Privacy Reports

INVESTIGATION REPORT

 

 

 

INVESTIGATION I98-018P

 

 

Ministry of Health

 

 

 

 

December 15, 1998

INTRODUCTION

 

BACKGROUND OF THE COMPLAINT

 

This investigation was initiated as a result of a privacy complaint concerning the Ontario Food Survey (the survey). 

 

The complainant received a letter from a university indicating that he had been selected to participate in the survey.  The letter stated that the university, another university, and the federal and provincial health ministries, were conducting a survey on the eating habits of Ontarians.  The letter went on the explain that the survey would be used “in the development of appropriate policies and programs that are important to health.”  According to the letter, the Ontario Ministry of Health (the Ministry) and the Principal Investigator for the university entered into a research agreement pursuant to section 21(1)(e) of the Freedom of Information and Protection of Privacy Act (the Act), which permitted disclosure of certain personal information for the purpose of conducting the survey.

 

The letter stated that the complainant’s name had been selected at random by the Ministry and was disclosed together with his address, date of birth, sex and spoken language, to the Principal Investigator for the purposes of the survey.  The complainant was advised that he would be contacted by a survey interviewer and asked to participate in an initial 90-minute interview in his home, possibly followed by a second 30-minute interview.  According to the letter, any information provided by the complainant was to be treated confidentially, and only the researchers would know the complainant’s identity. 

 

The letter was signed by the Principal Investigator, the Co-Investigator from the Food Safety Program of the second university, and the Chief Medical Officer of Health for the Province of Ontario.

 

The complainant’s position is that his personal information was disclosed by the Ministry to the university without his consent, and as a result, the disclosure was in contravention of the Act.

 

PRELIMINARY ISSUE

 

Jurisdiction to Investigate Privacy Complaints

 

The Ministry, in providing its response to the complaint, raised an issue relating to the jurisdiction of the Commissioner to investigate privacy complaints against institutions covered by the Act. 

 

The Ministry submits that I do not have jurisdiction to consider the complainant’s allegation of a breach of privacy as a result of an alleged improper disclosure of his personal information. The main thrust of this submission concerns the research purpose exception to the personal information exemption found at section 21(1)(e) of the Act. The Ministry takes the position that I have no jurisdiction to consider a complaint of this nature, “once it is satisfied that the requirements of this section [s. 21(1)(e)] have been met.” I will deal with this submission under Issue B(I) below.

 

The Ministry also makes the general argument that I have no jurisdiction to issue my investigation report in any event, whether or not I accept its arguments on the effect of section 21(1)(e). The Ministry states:

 

Finally, the ministry wishes to comment on the jurisdiction the IPCO pursuant to clause 59(f) of the Act in the event that the IPCO claims that this clause provides it with jurisdiction over this matter. The IPCO has not published any reports or orders describing what it views to be its jurisdiction under this clause.

 

Clause 59(f) reads:

 

The Commissioner may,

 

(f)        receive representations from the public concerning the operation of this Act.

 

The ministry submits that jurisdiction under this clause is limited to the receipt of representations - it does not confer any jurisdiction on the IPCO to offer comment or publish a “report” on the matter before it. The language of this clause is to be contrasted with that in clause 59(a), for example, in which the Commissioner may “offer comment on the privacy protection implications of proposed legislative schemes or government programs . . .” Clearly, it is to be contrasted with the language of subsection 51(1) [sic 54(1)] which makes it mandatory for the Commissioner to issue an order after the conclusion of an inquiry. [Ministry’s emphasis]

 

The authority conferred under section 59(f) is self-explanatory. The receipt of public representations on the operation of the Acts is, of course, one of many functions I perform under a broad statutory mandate relating to access to information and protection of privacy matters. In the 1993 judgment in John Doe v. Ontario (Information & Privacy Commissioner), 13 O.R. (3d) 367, recently cited with approval by the Ontario Court of Appeal in Ontario (Workers’ Compensation Board) v. Ontario (Assistant Information and Privacy Commissioner), [1998] O.J. No. 3485, the Ontario Divisional Court described the Commissioner’s general supervisory role under the legislation, including my reporting function to the legislature, in the following terms:

 

Under the Act . . . the adjudicative function is performed by the same person who administers the specialized area of regulatory activity. Such adjudicative function . . . is integral to the supervision of its specialized area of regulatory activity. The commissioner exercises a supervisory function in respect of compliance by government institutions with provisions of the Act and has exclusive jurisdiction to review the decision of a head of an institution under the Act relating to a request for access (ss.  4 and 50).

