Privacy Reports
Decision Information
The Office of the Information and Privacy Commissioner (the IPC) received a complaint on behalf of an injured worker who had been contacted by the Angus Reid Group (ARG) and asked to participate in a customer satisfaction survey being conducted on behalf of the Workplace Safety and Insurance Board (WSIB). The complainant contends that WSIB did not have statutory authority to disclose injured workers' personal information to ARG. The complainant is also concerned that the ARG surveyor who telephoned the household to speak to the injured worker, disclosed to a family member the fact that the complainant is an injured worker. According to the complainant, the family member had up to that point been unaware of this fact.
We initiated an investigation into the conduct of the WSIB customer satisfaction survey pursuant to our responsibilities under the Freedom of Information and Protection of Privacy Act (the Act). The investigation included interviews with staff at both WSIB and ARG.
Decision Content
INVESTIGATION REPORT
INVESTIGATION PC-000020-1
Workplace Safety and Insurance Board
February 9, 2001
INTRODUCTION:
The Complaint
The Office of the Information and Privacy Commissioner (the IPC) received a complaint on behalf of an injured worker who had been contacted by the Angus Reid Group (ARG) and asked to participate in a customer satisfaction survey being conducted on behalf of the Workplace Safety and Insurance Board (WSIB). The complainant contends that WSIB did not have statutory authority to disclose injured workers’ personal information to ARG. The complainant is also concerned that the ARG surveyor who telephoned the household to speak to the injured worker, disclosed to a family member the fact that the complainant is an injured worker. According to the complainant, the family member had up to that point been unaware of this fact.
We initiated an investigation into the conduct of the WSIB customer satisfaction survey pursuant to our responsibilities under the Freedom of Information and Protection of Privacy Act (the Act). The investigation included interviews with staff at both WSIB and ARG.
SURVEY RESEARCH - OVERVIEW
In 1998, the Ontario Provincial Service Restructuring Secretariat asked ministries to assess their services to the public and to subsequently develop action plans to improve any detected service gaps. Given the anticipated volume of survey research and that survey research may involve the collection, retention, use, disclosure and disposal of personal information, the Information and Privacy Commissioner collaborated with the Ministry of Labour and the Corporate Freedom of Information and Privacy Office of Management Board Secretariat to develop the paper Best Practices for Protecting Individual Privacy in Conducting Survey Research. What follows are excerpts from that paper:
As government institutions strive to become more efficient, accountable and customer focussed, they are more frequently undertaking survey research to elicit input on their programs and services. While survey research can be an important tool in shaping programs and services, it may involve the collection, retention, use, disclosure, and disposal of personal information.
Whenever provincial and local government institutions collect, retain, use, disclose, or dispose of personal information, they are required to comply with the privacy protection provisions of the Acts, and their regulations.
BACKGROUND:
The Workplace Safety and Insurance Board
The Workplace Safety and Insurance Board (formerly the Workers Compensation Board) operates under the authority of the Workplace Safety and Insurance Act, 1997 (WSIA). WSIB oversees Ontario’s workplace safety education and training system and administers the province’s no-fault workplace insurance for employers and their workers. WSIB provides disability benefits, monitors the quality of health care, and assists in early and safe return to work for workers who are injured on the job or contract an occupational disease.
When the governing legislation changed in 1997, WSIB implemented a new service delivery model aimed at improving the efficiency and effectiveness of their programs. In this context, and as part of its commitment to listen to its clients, WSIB retained ARG in 1999 to conduct a survey to determine the needs and views of both injured workers and employers. WSIB plans to conduct these surveys on an annual basis.
The results from the 1999 workers’ customer satisfaction survey served as a baseline for the 2000 survey, which began in May, 2000. It is the 2000 survey (the survey) that gave rise to this complaint.
The survey
WSIB states that it decided to hire an outside agency, ARG, to conduct the survey in response to stakeholder concerns that if WSIB itself conducted the survey, it could run the risk of merging client views and opinions in the actual claims files, resulting in adverse decisions on benefit eligibility.
For the purpose of conducting the survey, WSIB disclosed a CD-ROM to ARG in June 2000, which contained the following information on each of approximately 90,000 injured workers who had experienced a workplace accident during the period April 1999 to May 2000:
• name
• phone number
• city
• postal code
• industry sector/small business group
• WSIB claim number
• date of accident
It is important to note that WSIB did not disclose any injured workers’ medical information or claim status information to ARG.
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information disclosed to ARG “personal information” as defined in section 2(1) of the Act? If yes,
(B) Was the disclosure of the personal information from WSIB to ARG in compliance with section 42 of the Act?
RESULTS OF THE INVESTIGATION:
Issue A: Was the information disclosed to ARG “personal information” as defined in section 2(1) of the Act?
Section 2(1) of the Act states, in part, that “personal information” means recorded information about an identifiable individual, including,
...
