Privacy Reports

INVESTIGATION REPORT

 

 

INVESTIGATION I93-046M

 

 

A MUNICIPALITY

INTRODUCTION

 

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a named municipality (the Municipality).

 

The complainant, an employee of the Municipality, had been in receipt of Workers' Compensation Board (WCB) benefits for a workplace injury suffered in September 1989.  In December 1989, while he was off work recuperating from his injury, the complainant was in a car accident.  This accident involved coincidentally a Municipality vehicle.  The complainant subsequently filed a civil suit against the Municipality for damages.  Since the accident involved one of its vehicles bumping the complainant's car, the Municipality contacted the insurance company which acted as its agent in third party claims involving Municipality vehicles.

 

In a letter dated March 20, 1992 to the Municipality, the insurance company requested the opportunity of reviewing the complainant's personnel file - specifically any Workers' Compensation Board (WCB) claims.  The insurance company stated that it was investigating a "bodily injury claim" submitted by the complainant against the Municipality.  The insurance company was concerned that the complainant's claim for injuries might involve any prior and similar WCB injuries.

 

In a letter dated April 23, 1992 to the insurance company, the Municipality provided the insurance company with documentation which it considered relevant to the complainant's September 1989 WCB claim.

 

After the insurance company had asked the Municipality for a copy of the complainant's WCB claim but before the Municipality responded, the insurance company received a copy of the complainant's WCB file from the complainant's lawyer on April 7, 1992.  The insurance company did not advise the Municipality that it had already received this copy of the complainant's WCB records.

 

The complainant contended that the Municipality's disclosure of his WCB records to the insurance company was contrary to the Municipal Freedom of Information and Protection of Privacy Act (the Act).

 

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question "personal information", as defined in section 2(1) of the Act?  If yes,

 

 

(B)       Did the Municipality disclose the complainant's personal information, in accordance with section 32 of the Act?

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question "personal information", as defined in section 2(1) of the Act?

 

Section 2(1) of the Act defines "personal information", in part, as:

 

recorded information about an identifiable individual, including,

 

...

 

(c)        any identifying number, symbol or other particular assigned to the individual,

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

 

...

 

(h)        the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; ("renseignements personnels")

 

We obtained a copy of the documentation which the Municipality had disclosed to the insurance company.  This documentation consisted of records pertaining to the complainant's WCB claim dated September 10, 1989.  These records contained, for example, information concerning the complainant's medical condition, his WCB claim number, his Social Insurance Number, his driver's licence number, his postal address, and information concerning a WCB overpayment. 

The documentation also included a record entitled "SKILLS INVENTORY" which outlined the following information concerning the complainant and eight other Municipality employees:  various subjects that the employees had been trained in on a particular date, the fact that all of the employees had successfully completed the training, the dates that the employees were returning to "Operations", and whether they were returning on days or nights.

 

It is our view that the information contained in the documentation forwarded to the insurance company met the requirements of paragraphs (c), (d) and (h) of the definition of "personal information", in section 2(1) of the Act.

 

Conclusion:    The information in question was "personal information", as defined in section 2(1) of the Act.

 

 

Issue B:           Did the Municipality disclose the complainant's personal information, in accordance with section 32 of the Act?

 

Initially, the Municipality stated that it had disclosed the complainant's WCB claim to the insurance company in accordance with section 32(c) of the Act.  However, the Municipality subsequently stated that the personal information was not disclosed.  It stated, instead, that the personal information was used for a "purpose reasonably compatible with the purpose for which it was obtained or compiled, in accordance with s.31(b) of the Act".

 

Section 31 of the Act outlines the general rules for the use of personal information in the custody or control of an institution.  In the circumstances of this case, it is our view that since the records containing the personal information in question were forwarded to an organization external to the institution, the disclosure provisions of the Act, instead of the use provisions, more appropriately apply. 

