary/commission, date of commencement and date of termination is “personal information” as defined by section 2(1) of the Act .
2. The collection of the information for a specific bylaw investigation is consistent with section 28(2) of the Act .
3. The manner of collection of the information is in accordance with section 29 of the Act .
4. The notice of collection is in accordance with section 29 of the Act and Ontario Regulation 823. 

RECOMMENDATIONS:

I recommend that the city amend section 545-337 of the Toronto Municipal Code, Chapter 545, Licensing to reflect the city’s practice of only collecting the written contract of service when there is a specific bylaw investigation.

Within six months of receiving this Report, the city should provide this office with proof of compliance with the above recommendation.

Original Signed by:		March 12, 2017
Alanna Maloney
Investigator