INVESTIGATION REPORT

 

 

INVESTIGATION PC-000018-1

 

 

Ministry of the Attorney General

 

 

 

 

 

 

 

October 18, 2000

INTRODUCTION:

 

The Family Responsibility Office

 

The Family Responsibility Office (FRO) is part of the Ministry of the Attorney General.  FRO operates under the authority of the Family Responsibility and Support Arrears Enforcement Act, 1996 to:

 

•           collect support payments on behalf of recipients;

•           enforce court-ordered support payments;  and

•           enforce certain domestic contracts and paternity agreements filed with the court.

 

FRO has approximately 172,000 cases.  Most cases have three parties who have related but mutually exclusive interests:

 

•           the support payor (the payor);

•           the support recipient (the recipient);  and

•           the income source, which is often, but not always, an employer.

 

Each day, FRO mails more than 6,000 pieces of case-related correspondence.  These letters and notices are sent to the three parties, as well as to lawyers, the courts, and others involved with the administration of the program. Many of the mailings sent by FRO are processed by an envelope stuffing machine that inserts a single document into a single envelope.  However, certain types of documents, including an individually requested Statement of Arrears (Form 35A), may be manually  inserted into envelopes.  A Form 35A may or may not be accompanied by a letter.

 

Background of the Complaint

 

Payors and recipients may request copies of their own Statement of Arrears from FRO.  A payor made such a request in June 2000.  At about the same time, a lawyer from FRO’s Legal Department made an internal request for a Statement of Arrears for a different recipient-payor pair.  This second Form 35A was placed in an envelope addressed to the requesting payor.

 

After receiving the envelope containing the wrong Form 35A, the payor reported the incident to his Member of Provincial Parliament (MPP).  On  June 26, 2000, the Director of FRO received written notification of the disclosure and the Form 35A from the MPP.

 

On June 27, 2000, the Director of FRO called this office, asking that we undertake an investigation into what appeared to be an unauthorized disclosure of personal information by FRO.  We immediately initiated an investigation pursuant to our responsibilities under the Freedom of Information and Protection of Privacy Act (the Act).

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information "personal information" as defined in section 2(1) of the Act?

 

(B)       Was the disclosure of the personal information in accordance with section 42 of the Act?

 

 

RESULTS OF THE INVESTIGATION:

 

Issue A:          Was the information "personal information" as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

(c)        any identifying number, symbol or other particular assigned to the individual,

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

...

(h)        the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

We reviewed the Form 35A and its attached Schedule A which had mistakenly been mailed to the payor.  These records contain the names of the unrelated recipient and her payor-partner; the address of the recipient; the case number; the court that issued the support order; and the payor-partner’s payment history, including the total amount of arrears owing.

 

We find that the records clearly contain the "personal information" of the both the recipient and her payor-partner as defined in sections 2(1) of the Act.  The records do not contain any "personal information" of the payor who received the wrong Form 35A.

 

Conclusion:    The information in question was "personal information" as defined in section 2(1) of the Act.

 

 

Issue B:           Was the disclosure of the personal information in accordance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.  None of these circumstances were present in this case.  Accordingly, we find that the disclosure of the personal information by FRO was not in compliance with the Act.

 

Conclusion:    The disclosure of personal information was not in compliance with section 42 of the Act.

 

 

OTHER MATTERS:

 

How did the Form 35A from one case file end up being mailed to an unrelated payor?

 

On June 16, 2000, a payor called FRO and asked for a copy of his Statement of Arrears. The staff person who received the call completed the required processing request form and submitted it through FRO’s “overnight batch” procedure.  As part of this procedure, the staff person was required to generate the Form 35A from FRO’s database, but she neglected to do so. The staff person also addressed an envelope to the payor and submitted it, along with the processing request form, to the Document Processing Team who are responsible for stuffing envelopes and completing mailouts after the forms have been produced. Because the Form 35A is generated from the database under a separate process, the processing request form and the envelope are used by the Document Processing Team to match the envelope to the document before mailing.

 

The envelope was received by a staff person from the Document Processing Team.  This person inadvertently placed the unrelated Form 35A requested by the Legal Department into the envelope addressed to the payor.  This resulted in the payor receiving a Form 35A which included details of payment arrears involving a different recipient-payor pair.

 

The Document Processing Team has a "check point" procedure by which:

 

(a)        the envelope is checked against the name on the Form 35A; and

 

(b)        the processing request form is verified against the case number and file number which are encoded and printed at the bottom of the Form 35A.

