INVESTIGATION REPORT

 

 

 

INVESTIGATION I93-003M

 

 

A Municipality

 

 

 

 

 

August 5, 1993

INTRODUCTION

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a named municipality (the City).

 

At 10:30 a.m. on March 28, 1992, the complainant wrote a test entitled the "Entry Firefighter Test" (the test), with the City.  The test was one of the steps in the City's firefighter recruitment process.  The complainant stated that the test had asked for the applicants' race and sex.  The complainant indicated on his test answer sheet that he was a white male.

 

The City sent the completed test answer sheets to a private company in Sacramento, California, in order to be marked.  The complainant scored 82 percent on the test, while the cut-off mark for white males was 85 percent.  The cut-off mark for females and visible minorities was 70 percent.

 

Regarding the test, the complainant stated the following:

 

1.         The City ... did not state their authority, verbal or written, to collect this information on a test score sheet.

 

2.         The information that was supplied to them [the City] was used for a purpose other than what I was told it would be used for.

 

3.         They [the City] released this confidential information to a third party, namely [the named private company], without my permission.

 

During a meeting with the Compliance Investigator, the complainant outlined an additional concern.  He stated that the City's Employment Recruiter and its Secretary of Human Resources had access to the "test analysis printouts", which identified the individuals who had written the test by their name, sex, race and social insurance number (SIN).  The complainant questioned the authority of these two individuals to have access to this personal information.

 

The complainant also stated that while the City had the authority to collect the pre-employment data on its employment application form, it did not have the authority to collect it on the test answer sheet.  The complainant also questioned the City's authority to disclose his SIN to the private company.

 

The complainant thus questioned the City's authority to collect, use and disclose his pre-employment data consisting of his race and sex, and to disclose his SIN to the private company.  The complainant also questioned the authority of the City's Employment Recruiter and Human Resources Secretary to have access to the test analysis printouts.

 

Issues Arising from the Investigation

 

The following issues were identified as arising from this investigation:

 

(A)       Was the information in question "personal information", as defined in section 2(1) of the Act?

(B)       Did the City have the authority to collect the pre-employment data, in accordance with section 28(2) of the Act?

 

(C)       Did the City provide notice of its collection, in accordance with section 29(2) of the Act?

 

(D)       Did the City use the pre-employment data, in accordance with section 31 of the Act?

 

(E)       Did the City disclose the pre-employment data, in accordance with section 32 of the Act?

 

(F)       Did the City disclose the SIN, in accordance with section 32 of the Act?

 

(G)       Did the Employment Recruiter and the Human Resources Secretary obtain access to the test analysis printouts, in accordance with section 3(2) of Regulation 823 under the Act, as amended by Regulation 395/91?

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question "personal information", as defined in section 2(1) of the Act?

 

Section 2(1) of the Act defines "personal information", in part, as:

 

recorded information about an identifiable individual, including,

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

(c)        any identifying number, symbol or other particular assigned to the individual,

...

 

(h)        the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; ("renseignements personnels")

 

We obtained a copy of the complainant's test answer sheet.  It contained the following information:  his name, sex, race, SIN, and the highest grade he had completed in school.

 

We also obtained a copy of the test analysis printout.  It contained the following information about the complainant:  his name, SIN, the letter "M" for male, and the letter "W" for white.

 

It is our view that the information contained in the complainant's test answer sheet and the test analysis printout met the requirements of paragraphs (a), (b), (c) and (h) of the definition of "personal information", in section 2(1) of the Act.

 

Conclusion:    The information contained in the complainant's test answer sheet and the test analysis printout was personal information, as defined in section 2(1) of the Act.

 

Issue B:           Did the City have the authority to collect the pre-employment data, in accordance with section 28(2) of the Act?

 

Section 28(2) of the Act states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

 

The City submitted the following:

 

Yes, the City solicited the information in question.  It was verbally requested at each of the entry level firefighter tests conducted on March 27 and 28, 1992, at which time Fire Chief ... indicated that providing this information was optional.

 

The City collected this information under the authority of Section 28(2) on the basis that the collection was necessary to administer a lawfully authorized activity (being a special Employment Equity Program).  In this regard, please refer to Section 14  of the Human Rights Code  ... and the Ontario Human Rights Guidelines on Special Programs ....  (emphasis added)

 

Section 14(1)  of the Ontario  Human Rights Code  (the Code ) states:

 

A right under Part I is not infringed by the implementation of a special program designed to relieve hardship or economic disadvantage or to assist disadvantaged persons or groups to achieve or attempt to achieve equal opportunity or that is likely to contribute to the elimination of the infringement of rights under Part I.  [emphasis added]

 

Part I of the Code  addresses "Freedom from Discrimination".  It prescribes a number of rights, including the right to equal treatment with respect to employment without discrimination [section 5(1)].

