Privacy Reports

INVESTIGATION REPORT

 

 

 

INVESTIGATION I93-037M

 

 

A MUNICIPALITY

 

 

 

 

 

March 28, 1994

 

INTRODUCTION

 

 

Background of the Complaint

 

 

This investigation was initiated as a result of a complaint concerning a named municipality (the Municipality).

 

The complainant's child (son) who has special needs is enroled in the Municipality's Early Intervention Services Program (EISP).  The EISP is a home-based, comprehensive, early intervention service for the individual child with special needs and family members.  The service is administered by the Municipality and is funded by the Provincial Government with no cost to the family.  Families are the key decision makers and, with staff, set goals based on identified needs. 

 

Although the EISP is family-oriented, the complainant does not accept this family approach.  She insists that the EISP deal only with her son's development.  As a result, she stated that, when she reviewed her son's file, she was "shocked" to discover personal family information relating to her and to her younger son (her second son) on this file. 

 

She stated that the Municipality had wrongfully collected her personal information and had placed it on her son's file, contrary to the provisions of the Municipal Freedom of Information and Protection of Privacy Act (the Act).  She also indicated that the Municipality had collected her second son's personal medical information and placed political briefing notes concerning her, on her son's file.  She stated that all this personal family information contained in her son's file was accessible to the Municipality's EISP personnel. 

 

It was her view that the Municipality had no authority to collect the personal family information requested on the "Inventory of Social Support" form (the ISSF).  If the Municipality did have such authority, she felt that there should be notice on the ISSF to indicate at least the purpose for which the personal information would be used.

 

The complainant had filed four access requests for information concerning the EISP to the Municipality, pursuant to the provisions of the Act.  She stated that the Municipality had wrongfully disclosed this personal information to the Municipality's Commissioner (the Commissioner) for the Community Services and Health Committee (the Committee).

 

 

Issues Arising from the Investigation

 

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question "personal information", as defined in section 2(1) of the Act?  If yes,

 

(B)       Did the Municipality collect the complainant's family personal information, in accordance with section 28(2) of the Act?

 

(C)       Did the Municipality provide notice of this collection, in accordance with section 29(2) of the Act?

 

(D)       Did the Municipality disclose the complainant's personal information to the Commissioner, and subsequently to the Community Services and Health Committee, in accordance with section 32 of the Act?

 

 

 

RESULTS OF THE INVESTIGATION

 

 

Issue A:          Was the information in question "personal information", as defined in section 2(1) of the Act?

 

Section 2(1) of the Act defines "personal information", in part, as:

 

"personal information" means recorded information about an identifiable individual, including,

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

...

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

 

(e)        the personal opinions or views of the individual except if they relate to another individual,

...

 

(g)        the views or opinions of another individual about the individual, and

 

 

(h)        the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; (renseignements personnels")

 

We reviewed the Municipality's work file concerning the complainant's son.  This file contained the son's name, age, address, some medical information, details on his special needs, comments and suggestions by the EISP specialists, and notes of discussions between the complainant and various EISP personnel.  The work file also included limited medical information concerning the second son. 

 

The Municipality also maintained a file separate from the work file, which contained the complainant's correspondence with the Municipality and other government institutions concerning the EISP.   This correspondence file contained briefing notes which the Municipality used to reply to her letters.  It also contained an undated report (for a March 3, 1993 in camera meeting) which mentioned the complainant by name and the four access requests she had made.

 

It is our view that the information contained in these records met the requirements of paragraphs (a), (b), (d), (e), (g), and (h) of the definition of "personal information", in section 2(1) of the Act.

 

Conclusion:    The information in question was "personal information", as defined in section 2(1) of the Act.

 

 

Issue B:           Did the Municipality collect the complainant's family personal information, in accordance with section 28(2) of the Act?

 

Section 28(2) of the Act states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity [emphasis added].

 

The Municipality informed us that this collection was necessary to the proper administration of a lawfully authorized activity - to carry out its EISP.

 

In order for a collection of personal information to fall under the third condition of section 28(2) of the Act, an institution must demonstrate that the information it collects is necessary to the proper administration of an activity which falls within its mandate. 

 

The Municipality has cited certain sections of the Municipal Act, The Regional Municipality of York Act, the Day Nurseries Act, and the Child and Family Services Act (CFSA) as its authority for carrying out the EISP.  We have reviewed the specific legislation cited by the Municipality and are of the view that the applicable legislation is the CFSA.  Section 7(1) of the CFSA states:

 

The Minister may,

...

(b)        make agreements with persons, municipalities and agencies for the provision of services,

 

and may make payments for those services and facilities out of legislative appropriations.

 

According to the 1993 Annual Report of the Office of the Provincial Auditor, the Ministry of Community and Social Services (the Ministry) funds approximately 200 non-profit agencies under its Child and Family Intervention (CFI) program.  Services provided include therapy, counselling, skills training, and education as well as residential services to children who require more intensive assistance.  Funding for various children services is provided by the Ministry under the authority of the CFSA and Regulations.