. . . . .

 

The commissioner is also given administrative and adjudicative responsibility for access to government information on the one hand, and the protection of individual privacy on the other. Under the scheme of the Act, the commissioner is responsible for five overlapping and integrated activities:  reviewing government decisions concerning the dissemination of information; investigating public complaints with respect to government practices in relation to the use and disclosure of personal information; reviewing government administrative and records management practices; conducting research and giving advice on issues related to access and privacy; and educating the public concerning privacy and access issues.

 

The operation of this comprehensive statutory scheme has been documented in annual reports provided by the commissioner to the Legislative Assembly pursuant to s. 58. 

 

The Ministry is correct in suggesting that representations from the public in the form of complaints are the most frequent means by which issues of non-compliance with Part III of the Act come to my attention. However, section 59(f) is not the basis for my authority to conduct compliance investigations and make my investigation reports. That authority is found at section 58 of the Act.

 

Section 58(1) requires that I make an annual report to the Speaker of the Legislative Assembly to be laid before the Assembly when it is in session. The contents of my annual report are set out at section 58(2) of the Act. This requires that I provide a comprehensive review of the effectiveness of the provincial and municipal Acts in providing access to information and protection of personal privacy, including my assessment of the extent to which institutions are complying with the legislation and my recommendations with respect to the practices of particular institutions. Apart from imposing this general duty to report, the Legislature has left it to my Office to determine and adopt the administrative processes deemed necessary or advisable to fulfil my statutory obligations in this regard.

 

In order to make my report to the Legislature, I require information concerning questions of compliance which arise, as well as an adequate understanding of the institution’s position on compliance necessary to make this a meaningful exercise. Accordingly, my Office has developed an investigation process by which information concerning complaints of non-compliance with the legislation is provided by institutions and members of the public on a voluntary and responsible basis. Therefore, the effectiveness of my supervisory role and the usefulness of my annual reports in matters of compliance depend largely on the co-operation I receive from institutions when I am conducting compliance investigations.

 

In many cases, privacy complaints can be resolved informally without my having to undertake an investigation or make a report on the results of an investigation. Other complaints may warrant a more complete examination of the facts and the production of a report reflecting my views on an institution’s compliance with the Acts. Where I am of the opinion that an institution is not in compliance, my report will usually make recommendations on how the institution should endeavour to comply with its obligations in the future.  My recommendations do not bind the institution to take specific steps, but are designed to assist it in fulfilling its duties under the legislation in order to remain in compliance.

 

My privacy complaint investigations and reports form the principal basis for making my annual reports to the Legislative Assembly on the effectiveness of the Acts in protecting personal privacy.  My annual reports summarize the facts and circumstances of selected investigations, including my findings on compliance, my recommendations to institutions, and their responses on the implementation of my recommendations, and provide other information concerning my activities in monitoring the compliance of institutions with the legislation. My annual reports also refer the Legislature and other readers to the text of my investigation reports, which are made available to the public through my Office Web site (www.ipc.on.ca), and various reporting services.

 

My privacy investigations and reports on questions of compliance have proved to be an effective, efficient and fair method of fulfilling my obligations to report annually to the Legislature. They also contribute greatly to my ability to perform my other “overlapping and integrated activities,” in making sound recommendations on proposed revisions to the Acts and regulations, and offering informed comment on the privacy protection implications of proposed legislative schemes and government programs, all in furtherance of my duties set out at sections 58(2)(c) and 59(a) of the Act.  Without the cumulative knowledge and experience with the legislation which my investigation reports represent, the public and the Legislature would be deprived of one of the principal benefits of the legislation, namely, the expert advisory and supervisory role of an independent Commissioner concerning issues of compliance with the legislation. Further, if I were to accept the Ministry’s arguments, the Legislature would not have the benefit of the Commissioner’s choice of the most effective means of performing my statutory duties, and I would be impeded in my ability to report fully, accurately and fairly under section 58 of the Act. In my opinion, this cannot possibly have been the legislative intent.