 

On page two of the "Ontario Human Rights Commission Guidelines on Special Programs", dated

May 1991, the following is stated:

... section 28(c) [now section 29(c)] gives the Ontario Human Rights Commission an active mandate to facilitate and encourage the implementation of special programs that comply with section 13 [now section 14].  The Commission, therefore, supports and encourages ... employers ... to voluntarily adopt special programs.  [emphasis added]

 

Section 29 (c) of the Code  states:

 

It is the function of the Commission,

 

(c)        to recommend for consideration a special plan or program designed to meet the requirements of subsection 14(1), subject to the right of a person aggrieved by the implementation of the plan or program to request the Commission to reconsider its recommendation and section 37 applies with necessary modifications;

 

On page five of the "Guidelines on Special Programs", the following is further stated:

 

No person is obliged to seek an order from the Commission prior to implementing a special program, nor is the Commission obligated to issue an order in response to an application.

 

In fact, the Commission encourages ... employers ... to review their own operations in light of these guidelines, with a view to voluntarily undertaking initiatives aimed at promoting greater equality in our society.

 

The City also submitted that:

 

... the [Ontario Human Rights] Commission has considered the City's request for a special program and on March 6, 1989, the Chief Commissioner advised that the proposal meets the definition of a special program under Section 14.

 

The proposal being referred to above is the City's "Pre-Employment Applicant Tracking Programme".  The complainant provided us with a copy of the City's proposal in this regard, dated July, 1988.

 

The proposal included two sections entitled "Tracking Information To Be Requested" and "Data Collection Process".  Under "Tracking Information To Be Requested", the following is stated:

 

People applying for employment with [the named City] will be requested to provide, on a voluntary and confidential basis, personal information related to their sex, race and disability.

 

Under "Data Collection Process", the following is stated:

 

We will be modifying our current application form somewhat by including a 'Recruitment Questionnaire' insert and an envelope addressed to the attention of the Employment Equity Officer.  Pre-employment applicant tracking information will be requested via this Recruitment Questionnaire.

 

The complainant stated that he applied for the firefighter job by completing the employment application form.  He also stated that he had completed the recruitment questionnaire, which he returned to the City, by placing it in a locked box, set up for this purpose, in the City's Human Resources Department.

 

In our view, whether the City initially collected the pre-employment data through the employment application form or on the test is irrelevant to the main issue of whether they had the authority to collect it.  We believe that the City had the authority to collect the complainant's pre-employment data on the employment application form because the collection was "necessary" for the proper administration of a lawfully authorized activity, namely -- a special program under section 14(1)  of the Ontario  Human Rights Code .  However, it is also our view that any subsequent collections of the complainant's pre-employment data by the City for the purpose of administering its special program would no longer be "necessary".   Accordingly, it is our view that the City's second collection of the complainant's pre-employment data, on the test, did not meet the provisions of section 28(2) of the Act.

 

Conclusion:    The City's first collection of the complainant's pre-employment data (on the employment application form) was in accordance with section 28(2) of the Act, as it was "necessary" for the proper administration of a lawfully authorized activity, namely, the City's special program.

 

The City's second collection of the complainant's pre-employment data (on the test) was not necessary for the proper administration of the City's special program, since the City was already in possession of that information.  Thus, the City did not meet the provisions of section 28(2) of the Act, in this second instance.

 

Issue C:          Did the City provide notice of its collection, in accordance with section 29(2) of the Act?

 

Section 29(2) of the Act requires an institution to notify the individual to whom the personal information relates of what information the institution is collecting and why.  It states:

 

If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,

 

(a)        the legal authority for the collection;

 

(b)        the principal purpose or purposes for which the personal information is intended to be used; and

 

(c)        the title, business address and business telephone number of an officer or employee of the institution who can answer the individual's questions about the collection.

 

In this regard, the complainant stated:  "The City ... did not state their authority, verbal or written, to collect this information on a test score sheet".

 

The complainant also stated that before writing the test, the Fire Chief gave the applicants verbal instructions on how to fill out the test answer sheet.  Regarding the pre-employment data, the complainant said the Fire Chief explained that it would be used by the private company, but that no employment decisions would be based on it.

 

The City submitted:

 

It would appear that applicants were not informed of the purpose of the collection as was the case at the 8:00 a.m. sitting.  Specifically, they were not told that the sex and ethnicity data would be used for statistical purposes, nor was the statement made that no employment decisions would be based on this information.