 

The Municipality advised us that its EISP followed the "Infant Development Program Guidelines" dated March 1987, as set out by the Ministry.  The objectives of the EISP are to assist families who have children with special needs in implementing an Individual Family Support Plan.  The EISP provides the families with specialized information and skills to enable them to choose programs and services appropriate to their needs. 

 

We also reviewed the preamble of the CFSA which states:

 

The purposes of this Act are,

 

(a)        as a paramount objective, to promote the best interests, protection and well-being of children;

 

(b)        to recognize that while parents often need help in caring for their children, that help should give support to the autonomy and integrity of the family unit and, wherever possible, be provided on the basis of mutual consent;

 

(c)        to recognize that the least restrictive or disruptive course of action that is available and is appropriate in a particular case to help a child or family should be followed;

 

(d)       to recognize that children's services should be provided in a manner that,

 

(i)         respects children's needs for continuity of care and for stable family relationships, and

 

(ii)        take into account physical and mental developmental differences among children;

...

 

Based on the above information, we concur with the Municipality that the EISP is a lawfully authorized activity.

 

However, the Municipality must also demonstrate that the information it collects is "necessary" to the proper administration of this activity.

The Municipality provided us with the following submissions as to why it was necessary to collect the complainant's family personal information. 

 

The EISP assists families in arranging for specialized services and equipment as required.  It helps families access community resources and specialized funding.  It provides families with the opportunity for ongoing education and group involvement.  In addition, it assists families in selecting community early childhood programs and provides ongoing staff support.  It responds to families' requests for consultation during the transition to school board programs.  Fee assistance for child care services in group programs is available for families who qualify.  

 

The Municipality submitted that it had taken great effort in establishing the EISP to be as effective as possible.  Based on informed and recognized contemporary material in the child development field, the Municipality stated that the use of information gleaned from and about the child's immediate family is deemed important and necessary in determining what proposals can by made by staff for the parents to adopt with respect to the goals and objectives of most benefit for the child and its family.

 

In addition, the Municipality submitted:

 

The information also allows for an improved element of continuity of basic knowledge for the staff should replacement personnel be required.  Thus, the personal information about the parents and siblings (family) is felt to be necessary to properly deliver the program for its best and most enhanced benefit.  To operate with a deficiency of information through refusal to advise of pertinent personal information would naturally (and without any intent to diminish) generate an inferior service. 

 

The Municipality also stated:

 

The EISP is designed to provide the parents of the child with the necessary availability of specialized information and access to resources within the community.  The decision-making process is left to the parents as to what benefits they wish to take advantage of but unless the Municipality has as full a picture as possible, it is very difficult to administer, in an efficient and complete manner, the service that could be made available only through availability of adequate family personal information. 

 

The complainant had specifically stated that it was her view that the Municipality had no authority to collect the personal information requested on the ISSF. 

 

The Municipality submitted that the use of certain forms provides staff with the opportunity to collect information that is considered appropriate and necessary to the program.  According to the Municipality, there is no advantage to the program to gather unnecessary or useless personal information and likewise, there is a disadvantage to the delivery of the program if there is an omission of necessary and pertinent personal information.

 

The Municipality uses various forms and questionnaires to ask questions designed to solicit information so that the EISP specialists can carry out the purposes of the program.  The ISSF is just one of many forms which the Municipality uses to solicit personal information to determine how best to provide the program.

 

Having considered the Municipality's submissions,  we accept that in order to make a program, which is geared to helping families with special needs children, work well, the Municipality would require information about more than just the special needs of the child him or herself.  Therefore, it is our view that it is necessary for the Municipality to collect family personal information for the proper administration of a lawfully authorized activity, the EISP.

 

Conclusion:    The Municipality collected the complainant's family personal information in accordance with section 28(2) of the Act.

 

 

Issue C:          Did the Municipality provide notice of collection, in accordance with section 29(2) of the Act?

 

The complainant had stated her view that if the Municipality did have the authority to collect personal information, the Municipality should have given notice on the ISSF and indicated the purpose for which the personal information was intended to be used.

 

Section 29(2) of the Act requires an institution to notify the individual to whom the personal information relates of the authority for the collection and the purposes of the collection.  It states:

 

If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,

 

(a)        the legal authority for the collection;

 

(b)        the principal purpose or purposes for which the personal information is intended to be used; and

 

(c)        the title, business address and business telephone number of an officer or employee of the institution who can answer the individual's questions about the collection.

 

The Municipality advised us that it had provided verbal notice at the time that the families enroled for the EISP.  When we asked for specific details of the verbal notice, the Municipality was unable to provide any.  However, in its representations on our draft report, the Municipality stated that the complainant had received notice of the conduct of the program and the purpose for which the personal information was to be used.  However, notice, whether written or verbal, must comply with all three requirements of section 29(2) of the Act. 