 

Accordingly, I have the jurisdiction to proceed to make my report, which you will find below.

 

ISSUES ARISING FROM THE INVESTIGATION

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question the complainant’s “personal information,” as defined in section 2(1) of the Act?  If yes,

 

(B)       Did the Ministry disclose the personal information in compliance with section 42 of the Act?

                       

                        (i)         Jurisdictional Issue

                        (ii)        Requirement to Provide Notice

                        (iii)       Disclosure Issue

 

 

RESULTS OF THE INVESTIGATION

Issue A:          Was the information in question the complainant’s “personal information,” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states in part, that “personal information” means recorded information about an identifiable individual, including,

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

            ...

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

 

            ...

 

(h)        the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

The information disclosed to the university included the complainant’s name, address, date of birth, sex and spoken language.

 

There would appear to be no dispute that the information in question was the personal information of the complainant, falling within the scope of one or more of the paragraphs which define “personal information” in section 2(1) of the Act.

 

Conclusion:    The information in question was the complainant’s “personal information,” as defined in section 2(1) of the Act.

 

Issue B:           Did the Ministry disclose the personal information in compliance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information, including section 42(a) which states:

 

            An institution shall not disclose personal information in its custody or under its control except,

 

(a)        in accordance with Part II;

 

The Ministry does not dispute the fact that the complainant did not consent to the disclosure of his personal information.  However, under section 42(a), the Ministry may disclose personal information whether or not consent is obtained.

 

Section 42(a) refers to Part II of the Act.  This part is headed “Freedom of Information,” and sets out the legislative scheme for providing public access to government-held records.  Under Part II, if a requested record is within the custody or control of a government “institution,” as defined in the Act, access must be provided, unless the record or the information contained in the record falls within the scope of one or more of the mandatory and discretionary exemptions contained in Part II.  One of these mandatory exemptions, section 21, deals with the personal information of individuals other than a requester.  Under section 21, an institution is compelled not to disclose personal information unless one of the exceptions listed in section 21(1) are present.  One such exception is section 21(1)(e), which reads as follows:

 

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

 

(e)        for a research purpose if,

 

             (i)        the disclosure is consistent with the conditions or reasonable expectations of disclosure under which the personal information was provided, collected or obtained,

 

 (ii)       the research purpose for which the disclosure is to be made cannot be reasonably accomplished unless the information is provided in individually identifiable form, and

 

(iii)       the person who is to receive the record has agreed to comply with the conditions relating to security and confidentiality prescribed by the regulations;

 

The Ministry submits that the Principal Researcher made a request under Part II of the Act to the Ministry for access to personal information in the Ministry’s Registered Persons Database (the RPD) in order to select a sample for the survey. The request was accompanied by a Form 1 research agreement, as required by section 10(2) of Ontario Regulation 460 made under the Act.  According to the Ministry, it assessed the adequacy of the agreement, found initially that it did not comply with section 21(1)(e), worked with the requester to facilitate compliance with this section, and eventually concluded that the amended request satisfied the requirements of section 21(1)(e).  The Ministry then proceeded to disclose the personal information to the requester without prior notification to the complainant or any other person whose name would be selected from the RPD.

 

(i)         Jurisdictional Issue

 

The Ministry submits that the Act does not confer jurisdiction on the Information and Privacy Commissioner to consider the complainant’s allegation of a breach of privacy in these circumstances. 

 

The Ministry submits that if it is satisfied that the requirements of section 21(1)(e) have been established, it is entitled to disclose the requested personal information, and any complaint based on this disclosure is not within the Commissioner’s jurisdiction to review. 

The Ministry states:

 

When access requests are made, such as this one, remedial rights are found in subsection 50(1) of the Act, and are limited to the classes of individuals named there -- the “complainant” in this case does not fit within any of these categories.

 

The ministry takes the position that, with the exception of clause 42(a), the disclosure provisions in section 42 apply to the ministry’s disclosure of personal information “in the ordinary course of business;” i.e. in the absence of a request under the Act.  With respect to clause 42(a), the ministry submits that as the [Commissioner’s Office] has itself determined, this section may only be relied upon in the context of an access request (I95-024M).