(c) any identifying number, symbol or other particular assigned to the individual,
(d) the address, telephone number, fingerprints or blood type of the individual,
...
(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
I find that the information in question clearly satisfies the requirements of the definition of “personal information” contained in one or more of paragraphs (c), (d) and (h) of section 2(1) of the Act. WSIB does not dispute this finding.
Conclusion: The information disclosed to ARG was “personal information” as defined in section 2(1) of the Act.
Issue B: Was the disclosure of the personal information from WSIB to ARG in accordance with section 42 of the Act?
Section 42 of the Act sets out the rules for the disclosure of personal information other than to the individual to whom the information relates. This section provides that an institution shall not disclose personal information in its custody or under its control, except in the circumstances listed in sections 42(a) through (n).
WSIB’s submissions on the issue of disclosure are focussed on sections 42(c) and (e) of the Act.
Disclosure in accordance with section 42(c)
Section 42(c) reads as follows:
An institution shall not disclose personal information in its custody or under its control, except,
for the purpose for which it was obtained or compiled or for a consistent purpose;
The term “consistent purpose” is defined in section 43 of the Act as follows:
Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might reasonably have expected such a use or disclosure.
WSIB submits that:
Where personal information is collected on behalf of an institution, section 39(2)(b) of [the Act] requires an institution to notify the individual of the principal purpose(s) for which the personal information is intended to be used. That requirement does not extend to the allowable disclosure provisions in section 42 of [the Act].
At the time of the 2000 survey, the notice which had been in effect for the previous year (contained on the Worker’s Report of Injury/Disease Form 6) stated:
Personal information relating to you will be collected throughout your claim under the authority of the Workplace Safety and Insurance Act, and will be used to administer your claim and programs of the Board. Medical and non-medical information is collected from health care providers, vocational agencies, labour market service providers, employers, witnesses and others as required.
I do not dispute the WSIB’s position that, at the time of collecting personal information from injured workers, it provided these individuals with the required notification outlining the principle purposes for which the personal information, that is, to administer claims and programs of the Board. The issue in this investigation does not relate to this collection, but to the disclosure of this personal information to ARG for the purpose of conducting the survey.
WSIB’s notice provision went on to state the following:
Information may be disclosed to the employer, external medical, vocational, safety agencies and others as authorized by the Workplace Safety and Insurance Act and the Freedom of Information and Protection of Privacy Act.
While this notice states that information may be disclosed to a number of bodies in the context of processing claims and administering programs, the list of intended recipients of workers’ personal information does not include third party researchers conducting customer satisfaction surveys.
In WSIB’s discussion of section 42(c) they also refer to the requirements of section 45(d) and (e) of the Act which require the responsible minister to publish a personal information bank index setting forth, among other things, how the personal information is used on a regular basis (section 45(d)) and to whom the personal information is disclosed on a regular basis (section 45(e)). In this regard, WSIB submits:
Despite the legislative requirements of sections 39(2) and 45, the WSIB has included a number of principal disclosure practices to better inform the individual about the WSIB’s use and disclosure of their personal information. In the WSIB’s view, it would be misleading to list all possible disclosures on the Notice of Collection because that would alarm injured workers who would reasonably conclude that the WSIB intends to disclose their sensitive personal or medical information on a regular basis. Workers may erroneously decide not to make a claim with the WSIB and thereby prejudice their interests.
In my view, based on the wording of the notification in place at the time of the 2000 survey, injured workers would not have had a reasonable expectation that their personal information would be disclosed to a third party research organization. Previous investigation reports of this Office have stated that the reasonableness of an expectation of disclosure should be assessed at the time the personal information is collected from the individual (see Investigation I96-051P). More recently, in Investigation I98-014P, this Office found that disclosure of personal information for a customer satisfaction survey connected with the larger business or operational purposes of an institution would only have been “reasonably expected” if individuals had been informed at the outset that the institution might be undertaking a survey of this nature.
Although WSIB’s entry in the provincial Directory of Records does mention “researchers” as users of claim files, in my view, this is not sufficient to constitute reasonable notice of disclosure for the purpose of conducting the ARG survey. Furthermore, even if it could be successfully argued that the Directory of Records description was sufficient, relying on injured workers to discover this Directory on their own initiative is not a reasonable expectation.
For these reasons, I find that injured workers providing personal information to the WSIB in the context of claims for benefits under the WSIA would not reasonably expect that this information would be provided to ARF, based on the notices provided on Form 6 or included in the Directory of Records.
Accordingly, I find that the disclosure of personal information to ARF was not in accordance with section 42(c) of the Act.