 

It is, therefore, our view that the Municipality did not provide proper notice of collection, in accordance with section 29(2) of the Act.

 

Conclusion:    The Municipality did not provide notice of collection, in accordance with section 29(2) of the Act.

 

 

Issue D:          Did the Municipality disclose the complainant's personal information to the Commissioner, and subsequently to the Community Services and Health Committee, in accordance with section 32 of the Act?

 

Under the Act, an institution may not disclose personal information in its custody or under its control except in accordance with the provisions of section 32.  (Please see Appendix A for full text) 

 

Disclosure of the complainant's personal information to the Commissioner

 

The complainant wrote that she wanted to know who had disclosed to the Commissioner, the fact that she had filed an access request.

 

The Municipality's Freedom of Information and Privacy Co-ordinator processed the first four access requests made by the complainant by forwarding a copy of her letters to the Commissioner who was the relevant department head.  In so doing, the Municipality disclosed the complainant's identity.  At that time, this was consistent with the Municipality's policy for processing access requests.  The Municipality would forward the complete access request to the head of the department which had the requested information.  However, the Municipality has since changed its policy so that the requester is not identified.

 

We have examined the provisions of section 32 and have found that none applied to the disclosure of the complainant's identity as the requester to the Commissioner.  It is our view therefore, that the Municipality disclosed the complainant's personal information to the Commissioner, contrary to section 32 of the Act.

 

 

 

 

Disclosure of the complainant's personal information by the Commissioner to the Community Services and Health Committee

 

The complainant provided us with a copy of an undated report prepared by the Commissioner for the March 3, 1993 in camera meeting of the Municipality's Community Services and Health Committee (the Committee).  One of the purposes of this meeting was to respond to the complainant's voluminous correspondence.  This report mentioned that the Municipality had replied to four "Freedom of Information" requests (four access requests) filed by the complainant.  It was the complainant's view that the Municipality should not have disclosed the fact that she had filed four access requests in this report to the Committee. 

 

We asked the Municipality to explain why it had been necessary to cite the complainant's four access requests in the report.  The Municipality replied that the complainant had written many letters to various members of the Committee.  In a copy of a letter dated January 22, 1992 [sic] which the complainant sent to a Committee member, she herself had enclosed a copy of a response she received following an access request.  The Municipality stated:

 

Although the Commissioner's reference to four requests under the Act set out in his report is beyond that which [name of complainant] has referred to it should not be overlooked that [name of complainant] has in fact revealed that she has made a request under the Act and that she has specifically referred to it (in the January letter) and provided a copy of a response pursuant thereto to the Members of the Community Services and Health Committee.

 

However, the Municipality was unable to explain why it had been necessary to include the fact that the complainant had filed four access requests in the Commissioner's report to the Committee. 

 

We have examined the provisions of section 32 of the Act to the disclosure of this personal information but found none that applied.  It is, therefore, our view that the Commissioner's disclosure of the complainant's personal information to the Committee was not in accordance with section 32 of the Act.

 

Conclusion:    The Municipality disclosed the complainant's personal information to the Commissioner and subsequently to the Committee, contrary to section 32 of the Act.

 

 

 

SUMMARY OF CONCLUSIONS

 

o          The information in question was "personal information", as defined in section 2(1) of the Act.

 

o          The Municipality collected the complainant's family personal information, in accordance with section 28(2) of the Act.

 

o          The Municipality did not provide proper notice of collection, in accordance with section 29(2) of the Act.

 

o          The Municipality disclosed the complainant's personal information to the Commissioner, and subsequently to the Committee, contrary to section 32 of the Act.

 

 

 

RECOMMENDATIONS

 

We note that the Municipality has changed its procedures for dealing with access requests so that the identity of the requester is not disclosed. 

 

We, thus, recommend that:

 

the Municipality give proper notice for the collection of personal information on its questionnaires and forms relating to its EISP, in accordance with section 29(2) of the Act.

 

Within six months of receiving this report, the Municipality should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

 

 

 

Original signed by:                                                                  March 28, 1994                    

Susan Anthistle                                                                       Date

Compliance Review Officer

 

 

 

****

  

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

APPENDIX A

 

32.       An institution shall not disclose personal information in its custody or under its control except,

 

(a)        in accordance with Part I;

 

(b)        if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(d)       if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution's functions;

 

(e)        for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act or treaty;

 

(f)        if disclosure is by a law enforcement institution,

 

  (i)       to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or

 

 (ii)       to another law enforcement agency in Canada;

 

(g)        if disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;

 

(h)        in compelling circumstances affecting the health or safety of an individual if upon disclosure notification is mailed to the last known address of the individual to whom the information relates;

 

(i)         in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;

 

(j)         to the Minister

 

 

(k)        to the Information and Privacy Commissioner;

 

(l)         to the Government of Canada of the Government of Ontario in order to facilitate the auditing of shared cost programs.