 

Section 50(1) sets out the classes of persons who may appeal access decisions under the Act, and reads as follows:

 

            A person who has made a request for,

 

                        (a)        access to a record under subsection 24(1);

 

                        (b)        access to personal information under subsection 48(1); or

 

                        (c)        correction of personal information under subsection 47(2),

 

or a person who is given notice of a request under subsection 28(1) may appeal any decision of a head under this Act to the Commissioner.

 

Section 28(1) of the Act requires the institution to provide written notice in certain circumstances before granting access to requested records.  Specifically, section 28(1)(b) provides:

 

Before a head grants a request for access to a record,

 

            (b)        that is personal information that the head has reason to believe might constitute an unjustified invasion of personal privacy for the purpose of clause 21(1)f),

 

the head shall give written notice in accordance with subsection (2) to the person to whom the information relates.

 

The Ministry submits that it is only obliged to give notice to the complainant pursuant to section 28(1)(b) if it has reason to believe that disclosure of the information might constitute an unjustified invasion of personal privacy for the purposes of section 21(1)(f) of the Act. Because disclosure was contemplated under section 21(1)(e) rather than section 21(1)(f), in the Ministry’s view, the head of the institution had no reason to believe that the disclosure might constitute an unjustified invasion of personal privacy, and the notice requirements under section 28(1)(b) did not apply.

 

Extending this line of reasoning, the Ministry submits that because the complainant did not fall among the classes of persons entitled to notice, he had no right of appeal under section 50(1) of the Act. Because there was no right of appeal, the Commissioner has no jurisdiction to provide a remedy relating to the disclosure of the complainant’s personal information. In the Ministry’s view, the Commissioner has no jurisdiction to consider a complaint under section 42(a) in the absence of a request under Part II of the Act.

 

I cannot accept the Ministry’s position. There is nothing in the statutory provisions referred to by the Ministry, or in the overall scheme of the Act, to suggest that the Commissioner’s statutory role in monitoring compliance with the Act should be interpreted in such a narrow, restricted way. The Ministry points to no statutory basis for asserting that my jurisdiction to consider a question of compliance with section 42(a) is limited to situations where I also have authority to grant a remedy in an access appeal under section 50(1).  A disclosure pursuant to an access request is either made in accordance with Part II and section 42(a) of the Act or it is not.  My authority to review an institution’s decision to the disclosure of information in an access appeal is simply not relevant to the question of whether an institution is in compliance with Part III of the Act or to my role generally in overseeing compliance.

 

In the case before me, the complainant made a privacy complaint; he did not appeal an access request.  My role in overseeing compliance by institutions with the provisions of the Act includes reviewing whether or not a disclosure of personal information complies with the privacy provisions of Part III.  In my view, the inclusion of section 42(a) within these privacy provisions (section 42(a)) provides an added safeguard in situations where personal information may have been improperly disclosed in response to an access request.  In particular, it provides protection for individuals who cannot avail themselves of the statutory provisions provided to appellants.  Without this safeguard, individuals would have no recourse to pursue their privacy concerns, thereby creating a situation which is contrary to one of the main purposes of the Act -- the protection of personal privacy.

 

In my view, where disclosure of personal information has been made in response to an access request, and a complaint is made to my office, I have the authority to satisfy myself that the disclosure was properly made under Part II in order determine if the requirements of section 42(a) of the Act are present.

 

(ii)        Requirement to Provide Notice

 

The Ministry maintains that it was not required to give notice under section 28(1)(b) of the Act because it was not relying on the exception provided by section 21(1)(f), and had no reason to believe that disclosure of the personal information might constitute an unjustified invasion of privacy.  The Ministry attempts to distinguish the present case from Investigation Report I95-024M, where I found that a municipal institution had breached section 32 of the Municipal Freedom of Information and Protection of Privacy Act (the equivalent of section 42 in the provincial Act), because it had not notified the complainant prior to disclosing his personal information in response to an access request.

 

In I95-024M, the institution had disclosed personal information pursuant to section 14(1)(f) of the municipal Act (section 21(1)(f) of the provincial Act).  In that case, I found that disclosure in the absence of notice was not proper, and that the institution should have provided the complainant with the opportunity to provide representations on whether any of the presumptions or factors listed in sections 14(2) and (3) of the municipal Act were present before determining whether disclosure would be an unjustified invasion of privacy.