 

In the section entitled "Background of the Complaint", we indicated that the complainant had written the test at 10:30 a.m. on March 28, 1992.  In its submission, the City stated that the "... applicants [at the 10:30 a.m. sitting] were not informed of the purpose of the collection as was the case at the 8:00 a.m. sitting".  On March 28, 1992, the test had been written at 8:00 a.m. and 10:30 a.m., by two different groups of applicants.  Prior to receiving this complaint, we had investigated another complaint, also regarding the City's recruitment of firefighters.  The complainant in the first complaint (Investigation I92-72M) had written the test at the 8:00 a.m. sitting, at which time the Fire Chief told the applicants that the pre-employment data would be principally used for statistical purposes.

 

In its submission, as outlined above, the City responded only to section 29(2)(b) of the Act.  It stated that the applicants at the 10:30 a.m. sitting were not informed of the purpose of the collection.  The City did not, however, respond to sections 29(2)(a) or (c) of the Act.  We have relied on the City's submission to the first complaint, to make a finding in this regard.  (Please note that since many of the issues identified in both complaints were similar, the City agreed to have its response to the first complaint applied to the second complaint, where the issues were the same.)

 

In its earlier submission to Investigation I92-72M, the City stated:

 

The form of the notice was not strictly in accordance with that outlined in Section 29(2) of the Act to the extent that legal authority was not specified, nor was a contact person indicated who could answer any questions about the collection.

 

Based on the above, it is our view that the City did not provide proper notice of collection, in accordance with section 29(2) of the Act.

 

Conclusion:    The City did not provide notice of collection, in accordance with section 29(2) of the Act.

 

Issue D:          Did the City use the pre-employment data, in accordance with section 31 of the Act?

 

Section 31 of the Act prohibits the use of personal information, unless one of three conditions exist.  It states:

 

An institution shall not use personal information in its custody or under its control except,

 

(a)        if the person to whom the information relates has identified that information in particular and consented to its use;

 

(b)        for the purpose for which it was obtained or compiled or for a consistent purpose; or

 

(c)        for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act, 1987.

 

The complainant stated:  "The information that was supplied to them [the City] was used for a purpose other than what I was told it would be used for".  The complainant believed that the City used the pre-employment data to aid it in its firefighter selection process -- a purpose for which the City had not stated it would use this information.  In this regard, the complainant provided us with the City's brochure entitled "Enjoy a challenging and worthwhile career", which contained the following excerpt:

 

The [named City] is an Equal Opportunity Employer, therefore an individual's age, race, sex, sexual orientation, and/or religion are not factors in our selection process.

 

Regarding its use of the pre-employment data, the City submitted:

 

The City used the pre-employment data in the same manner outlined in our submission relative to Investigation #I92-72M, notwithstanding that notice of the purpose of the collection was not given at the 10:30 a.m. sitting.  Therefore, I would assume that the same submission and Compliance Officer's recommendations would apply in this instance.

 

In its submission to Investigation I92-72M, the City stated:

 

The data was sorted by [the named private company] based on employment equity parameters (see attached Schedule No. 3) in order that the aggregate data could be used for comparison to prior years and to administer (relative to the firefighter hiring process) the Special Employment Equity Program approved by the Human Rights Commission.

 

There were 1,954 applicants for the firefighter positions, 1,608 of whom wrote entry level test No. 1.  The aggregate data compiled by [the named private company] revealed that there was a disproportionately small number of women and visible minority candidates, being 70 of the 1,282 who achieved a pass mark of 70% or better on Test No. 1.  Given the number of vacancies to be filled (20-25) and the City's past experience with failure rates on physical-medical tests (30-35%) it was decided that 350 candidates should proceed to Test No. 2.  It was also decided that given the small number of minority candidates, all of the 70 who attained a pass mark on Test No. 1 should proceed to Test No. 2.  This meant that the number of white male applicants had to be reduced to 280 and this was done by examining the marks on Test No. 1 to determine an appropriate cutoff mark which would yield approximately 280 white male candidates.

 

The City did not inform the applicants at the 10:30 a.m. sitting of the principal purpose or purposes for which the pre-employment data was intended to be used.  Thus, it is our view that the City may not rely on section 31(a) to authorize its use of the pre-employment data, because the complainant could not have consented to a use that he was never told about.

 

In the absence of a proper notice of collection, and given the statement in the City's brochure that an individual's age, race, sex, sexual orientation and/or religion are not factors in its selection process, it is our view that the City cannot be said to have used the data "for the purpose for which it was obtained or compiled", in accordance with section 31(b) of the Act.

