Privacy Reports

INVESTIGATION REPORT

 

 

INVESTIGATION PC-000025-1

 

 

Legal Aid Ontario

 

 

 

 

 

December 13, 2000

INTRODUCTION:

 

Legal Aid Ontario

 

Legal Aid Ontario (LAO) is an independent agency that was established in late 1998 under the Legal Aid Services Act, 1998 (the LSA).  As part of its statutory mandate, LAO provides legal aid services by a number of different methods, including certificates, staff offices, duty counsel, community legal clinics, public legal education, summary assistance, alternative dispute resolution and self-help materials.  There are legal aid offices in 48 communities across the province.

 

Background of the Complaint

 

A couple visited the Windsor legal aid office for a meeting, and were asked to wait in a conference room.  The wife was looking for some scratch paper to make notes, and found a stack of stapled sheets of paper by the telephone.  She noticed that the backs of these sheets contained various pieces of information, including the names, telephone numbers, birth dates and SIN numbers of individuals, an indication as to whether those individuals were applying for legal aid, and whether they had ever applied before. 

 

After reviewing the sheets to ensure that none of them contained any personal information of either herself or her husband, the wife kept nine sample sheets and later provided them to her local Member of Provincial Parliament (MPP).

 

The MPP wrote to this Office asking us to investigate the matter.  We immediately initiated an investigation pursuant to our responsibilities under the Freedom of Information and Protection of Privacy Act (the Act).

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Is the information "personal information" as defined in section 2(1) of the Act?

 

(B)       Was the disclosure of the personal information in accordance with section 42 of the Act?

 

 

RESULTS OF THE INVESTIGATION:

 

Issue A:          Is the information "personal information" as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

...

 

(c)        any identifying number, symbol or other particular assigned to the individual,

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

...

 

(h)        the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

The sheets of paper are the top portion of a document titled "Information Slip", which is used by LAO to administer certain programs.  They contain the names of nine individuals in combination with some or all of the following information:  address, telephone number, birth date, SIN number, whether they were applying for legal aid, and whether they had applied in the past.

 

I find that the records clearly contain "personal information" of the nine individuals, as defined in sections 2(1)(c), (d) and/or (h) of the Act.

 

Conclusion:    The information in question is "personal information" as defined in section 2(1) of the Act.

 

 

Issue B:           Was the disclosure of the personal information in accordance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.  Having reviewed these sections, I find that none of them apply in the circumstances of this complaint.  The LAO does not dispute this finding.

 

Conclusion:    The disclosure of personal information was not in compliance with section 42 of the Act.

 

How did the disclosure of personal information occur?

 

In an apparent effort to avoid unnecessary costs, the Windsor legal aid office instructed its staff to reuse old documents received from its head office in Toronto, provided that those documents did not contain personal information of clients.  For example, policy memoranda that are available to the public were reused for scrap paper.  LAO believes that a summer student may have misinterpreted the instructions and mistakenly used documents containing personal information of clients to create the scratch pad that was found in the Windsor office's conference room.

 

 

Steps taken by LAO in response to the disclosure

 

Upon being advised of this complaint, the Director of the Windsor legal aid office took the following steps:

           

1.         The remaining parts of the scratch pad were retrieved and shredded.

 

2.         The office confirmed that no other areas accessible to the public contained scratch pads containing clients' personal information.

 

3.         The office also confirmed that no paper used anywhere in the office for scratch pad purposes contained the personal information of clients.

 

4.         The Director drafted and circulated a memorandum to all staff in the Windsor office summarizing what had occurred and reminded staff of their privacy protection responsibilities under the Act.

 

5.         To reduce the risk of a repeat occurrence, the office instituted a policy prohibiting the provision of scratch pads to legal aid clients visiting its office.         

 

After discussions between our office and the LAO's Freedom of Information and Privacy Co-ordinator, the LAO took the following additional action:

 

1.         LAO provided written notification to the nine individuals whose personal information was contained on the scrap pad sheets provided to this Office by the MPP, acknowledging the improper disclosure of their personal information.  LAO apologized for the error and assured these individuals that steps had been taken to correct the problem.  

 

2.         LAO sent a memorandum to all Area Directors, Area Office Administrators and Managers on the subject of "Reuse of Paper and Destruction of Client Files".  The memorandum directed staff to discontinue all reuse of paper and to shred client files or any material containing client information before disposing of it.  The memo specified the locations of the shredders.

 

3.         To reinforce and review the existing policy regarding privacy issues and the interaction of the LSA and the Act, LAO scheduled an information and question and answer session on client confidentiality issues for the Area Administrators Conference in late November 2000. Area Office Administrators throughout the province will be attending this conference.

Recognition of responsibilities under the Act

 

LAO was listed as a scheduled institution under the Act in 1998.  In September 1999, and again in May 2000, LAO sent a memorandum entitled "Freedom of Information and Protection of Privacy" to all Directors and Administrators.  The intent of the memorandum was to assist staff in understanding their new responsibilities under the Act.

 

This memorandum addressed a wide range to issues, including both access to information and the collection, retention and destruction of personal information.  However, the memorandum did not discuss LAO's obligations regarding the proper use and disclosure of personal information (sections 41, 42 and 43 of the Act).

 

 

SUMMARY OF CONCLUSIONS:

 

I commend LAO staff for their prompt response after learning of the improper disclosure of personal information from its Windsor office, and for the steps LAO has taken to address this particular situation and more general privacy issues in LAO offices throughout the province.

 

I have reached the following conclusions based on the results of our investigation:

 

1.         The personal information of nine LAO clients was disclosed in contravention of the Act.

 

2.         There appears to have been a communication breakdown regarding the reuse of paper at the Windsor legal aid office.

 

3.         While this situation may be an isolated occurrence, the fact that it occurred raises concerns about the awareness of all staff regarding the Act and issues pertaining to privacy protection.

 

4.         Although LAO has a written memorandum in place that addresses a number of issues relating to privacy protection, it does not adequately address the proper use and disclosure of personal information.

 

 

RECOMMENDATIONS:

                       

In addition to the initiatives already put into place by LAO, I recommend the following:

 

1.         LAO revise its May 2000 memorandum on the subject of the "Application of the Freedom of Information and Protection of Privacy Act"to include the following:

 

(a)        contents of the October 2000 memorandum on the subject of the "Reuse of Paper and Destruction of Client Files"; and

(b)        discussion of LAO's obligations under sections 41, 42 and 43 of the Act.

 

2.         LAO distribute the revised memorandum to all LAO staff, not just Directors and Administrators.

 

3.         LAO post the revised memorandum on staff bulletin boards in all offices throughout the province.

 

4.         LAO provide new staff with a copy of the revised memorandum as part of an orientation program.

 

5.         LAO establish an ongoing training program for new and current staff on both the access and privacy provisions of the Act, LAO privacy policies, and the interaction of the Legal Services Act and the Act.

 

Within three months of receiving this report, LAO should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

                                               

                                                                                                                       

 

 

Original signed by:                                                                            December 13, 2000                                        Tom Mitchinson

Assistant Commissioner