 

However, the Ministry submitted that the notice requirement referred to in I95-024M was confined to circumstances where section 21(1)(f)/14(1)(f) were being relied upon by an institution as the basis of permitting disclosure.  I disagree.

 

Although section 14(1)(f) was the only exception relied upon in I95-024M, I did not conclude in that case that notice is required only where section 21(1)(f)/14(1)(f) is relied upon by an institution.  The notice requirements of section 28(1)(b) are engaged whenever an institution has reason to believe that the disclosure of personal information may constitute an unjustified invasion of personal privacy. If an institution is relying on one of the exceptions listed in sections 21(1)(a) through (e), and there is a reasonable doubt as to whether the requirements of these exceptions have been established, the institution may well have reason to believe that disclosure may constitute an unjustified invasion of personal privacy for the purposes of section 21(1)(f), in which case notice under section 28(1)(b) would be required.

 

In my view, the Ministry’s arguments concerning its obligation to provide section 28(1)(b) notice to affected persons, and the related right of an affected person to appeal the head’s decision prior to disclosure, are premised on the assumption that an institution will always be correct in applying the section 21(1)(a) through (e) exceptions.  If in fact the institution is not correct and the requirements of any of sections 21(1)(a) through (e) being relied upon are not present, then the obligation to give section 28(1)(b) notice would clearly arise.

 

In the present case, if any of the requirements of section 21(1)(e) are not present, this exception to the mandatory section 21 exemption is not available, and disclosure of personal information is prohibited unless another exception, such as section 21(1)(f), applies.  In these circumstances, failure to provide section 28(1)(b) notice prior to disclosure of this personal information would amount to non-compliance with the requirements of section 42(a). The Ministry’s obligation to provide proper notice cannot be removed simply because it mistakenly thought it could rely on section 21(1)(e). Nor can the absence of notice deprive an affected person of the right to appeal to this office where section 28(1)(b) notice should have been given prior to disclosure, but was not.

 

I should also note that institutions are not the only bodies with a statutory obligation to provide notice to affected persons. Section 50(3) of the Act also imposes an obligation on the Commissioner to provide notice during the course of an appeal.   In Ontario (Attorney General) v. Fineberg [1996] O.J. No. 67, the Divisional Court interpreted this obligation.  The Court quashed Order P-676 for breach of natural justice because this office had not provided an affected person with notice on the basis that the record at issue had not contained his personal information. The Court found that the affected person should have been given the opportunity to make submissions on the threshold question of whether the record contained his personal information and, if so, whether the disclosure would constitute an unjustified invasion of personal privacy. 

 

The Court’s judgment suggests that notice is required under section 50(3) where the outcome of a threshold decision may result in disclosure of a record containing personal information.  In my view, similar considerations of fairness should apply where information qualifies as personal information and a reasonable doubt exists as to whether disclosure would fall within one of the exceptions at sections 21(1)(a) through (e).

 

In my view, where an institution relies on an exception at sections 21(1)(a) to (e) and fails to give section 28(1)(b) notice, it does so at its own risk. The disclosure of personal information may never come to the attention of the affected person.  However, if it does, as in the present case, and that person claims that none of the exceptions in sections 21(1)(a) through (e) are available, that individual is entitled to complain to this office that section 42(a) has not been complied with; this will then necessarily require an independent determination of the proper application of the various provisions of section 21 and the notice requirements of section 28(1)(b) of the Act.

 

(iii) Disclosure Issue

 

I next considered whether the Ministry had disclosed the complainant’s personal information in accordance with Part II.  The Ministry stated that the purpose for which the personal information was requested was clearly a research purpose, as set out in the following definition in IPC Orders P-666 and M-336.

 

Research means a systematic investigation into and study of materials and sources in order to establish facts and reach new conclusions and endeavour to discover new or to collate old facts by scientific study or by a course of critical investigation.

 

Having reviewed the research agreement and the survey design proposal, I accept the Ministry’s submission that the purpose for which the personal information was requested was a research purpose, as defined above.

 

The Ministry submitted that it had complied with the three conditions set out in section 21(1)(e) as follows:

 

Condition (i)

 

The Ministry submitted that the information in the Registered Persons Database is collected directly from individuals when they apply for Ontario Health Insurance Plan (OHIP) coverage. The Ministry further submitted that individuals who apply for OHIP coverage are provided with a notice of collection of their personal information as required under section 39(2) of the Act.  (See Appendix B for full text.)