Disclosure in accordance with section 42(e)
Section 42(e) reads as follows:
An institution shall not disclose personal information in its custody or under its control, except,
for the purpose of complying with an Act of the Legislature or an Act of Parliament or a treaty agreement or arrangement thereunder;
In Investigation I94-023P, this Office found that for section 42(e) to apply, the statute in question must impose a duty on the institution to disclose the individual’s personal information; a discretionary ability to disclose is not sufficient. The report states:
It is our view that the word ‘complying’ in section 42(e) indicates that the requirement in question must be mandatory in nature. [emphasis added]
This interpretation has been adopted and consistently applied in many reports since that time (see for example, Investigations I94-095P and I94-057M).
WSIB maintains that the notice in effect at the time of the disclosure to ARG satisfied the requirements of section 42(e). As quoted earlier, the relevant portion of that notice states:
Information may be disclosed to the employer, external medical, vocational, safety agencies and others as authorized by the Workplace Safety and Insurance Act and the Freedom of Information and Protection of Privacy Act.
WSIB submits:
[The WSIA] does not restrict the WSIB’s authority to disclose personal information. Under section 159(2) of the WSIA, WSIB has the powers of a natural person. This includes the power to enter into contracts. It is the WSIB’s position it has the authority to enter contracts that meet the requirements of the Act and that the contract with ARG complies with those requirements.
WSIB’s authority to enter into a contract is not at issue in this complaint.
Section 159(2) of WSIA does not expressly authorize the disclosure of personal information to a third party in order to conduct a customer satisfaction survey. WSIB argues that an express provision is not necessary, stating:
[WSIB] submits that it is not reasonable to expect the legislation to specifically require the disclosure of personal information to a third party in order to conduct a customer satisfaction survey.
[WSIB] has the power under its own legislation to release personal information. In this case, it did so by signing an agreement with [ARG] that included the confidentiality provisions required by [the Act], and thus, complied with the legislation. [WSIB’s emphasis]
The position put forward by WSIB, even when considered in light of the documentation provided by the WSIB in response to receiving a draft copy of this report, does not meet the requirements of section 42(e) outlined above. WSIB has not identified any statutory provision that requires a disclosure for the purpose of conducting a survey of this nature and, for that reason, I find that the disclosure of personal information to ARG was not in accordance with section 42(e) of the Act.
In my view, the proper way for WSIB to have proceeded in this case would have been to restrict the amount of personal information disclosed to ARG to only that which was necessary in order to conduct the survey (ie., name, telephone number and industry sector/small business group) and to have notified the injured workers that their personal information would be disclosed to ARG for this purpose.
Conclusion: The disclosure of personal information from WSIB to ARG was not in accordance with section 42 of the Act.
SUMMARY OF CONCLUSIONS:
In summary, we conclude that:
• The information disclosed to ARG was “personal information” as defined in section 2(1) of the Act.
• The disclosure of personal information from WSIB to ARG was not in accordance with section 42 of the Act.
OTHER MATTERS:
Disclosure to the complainant’s family member
The survey methodology used by ARG required surveyors to make five attempts to reach an individual if there was either no answer or a busy signal. If an injured worker was contacted and refused to participate in the survey, this person would be immediately eliminated from the survey sample. If someone other than the injured worker answered the telephone, the surveyor was expected to reveal that the call was being made by ARG, but was not supposed to identify the subject matter of the survey. If the injured worker was not available to come to the telephone, the surveyor was expected to reschedule the phone call at a time when the injured worker would be available.
It would appear that this methodology was not followed in the complainant’s case.
According to the complainant, the injured worker was contacted by an ARG surveyor but refused to participate in the survey. However, the surveyor called the household again the next day and the injured worker’s daughter answered the telephone. The surveyor identified herself as calling from ARG to do a survey on behalf of WSIB on injured workers, and then asked to speak to the injured worker by name. The injured worker was not home at the time, and to our knowledge was not contacted by ARG again. However, according to the complainant, the daughter had not previously known that her parent was in receipt of injured worker benefits until made aware of this fact by the ARG surveyor.
There is no dispute that this incident should not have occurred. WSIB states that it sincerely regrets this unfortunate incident. WSIB also states, and ARG confirms, that when this incident was brought to the attention of WSIB, officials immediately contacted ARG who in turn took corrective action to ensure that this type of situation would not happen again.
ARG and WSIB also made revisions to the survey script, in accordance with suggestions made by this Office during the course of completing this investigation. These changes included: (a) specific instructions to the surveyors not to discuss the survey topic with anyone other than the injured worker; (b) an explanation to the injured worker that his or her response will be anonymized and aggregated so that it will not be possible for WSIB to identify the worker and that therefore participation in the survey cannot affect the worker’s claim; and (c) seeking the injured worker’s consent to participate in the survey.