 

This procedure was not followed in this case.

 

FRO also has a draft procedure manual for the Document Processing Team, which includes the “check point” procedure.  Although the manual has not yet been finalized and issued to the team, staff members were involved in its development and are aware of the “check point” procedures.

 

Steps taken by the FRO in response to the disclosure

 

As soon as FRO learned of the improper disclosure of personal information on June 26, 2000, the Director notified both her Assistant Deputy Minister and this office. 

Between June 26-28, FRO also took the following steps:

 

1.         Contacted the payor

 

Immediately after receiving written notification from the MPP on June 26, a FRO Client Service Manager called the payor and left a voice mail message.   Because it was after regular office hours, the Manager also left a cell phone contact number.  The Manager and payor spoke the next day.  The Manger obtained details of the disclosure;  confirmed that the payor had not disclosed the information to anyone else; advised the payor that, because his requested Form 35A had not in fact been produced, it had not been disclosed to anyone;  and asked that he return the courier envelope to FRO.  The actual Form 35A had already been returned to FRO by the MPP.

 

2.         Notified the recipient and her payor-partner

 

On June 27, the Manager spoke to the recipient by telephone and provided her with a detailed account of what had happened.  The Manager told the recipient that she would receive a new case number.  Follow-up letters were sent by the Manager to both the recipient and her payor-partner explaining what had occurred.

 

3.         Changed the case number

 

The recipient’s case file was assigned a new case number on June 28.  The case number is a unique identifier assigned by FRO to a case file.  The payor and recipient for a particular case file have the same case number.  Payors and recipients are able to call a FRO automated call centre, enter the case number, and obtain basic account information about their file, such as balance owing, amount/date of last payment, answers to common questions, and enforcement activity to date. Once a new case number was assigned, the disclosed case number could no longer be used to access information through the FRO automated call centre. The recipient and her payor-partner were also informed that their file was being transferred to a designated Client Services Associate responsible for handling files for which the case number had been changed.

 

                        Reviewed procedures with staff

 

Procedures from the draft procedures manual were reviewed with the Document Processing Team.

 

5.         Revised processing request form

 

FRO revised the internal processing request form to ensure that more checks are being done prior to mailing of documents.  The revised form is more detailed and requires that information on the envelope attached to the form be checked to ensure that it matches the information requested on the form.  If a Form 35A is being sent to someone other than the payor or recipient, the name of this individual must be identified on the request form which is matched to the name on the envelope.

 

CONCLUSIONS:

 

We commend FRO staff for their prompt response when learning of the potential improper disclosures of personal information, and for seeking the assistance of this office. 

 

We have reached the following conclusions based on the results of our investigation:

 

1.         The names and addresses of recipients and payors, and details of their financial transactions, are particularly sensitive types of personal information.  This information must be handled with extra care and attention to detail.

 

2.         Although a checking procedure for verifying addresses on manually processed correspondence was in place, it was not followed.

 

3.         The huge volume of mail processed by FRO on a daily basis, whether automated or manual, increases the potential for human error.

           

 

RECOMMENDATIONS:

 

The following is a list of recommendations based on our investigation.

 

1.         Because of the potential for human error, manually inserted mailings should be subject to checking procedures at several stages so that if an error is missed at one stage in the process or a check point is accidentally by-passed, there are other opportunities to correct the mistake.

 

2.         We recommend that FRO develop written policies and procedures for mail room staff to follow that include mechanisms for ensuring privacy protection.  This should include, at a minimum, procedures followed by the Document Processing Team who handle the distribution of Form 35As.  Documents containing the name and address of a client should be flagged and subject to particularly strict security protocols and procedures.

 

3.         Given the enormous size of FRO’s client base and the highly sensitive personal information contained in FRO program files, we recommend that all FRO program and mail room staff be given ongoing training on both the access and privacy provisions of the Act.  Special attention should be given to the training needs of temporary employees.

 

4.         In order to identify the full scope of potential privacy concerns within the operation of FRO programs, we recommend that FRO undertake a comprehensive privacy audit.

 

This Office would be pleased to assist with any of the above recommendations.

 

Within three months of receiving this report, the Ministry of the Attorney General should provide the Office of the Information and Privacy Commissioner with proof of compliance with Recommendations 1 through 4.

 

 

 

 

 

 

 

 

Original signed by:                                                                         October 18, 2000                                                  

Tom Mitchinson                                                         Date

Assistant Commissioner