 

The Ministry submitted that its notice states in part:

 

Collection of the personal information as described on this form is for the determination of eligibility for health coverage, health planning and co-ordination, and the administration of the Health Insurance Act  and Ontario Drug Benefit Act .  The authority for the collection and use of this information is the Health Insurance Act, R.S.O. 1990, c.H.6 s.4 (.1(1) and (2) and the Ontario Drug Benefit Act, R.S.O. 1990, c.O.10,s.13(1)  and (2) ...[emphasis added]

 

The Ministry stated that the specific language and statutory language of the notice have been amended over the years.  However, the notice has always advised that “health planning and co-ordination” were included as two of the purposes for which the information was being collected on OHIP application forms.

 

The Ministry submitted that the individuals selected for the survey were advised through this notice that information was being collected for, among other things, “health planning and coordination.”  The Ministry submitted that the use of the information to plan programs and services to address nutrition issues was consistent with the reasonable expectations of those providing the information.

 

The above notice does not specifically state that the personal information collected on OHIP application forms might be used for research purposes.  However, individuals who received the above notice stating that the collection of personal information was also for “health planning and coordination” might reasonably have expected that their personal information may be used or disclosed for a purpose related to health planning or coordination.

 

In this case, the personal information was disclosed for the purposes of conducting a survey related to a health matter, i.e., involving nutritional issues. Therefore, it is my view that the disclosure of the survey participants’ personal information was consistent with the reasonable expectations under which the personal information was collected.  Accordingly, it is my view that the Ministry met the terms of the first condition under section 21(1)(e).

 

Condition (ii)

 

The Ministry submitted that because the research project was to be conducted by survey, the research purpose could not reasonably be accomplished unless the information was provided in individually identifiable form.  The Ministry stated that each survey participant was given a unique identifier and a document then created which matched the unique identifier with the name and address of the individual.  The survey forms themselves did not contain the name of the individual participants, only their unique identifier.

 

Under some circumstances, it is possible to accomplish a research purpose by providing coded information or information that has been stripped of all personal identifiers.  Such methods provide very strong privacy protection for the individuals involved.  However, in the circumstances of this case, the research method required that personal interviews be conducted with survey respondents in order to ask additional questions about their eating habits. Follow-up interviews were also planned in some cases.

 

It is my view that the researchers would not have been able to contact the individuals selected at random by the Ministry for the purposes of conducting the initial and follow-up interviews without having information before them that identified the individuals involved. Therefore, the research purpose could not have reasonably been accomplished unless the Ministry had provided the information in personally identifiable form. Accordingly,  it is my view that the Ministry met the terms of condition (ii) of section 21(1)(e) of the Act when it provided the information to the Principal Investigator in personally identifiable form.

 

I should emphasize, however, that those individuals contacted by the Principal Investigator to participate in the survey were free to decline.  I feel that the voluntary nature of participating in the survey and the ability to refuse to consent should have been explicitly noted.

 

The letter to the survey participants stated: “you will be...invited to participate in a ninety minute interview...you may also be asked to participate in a second interview...if you are willing to participate, the interviewer will arrange a time to interview you.” Survey participants were also offered a nominal payment to participate.  While the implication of the above is that participating in the survey was voluntary, the letter did not specifically state that participation was voluntary and that individuals were not obligated to participate.  In my view, the survey participants’ right to refuse to consent should have been explicitly set out in the letter so that there could be no question that they were not obligated to participate in any way.

 

Condition (iii)

 

The Ministry submitted that it had reviewed each paragraph of subsection 10(1) of Ontario Regulation 460 (the regulation) to ensure that the terms and conditions relating to security and confidentiality were specifically addressed in the agreement before disclosing the personal information.  The Ministry also stated that the research agreement contained several additional privacy and security provisions extending well beyond the legal requirements of the regulation.

 

Section 10(1) of the regulation states:

 

The following are the terms and conditions relating to security and confidentiality that a person is required to agree to before a head may disclose personal information to that person for a research purpose:

 

1. The person shall use the information only for a research purpose set out in the agreement or for which the person has written authorization from the institution.

 

2. The person shall name in the agreement any other persons who will be given access to personal information in a form in which the individual to whom it relates can be identified.