 

It is also our view that the City did not use the pre-employment data for a "consistent purpose", in accordance with section 31(b).  A consistent purpose is one which the complainant would have reasonably expected.  It is our view that in the circumstances of this complaint, where proper notice of collection was not given, and given the statements made in the City's brochure, the complainant would not have reasonably expected the City to use his pre-employment data as criteria in its hiring decision.

 

We also reviewed section 31(c) of the Act and found that it did not apply to the circumstances of this complaint.

 

Conclusion:    The City did not use the pre-employment data in accordance with section 31 of the Act.

 

Issue E:           Did the City disclose the pre-employment data, in accordance with section 32 of the Act?

 

Section 32 of the Act prohibits the disclosure of personal information by an institution, except in certain circumstances.  (For the full text of section 32, please refer to Appendix A.)

 

The complainant stated:  "They released this confidential information to a third party, namely (the named private company), without my permission".

 

The City submitted that sections 32(b) and (c) of the Act authorized its disclosure of the applicants' pre-employment data to the private company.  We examined each of the City's positions separately.

 

Section 32(b) of the Act

 

Section 32(b) of the Act states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(b)        if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

The City submitted:

 

Yes, the answer sheets were disclosed to [the named private company] in order to allow them to computer mark Test No. 1 and to prepare the statistical summary [i.e., the "Test Analysis"].  Staff believe that this was authorized pursuant to Section 32(b) as the information was provided voluntarily.  In providing this information, the applicant would have known based on the computer format of the answer sheet, that the data would have to be electronically sorted and scored.

 

It is our view that while the computer format of the test answer sheet may have suggested to the applicants that the data would have to be electronically sorted and scored, the format did not suggest that a private company in California would be doing the sorting and scoring.  In fact, the "Test Security Agreement" between the City and the private company allows for the client or purchaser of the test to score the test.

 

Thus, it is our view that the City may not rely on section 32(b) of the Act to authorize its disclosure of the pre-employment data to the private company, for marking purposes.

 

Section 32(c) of the Act

 

Section 32(c) of the Act states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

 

In its submission to I92-72M, the City stated:  "... the disclosure for tabulation purposes was required to generate the statistics necessary in order to forward the City's Employment Equity Program".

 

In the circumstances of this complaint, and especially given the absence of a proper notice of collection, it is our view that the City cannot be said to have disclosed the pre-employment data "for the purpose for which it was obtained or compiled", in accordance with section 32(c) of the Act.  And, since the City did not inform the complainant of the principal purpose or purposes for which the pre-employment data was intended to be used, it cannot be said that the complainant might reasonably have expected this disclosure.  Therefore, it is our view that the City did not disclose the complainant's pre-employment data for a "consistent purpose", in accordance with section 32(c) of the Act.

 

We reviewed the remaining exceptions listed in section 32 of the Act and found that none applied to this disclosure of personal information.  Accordingly, it is our view that the City's disclosure of the personal information was not in accordance with section 32 of the Act.

 

Conclusion:    The City's disclosure of the complainant's pre-employment personal information was not in accordance with section 32 of the Act.

 

Issue F:           Did the City disclose the complainant's SIN, in accordance with section 32 of the Act?

 

The complainant questioned the City's authority to disclose his SIN to the private company.

 

In its submission to I92-72M, the City stated:  "... the disclosure for tabulation purposes was required to generate the statistics necessary in order to forward the City's Employment Equity Program".

 

In our view, the City did not need to disclose the applicants' SIN to generate the statistics necessary for its employment equity program.  We reviewed section 32 of the Act and found that none of the exceptions listed applied to this disclosure.  Accordingly, it is our view that the City's disclosure of this personal information was not in accordance with section 32 of the Act.

 

Conclusion:    The City's disclosure of the complainant's social insurance number was not in accordance with section 32 of the Act.

 

Issue G:          Did the Employment Recruiter and the Human Resources Secretary obtain access to the test analysis printouts, in accordance with section 3(2) of Regulation 823 under the Act, as amended by Regulation 395/91?

 

Section 3(2) of Ontario Regulation 823 states:

 

Every head shall ensure that only those individuals who need a record for the performance of their duties shall have access to it.