Contract between WSIB and ARG
The Advisory Services Agreement in place between WSIB and ARG for the purpose of the survey binds ARG to the privacy protection provisions of the Act. The agreement also includes specific provisions on confidentiality, records management, security, use, disclosure, retention and disposal of personal information. Although the disclosure to ARG was not in accordance with the Act, it is significant to note that WSIB did take steps to ensure that, once disclosed, the personal information was afforded the protections of the Act.
Conduct of the survey
The protocol used by ARG in conducting the survey also took into account privacy considerations.
When ARG received the CD-ROM from WSIB it loaded the following information on to its sample management system:
• industry sector/business team
• name
• phone number
• city
• postal code
(ARG states that it required only the first three items, but kept the city and postal code in case there were changes in the survey.)
After loading the information into the sample management system, WSIB advises that the CD-ROM was returned by ARG.
Individual ARG surveyors only had access to the name of the injured worker, which was stored in the computer and fed electronically to the surveyor as the calls were made. The surveyor entered the industry sector/business team, and the automated system dialled the telephone number. As soon as the surveyor started to record answers to the questionnaire on the computer screen, the name of the injured worker disappeared from view. The name was not recorded on the questionnaire itself, thereby ensuring that the injured worker’s views and opinions remained anonymous.
In addition, our investigation was able to confirm that all survey results reported by ARG to WSIB for the 1999 survey were in aggregate non-identifiable form, and that the parties intended to follow this same protocol for the 2000 survey.
Extent of the disclosure
Despite having concluded that disclosure to ARG was not in accordance with the Act, it is nonetheless important to go on and examine the extent of the disclosure, because WSIB intends to conduct a similar survey in 2001.
The extent of the disclosure of the injured workers’ personal information to ARG during the 2000 survey is troubling for two reasons: (1) the amount of each injured worker’s personal information that was disclosed; and (2) the sample size used for the survey.
A. Amount of injured workers’ personal information disclosed
The CD-ROM sent to ARG contained the following information about each injured worker:
• name
• phone number
• city
• postal code
• industry sector/small business group
• WSIB claim number
• date of accident
ARG states that the only information it required to obtain the sample for the 2000 survey was the injured worker’s name, telephone number and industry sector/small business group. ARG explains that the 1999 survey required the city and postal code, because the unit of analysis was intended to be by Ontario regions. However, during the course of the 2000 survey, the unit of analysis was changed to industry sector/small business group, thereby reducing the amount of information required for survey purposes.
In fact, the Advisory Services Agreement stipulates that WSIB was to provide the name and telephone number, and no other personal or confidential information associated with the worker’s claim. Although there is no indication that WSIB provided any personal information associated with the workers’ claim per se, it did disclose significantly more personal information than was stipulated in the agreement or in fact needed by ARG. WSIB should have restricted the disclosure of personal information to that which was necessary for the purpose of conducting the survey.
B. Sample size used for the survey
WSIB wanted the survey results to be based on responses from 3,000 injured workers. According to ARG, the industry standard sample size for a survey of this nature is a minimum of ten times the number of responses required. This means that ARG would require information concerning a minimum of 30,000 injured workers in order to conduct the survey, although ARG also states that they would prefer more than the minimum.
As noted earlier, the CD-ROM provided by WSIB to ARG contained personal information of approximately 90,000 injured workers. Even taking into account ARG’s preference for more than the minimum sample size, in my view, providing ARG with three times the minimum was excessive. In order to minimize the amount of personal information disclosed to ARG, WSIB should have restricted the sample size to the number of injured workers reasonably required in order to complete the survey.
Notice
WSIB has provided this Office with a draft amended notice of collection, which it intends to send to each individual injured worker that will be part of the 2001 survey. It provides that the injured worker’s name, telephone number, city and postal code to be disclosed to ARG for the purpose of the upcoming survey, despite the fact that the agreement between WSIB and ARG governing the 2000 survey stipulates that only the name and phone number are required. This discrepancy should be resolved by WSIB and ARG prior to undertaking the 2001 survey, and only the personal information necessary for the purposes of the survey should be identified in the notice and disclosed to ARG.
RECOMMENDATIONS:
1. WSIB should attach or link a record of the personal information disclosed to ARG in the context of conducting the 2000 survey to all WSIB’s injured workers personal information, pursuant to section 46(1)(b) of the Act.
2. WSIB should provide injured workers with the required notice of the purpose for which the personal information is intended to be used, pursuant to section 39(2) of the Act, at the time the personal information is collected.
3. WSIB should limit the amount of personal information disclosed to ARG for the purpose of conducting any future survey to that which is necessary in order to conduct the survey, and to reflect these limitations in the terms of any agreement between WSIB and ARG.
4. Before conducting any future survey with individual injured workers, WSIB/ARG should provide these individuals with sufficient information about the research project and obtain informed consent before proceeding.
The WSIB should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations no later than May 12, 2001.
Original signed by: February 9, 2001
Tom Mitchinson Date:
Assistant Commissioner