 

Section 32 of the Act prohibits the disclosure of personal information by an institution, except in certain circumstances.  Section 32(c) of the Act, which the Municipality had originally relied upon, states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

 

In our view, one of the purposes for which the Municipality obtained the complainant's WCB claim was for WCB claims management.  However, the Municipality disclosed the complainant's WCB information to the insurance company not for this purpose, but to assist the insurance company with its investigation in respect of the complainant's suit for damages against the Municipality.  It is, thus, our view that the Municipality's disclosure of the complainant's personal information to the insurance company was not "for the purpose for which it was obtained or compiled", in accordance with section 32(c) of the Act.

 

Section 32(c) also states that personal information may be disclosed for a "consistent purpose".  However, section 33 of the Act further provides that:

 

The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31(b) and 32(c) only if the individual might reasonably have expected such a use or disclosure.  (emphasis added)

 

 

In this case, however, the personal information was not collected directly from the complainant.  When personal information has been collected indirectly, as in the circumstances of this case, a consistent purpose is one which is "reasonably compatible" with the purpose for which the personal information has been obtained or compiled.

 

As we stated earlier, one of the purposes for which the complainant's WCB claim had been obtained by the Municipality was for WCB claims management.  In our view, the Municipality's disclosure of the complainant's WCB claim to the insurance company for the purpose of addressing the civil suit was not reasonably compatible with WCB claims management.  It is thus our view that the Municipality's disclosure was not for a "consistent purpose", in accordance with section 32(c) of the Act.

 

It is also our view that if the Municipality had not been coincidentally the complainant's employer, the Municipality would not have had custody or control of the complainant's WCB records and would not have been in a position to disclose these records.  We acknowledge that in order for the civil suit to proceed, it would have been necessary eventually for the complainant or his representative to disclose these records to the insurance company. However, it is our view that it would not have been necessary for the complainant's employer to be involved.

 

We have reviewed the remaining exceptions under section 32 and found that none applied to the circumstances of this case.  It is, therefore, our view that the Municipality disclosed the complainant's personal information to the insurance company contrary to section 32 of the Act.

 

Conclusion:    The Municipality disclosed the complainant's personal information contrary to section 32 of the Act.

 

 

Other Matters

 

During the course of this investigation, the following matters were identified which should be brought to the institution's attention.

 

Disclosure of the "SKILLS INVENTORY"

 

We found that in addition to sending a copy of the complainant's WCB records, the Municipality also disclosed a record entitled "SKILLS INVENTORY", to the insurance company.  As previously mentioned, this record included details about training which the complainant and other Municipality employees had successfully completed.  It also included details regarding the dates that the employees were returning to "Operations", and whether they were returning on days or nights.

 

 

 

We examined section 32 of the Act and found that none of the exceptions listed applied to this disclosure.  Accordingly, it is our view that the Municipality's disclosure of this personal information was contrary to section 32 of the Act.

 

Conclusion:    The Municipality disclosed the personal information contained in the "SKILLS INVENTORY" contrary to section 32 of the Act.

 

 

Faxing of Personal Information

 

While this complaint did not concern the improper disclosure of personal information by facsimile, we noticed that there was a facsimile cover sheet included in the records disclosed to the insurance company.  Since it appeared that personal information might have been sent via facsimile, we reminded the Municipality of our faxing guidelines.  We enclosed (with our draft report) copies of the following:  "Guidelines on Facsimile Transmission Security, June 1989" and "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990".

 

 

 

SUMMARY OF CONCLUSIONS

 

●         The information in question was "personal information", as defined in section 2(1) of the Act.

 

●         The Municipality disclosed the complainant's personal information contrary to section 32 of the Act.

 

●         The Municipality disclosed the personal information contained in the "SKILLS INVENTORY" contrary to section 32 of the Act.

 

 

RECOMMENDATIONS

 

We recommend that the Municipality:

 

1.         take steps to ensure that disclosures of personal information are made in accordance with the Act, for example, by clarifying any existing guidelines or procedures regarding disclosure of personal information;

 

2.         remind its employees of our guidelines on the transmission of facsimiles.

 

 

 

 

 

Within six months of receiving this report, the Board should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

Original signed by:                                                                  December 31, 1993    

Susan Anthistle                                                                       Date

Compliance Review Officer

 

 

****