 

The City confirmed that the Employment Recruiter and the Information Clerk (i.e., the Secretary of Human Resources) had access to the test analysis printout.  It also submitted the following:

 

It is the City's position that the above staff members required access to information in the test analysis printout in order to perform their respective duties.  The Employment Recruiter is involved in all stages of the hiring process including the Selection Committee which decides who will proceed to the next level of testing based on test performance and the parameters of the City's Employment Equity Program

 

The Information Clerk performs all administrative duties for the Employment Recruiter throughout the entire testing process.  These include advising any of the 1,600 applicants of their test results where these have been requested by them either in person or in writing.

 

We concur with the City that the Employment Recruiter and the Information Clerk needed access to the test analysis printouts for the performance of their duties.

 

Conclusion:    The Employment Recruiter and the Information Clerk obtained access to the test analysis printouts, in accordance with section 3(2) of Ontario Regulation 823.

 

OTHER MATTERS

 

In Issue F we concluded that the City's disclosure of the complainant's social insurance number was not in compliance with section 32 of the Act.

 

With respect to social insurance numbers, we would also like to draw the City's attention to the IPC's most recent publication of "Practices" dated April, 1993 (copy enclosed).  In this issue, we addressed the collection, retention, use, and disclosure of social insurance numbers.  Our main purpose was to heighten awareness of the privacy implications associated with the SIN, when used as a unique personal identifier.

 

SUMMARY OF CONCLUSIONS

 

•           The information contained in the complainant's test answer sheet and the test analysis printout was personal information, as defined in section 2(1) of the Act.

 

•           The City's first collection of the complainant's pre-employment data (on the employment application form) was in accordance with section 28(2) of the Act, as it was "necessary" for the proper administration of a lawfully authorized activity, namely, the City's special program.

 

The City's second collection of the complainant's pre-employment data (on the test) was not necessary for the proper administration of the City's special program, since the City was already in possession of that information.  Thus, the City did not meet the provisions of section 28(2) of the Act, in this second instance.

 

•           The City did not provide notice of collection, in accordance with section 29(2) of the Act.

 

•           The City did not use the pre-employment data in accordance with section 31 of the Act.

 

•           The City's disclosure of the complainant's pre-employment personal information was not in accordance with section 32 of the Act.

 

•           The City's disclosure of the complainant's social insurance number was not in accordance with section 32 of the Act.

 

•           The Employment Recruiter and the Information Clerk obtained access to the test analysis printouts, in accordance with section 3(2) of Ontario Regulation 823.

 

 

RECOMMENDATIONS

 

1.         With regard to the third condition of section 28(2) of the Act, we recommend that the City collect personal information only in those instances where the collection is truly "necessary" to the proper administration of a lawfully authorized activity.

 

2.         Except where notice has been waived or section 29(3) of the Act applies, we recommend that each time the City collects personal information, it inform the individual to whom the information relates of the following, pursuant to section 29(2) of the Act:

 

-           the legal authority for the collection;

-           the principal purpose(s) for which the information is to be used; and

-           the address and telephone number of an official within the City who may answer questions about the collection.

 

3.         We recommend that the City use personal information only in accordance with section 31 of the Act.

 

4.         Since the named private company has physical possession of the test answer sheets containing the applicants' pre-employment personal information, we recommend that the City establish a formal written agreement with the company in Sacramento, California, requiring that it comply with the applicable privacy provisions of the Act.

 

5.         As an alternative to recommendation #4, the City may in future wish to consider removing the personal identifiers from all test answer sheets, prior to disclosing this information to the private company.

 

6.         We recommend that the City not disclose any personal information unless one of the exceptions to the prohibition against disclosure, as cited in section 32 of the Act, applies.

 

Since the above recommendations are the same as those contained in Investigation I92-72M, the City should provide the Office of the Information and Privacy Commissioner with proof of compliance with these recommendations, at the same time that it responds to I92-72M.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Original signed by:                                                      August 5, 1993                                                                                              

Ann Cavoukian, Ph.D.                                                 Date

Assistant Commissioner

 

 

 

APPENDIX A

 

 

32.       An institution shall not disclose personal information in its custody or under its control except,

 

(a)        in accordance with Part I;

 

(b)        if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(d)       if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution's functions;

 

(e)        for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act or treaty;

 

(f)        if disclosure is by a law enforcement institution,

 

(i)         to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or

 

(ii)        to another law enforcement agency in Canada;

 

(g)        if disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;

 

(h)        in compelling circumstances affecting the health or safety of an individual if upon disclosure notification is mailed to the last known address of the individual to whom the information relates;

 

(i)         in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;

 

(j)         to the Minister;

 

(k)        to the Information and Privacy Commissioner;

 

(l)         to the Government of Canada or the Government of Ontario in order to facilitate the auditing of shared cost programs.