Privacy Reports

INVESTIGATION REPORT

 

 

INVESTIGATION I94-005P

 

 

A COMMUNITY COLLEGE

INTRODUCTION

 

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a community college (the College).

 

The complainant, an employee of the College, was concerned about the collection and retention of records containing personal information about his job performance at the College, including a petition signed by co-workers, two cautionary letters from the employer, and a psychiatric report.

 

The complainant advised that a clause in the collective agreement between the College and the union provided for removal of personal records after one year, however, his records had been retained on file for over two years, and the College would not agree to dispose of them.

 

The complainant was of the view that the College's collection and retention of his records was in contravention of the Freedom of Information and Protection of Privacy Act (the Act).  Further, the complainant felt that the records were false and misleading, with groundless accusations about his job performance and attitude. 

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information contained in the records "personal information" as defined in section 2(1) of the Act?  If yes,

 

(B)       Did the College collect the personal information in the records in accordance with section 38(2) of the Act?

 

(C)       Did the College retain the personal information in the records in accordance with section 40(1) of the Act?

 

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information contained in the records "personal information" as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

(g)        the views or opinions of another individual about the individual,

 

(h)        the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

We reviewed the records at issue.  They included a petition signed by co-workers alleging hostile and threatening behaviour, two cautionary letters from the College, and a psychiatric report.  The records contained the complainant's name, information about the complainant's work and marital situation, his age, the views of the complainant's co-workers about him, and personal information about the complainant's employment, psychological and educational history.

 

It is our view that the information contained in the records met the requirements of paragraphs (a), (b), (g) and (h) of the definition of "personal information" in section 2(1) of the Act.

 

Conclusion:    The information contained in the records was personal information as defined in section 2(1) of the Act.

 

Issue B:           Did the College collect the personal information in the records in accordance with section 38(2) of the Act?

 

The complainant was of the opinion that the College had been harassing him by collecting his personal records.  He felt that the College had been trying to "shoot the messenger" rather than deal with broader problems within his department. 

 

Section 38(2) of the Act states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. (emphasis added)

 

The College stated that its collection of the complainant's personal information in the records was necessary to the proper administration of a lawfully authorized activity.  

 

The College advised that it had provided a standard notice of collection to the complainant when he became a permanent employee.  The written notice had informed him that a personnel file containing personal information collected directly from him, or indirectly about him, on matters such as "employment history, salary, performance and attendance, had been initiated under the authority of the Ministry of Colleges and Universities Act R.S.O. 1980, c.272, s.5; R.R.O. 1980, Reg 640 for the purpose of various human resources planning and reporting activities...".  (Now, R.S.O. 1990, c.M.19 s.5  and 1990, Reg 770) . 

Section 5(1) of the Ministry of Colleges and Universities Act states:

 

Subject to the approval of the Lieutenant Governor in Council, the Ministry may establish, name, maintain, conduct and govern colleges of applied arts and technology that offer programs of instruction in one or more fields of vocational, technological, general and recreational eduction and training, in day or evening courses and for full-time or part-time students.

 

Section 5(1) of Regulation 770 states, in part, that a Board of Governors has "the power to appoint, classify, promote, suspend, transfer, reclassify or remove...administrative, teaching and non-teaching personnel...".

 

It is, therefore, our view that the College's management of human resources was a lawfully authorized activity.

 

The College stated that it had collected the complainant's personal information in order to carry out its administrative duties in an appropriate manner.  These duties included documenting and responding to the complainant's co-workers' concerns about his behaviour; dealing with a situation which interfered with the functioning of the department, and undertaking various supervisory and administrative activities related to the disciplinary procedures of the College.  The personal information which was collected included the views of co-workers about the complainant's behaviour, a psychiatric assessment about the complainant and his work situation, information about his job performance etc. 

 

In our view, the College's collection of this personal information was necessary to the proper administration of a lawfully authorized activity, i.e. human resources management.  Therefore, the College's collection of the complainant's personal information in the records was in accordance with section 38(2) of the Act.

 

Conclusion:    The College collected the complainant's personal information in the records in accordance with section 38(2) of the Act.

 

 

Issue C:          Did the College retain the records in accordance with section 40(1) of the Act?

 

Section 40(1) of the Act states:

 

Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information.

 

Section 5(1) of Regulation 460 of the Act stipulates the length of time that personal information must be retained:

 

Personal information that has been used by an institution shall be retained by the institution for at least one year after use unless the individual to whom the information relates consents to its earlier disposal.  (emphasis added)

 

The College advised that while an employee may ordinarily request the removal of a disciplinary notice that has been in his or her personnel file for more than one year, under section 16.4 of the collective agreement, the removal of such notice is at the discretion of the College.  However, because of the nature of its transactions with the complainant, the College felt it was necessary to retain the records.  Section 16.4 of the collective agreement states:

 

Each employee may, once each calendar year, request the removal of a disciplinary notice that has been in his/her official personnel file for more than one (1) year.  The removal of such notice shall be at the discretion of the College.  Such discretion shall not be exercised unreasonably.

 

The College stated that it continued to have concerns about the complainant's behaviour and conduct and the impact this had on the work environment.   Human resource management was ongoing with respect to the measures the College had undertaken.  Furthermore, the complainant was pursuing a grievance involving the issues raised by the records that contained his personal information.  It appeared, therefore, that the College was still "using" the complainant's personal information that it had collected.

 

However, even if the College was no longer using this personal information, while an institution is required under the Act to retain personal information for a one year minimum period after its use, there is no maximum time limit.  Therefore, it is our view that the College's retention of the complainant's records was not in contravention of the Act.

 

 

Conclusion:    The College retained the personal information in the records in accordance with section 40(1) of the Act and section 5(1) of Regulation 460 made under the Act.

 

 

Other Matters

 

The complainant stated that the records contained false and misleading accusations about his job performance and attitude.  The College advised us that they had informed the complainant of his right to make corrections to his personal information, as provided for under section 47 of the Act.   We also informed the complainant of this right.

 

 

SUMMARY OF CONCLUSIONS

 

●         The information contained in the records was personal information as defined in section 2(1) of the Act.

 

●         The College's collection of the personal information in the records was in accordance with section 38(2) of the Act.

 

●         The College's retention of the personal information in the records was in accordance with section 40(1) of the Act and section 5(1) of Regulation 460 made under the Act.

 

 

 

 

 

Original signed by:                                                                  May 11, 1994                                                

Susan Anthistle                                                                       Date

Compliance Review Officer

 

 

****