 

3. Before disclosing personal information to other persons under paragraph 2, the person shall enter into an agreement with those persons to ensure that they will not disclose it to any other person.

 

4. The person shall keep the information in a physically secure location to which access is given only to the person and to the persons given access under paragraph 2.

 

5. The person shall destroy all individual identifiers in the information by the date specified in the agreement.

6. The person shall not contact any individual to whom personal information relates, directly or indirectly, without the prior written authority of the institution.

 

7. The person shall ensure that no personal information will be used or disclosed in a form in which the individual to whom it relates can be identified without the written authority of the institution.

 

8. The person shall notify the institution in writing immediately if the person becomes aware that any of the conditions set out in this section have been breached.

 

I have examined the agreement, comparing its terms with the above requirements. I found that the agreement met the requirements of each of the terms and conditions set out above.  Therefore, in my view, the Ministry met the terms of the third condition of section 21(1)(e) when it entered into a research agreement, meeting the above terms and conditions.

 

The regulation also requires that the agreement relating to the security and confidentiality of personal information to be disclosed for a research purpose, appear in Form 1, the format set out in the regulation. (See Appendix C.) I examined the agreement and found that it was set out in the format described in the regulation, with some additional clauses.

 

Taking all of the above into account, I am satisfied in this particular case that the Ministry properly applied the exception at section 21(1)(e), and that there was no reasonable basis for it to doubt that the section 21(1)(e) exception applied. Accordingly, the head had no reason to believe that the disclosure might constitute an unjustified invasion of the data subjects’ personal privacy.

 

It is my view that the complainant’s personal information was disclosed to the Principal Researcher of the university in accordance with section 21(e) of Part II of the access provisions of the Act.  Since the personal information was disclosed in accordance with Part II, it is also my view that the personal information was disclosed in compliance with section 42(a) of the disclosure provisions of the Act.

 

Conclusion:    The personal information was disclosed in compliance with section 42 of the Act.

 

Other Matters

 

During the course of this investigation, the following matter was also identified which should be brought to the Ministry’s attention.

 

Disclosure of Individuals’ Names and Addresses to Bell Canada

 

I noted that the research agreement contained the following two clauses:

 

[the Principal Investigator] may permit the persons listed ... to disclose the names and addresses of the selected individuals to Bell Canada solely for the purpose of obtaining the telephone numbers of the selected individuals.

Before disclosing the names and addresses of the selected individuals to Bell Canada for the purpose described ...[the Principal Investigator] will enter into an agreement with Bell Canada to ensure that Bell Canada will not disclose the names and addresses of the selected individuals to any other person or use the information for any other purpose other than to provide the telephone numbers to [the Principal Investigator].

 

Almost eight thousand individuals had originally been selected to participate in this survey.  The Principal Investigator later requested access to the personal information of approximately seven thousand additional individuals to compensate for a poor response rate. A supplementary research agreement with terms identical to the original agreement was subsequently entered into by the Ministry and the Principal Investigator.

 

The Ministry stated that no personal information was disclosed to Bell Canada and that the interviewers had located the telephone numbers in the Bell Canada directory.  While I was pleased to learn this, I have serious concerns relating to the research agreement between the Ministry and the Principal Investigator, providing for the above-noted disclosures to Bell Canada, especially given the large number of individuals involved.

 

It is my view that having the interviewers use telephone directories is a much more privacy protective method of obtaining the survey participants’ telephone numbers than entering into an agreement which may have led to the disclosure of the identities of almost fifteen thousand survey participants, to a private sector telephone company.  Since the interviewers managed to find the required telephone numbers through the use of directories, the disclosure of this personal information to Bell Canada would have been unnecessary to accomplish the purpose of the survey.

 

I recommend that in future, prior to permitting the release of personal information to private sector companies not covered by the Act, every other means of obtaining the needed information first be exhausted.

 

SUMMARY OF CONCLUSIONS

 

∙           The information in question was the complainant’s “personal information,” as defined in section 2(1) of the Act.

 

∙           The personal information was disclosed in compliance with section 42 of the Act.

 

 

 

 

 

Original signed by:                                                                              December 15, 1998                                      

Ann Cavoukian, Ph.D.                                                 Date

Commissioner

 

***