Privacy Reports
Decision Information
SUMMARY OF COMMISSIONER-INITIATED COMPLAINT: The Office of the Information and Privacy Commissioner (the "IPC") received a telephone call from the London Police Service ("London Police") regarding a possible disclosure of personal information. More particularly, London Police advised the IPC that it had accidentally released to a requester, a copy of a document containing the personal information of individuals other than the requester. On the basis of this telephone call, the IPC initiated an investigation under the Municipal Freedom of Information and Protection of Privacy Act (the Act). DISCUSSION: During the investigation, the following information was obtained as a result of discussions with the London Police's Freedom of Information Coordinator ("FOI Co-ordinator") and written materials provided to our office. Background London Police had received a request under the Act for a copy of an occurrence report. The individual requesting the report (the "requester") indicated to London Police that he was only interested in the information in the report that pertained to him and that he was not interested in information pertaining to other individuals. As a result, London Police decided to release to the requester a severed version of the report, deleting the personal information of individuals other than the requester. Having prepared the severed version of the report, London Police subsequently notified the requester that his records package was ready and that he could come by any time during office hours to pick up the package. London Police's procedures require that the Freedom of Information Analyst (the "FOI Analyst") place the records being released to a requester in an envelope together with the decision letter, and then place the envelope in the bottom shelf of the filing cabinet. The procedures also require that the person retrieving the package from the filing cabinet check the contents of the package to ensure that what is being released is in fact the severed copy. In this case, when the requester attended at London Police's office to pick up his package, it was lunch hour and both the FOI Co-ordinator and FOI Analyst were out of the office. An individual from the Records Department, who fills in at reception when the usual back up person is not available, was handling the reception desk. When the receptionist went to retrieve the package from the filing cabinet, she found the requester's file containing both the severed and unsevered report, but no records package for the requester. The receptionist tried to contact the FOI Analyst at home, but could not reach her. She also tried to contact the individual who usually fills in at reception, but could not reach her either. The receptionist ultimately decided to prepare the records package herself, rather than ask the requester to wait or return later. She placed both the unsevered and severed copy of the occurrence report in an envelope, which she then gave to the requester. The FOI Analyst and Co-ordinator learned of the error when they returned to the office about an hour later. Steps Taken by London Police Upon learning of the error, the FOI Co-ordinator immediately instructed the FOI Analyst to call the requester and advise that they would be sending a police officer to the requester's residence to retrieve the package. Upon receiving the call, the requester volunteered to personally return the package. About 30 minutes later, the requester attended at London Police's office and returned the package. The FOI Co-ordinator also contacted the IPC that same day to advise of the incident. In a follow up conversation the next day, the IPC suggested that the FOI Co-ordinator specifically ask the requester whether he had viewed or had copied the unsevered document and whether he would be willing to swear an affidavit. The FOI Co-ordinator later called the requester, who advised her that he had neither viewed nor copied the documents and further indicated that he was willing to swear an affidavit to that effect. The requester did later swear an affidavit, stating that during the time the documents were in his possession and prior to returning them to London Police, they remained in his personal automobile and that he did not have the opportunity to view them. London Police indicated that based on this affidavit, no personal information had been disclosed to the requester and no benefit would be served in notifying the individuals whose information had been contained in the report. In addition to the above steps, the FOI Co-ordinator obtained reports from the staff involved and notified the Superintendent of London Police of the incident. She also spoke with the staff directly and reminded them of the FOI procedures and the distinctions between severed and unsevered documents. According to the FOI Co-ordinator, individuals who work in the FOI office, including those from other departments who provide reception back up, receive training in FOI procedures and issues. The FOI Coordinator also advised that although there is no memo posted at reception regarding pick-up of FOI documents, the FOI manual is located near the reception desk, to assist staff who may be filling in at reception. The FOI Co-ordinator indicated that the error had occurred as a result of staff not having followed the proper procedures regarding preparing and pick-up of records. She advised the IPC that as a further measure to prevent similar incidents from occurring in the future, weekly audits would now be conducted (rather than monthly audits) to ensure that the severed documents and decision letters are placed in packages for the requesters. CONCLUSIONS: Where an institution has made a disclosure of personal information, the IPC considers whether the disclosure was in accordance with section 32 of the Act . The circumstances of this case are unique. Although it is clear that the envelope provided to the requester contained personal information as defined by section 2(1), I am not persuaded that this personal information was actually disclosed to him. Based on the information provided by the London Police and the contents of the requester's sworn affidavit, in my view, it is reasonable to conclude that the requester did not view the personal information contained in the records. The envelope containing this information was in his exclusive possession during the short period of time between its release to the requester and its return to the London Police. The requester is the only person who could potentially have viewed the personal information during this time period, and he swears that he did not. It appears that the requester cooperated fully with the London Police, and that the error on their part was corrected quickly, without compromising the privacy interests of any other individual. Given the particular and unique circumstances of this
Decision Content
PRIVACY COMPLAINT REPORT
PRIVACY COMPLAINT NO. MC-010026
INSTITUTION: London Police Service
SUMMARY OF COMMISSIONER-INITIATED COMPLAINT:
The Office of the Information and Privacy Commissioner (the “IPC”) received a telephone call from the London Police Service (“London Police”) regarding a possible disclosure of personal information. More particularly, London Police advised the IPC that it had accidentally released to a requester, a copy of a document containing the personal information of individuals other than the requester. On the basis of this telephone call, the IPC initiated an investigation under the Municipal Freedom of Information and Protection of Privacy Act (the Act).
DISCUSSION:
During the investigation, the following information was obtained as a result of discussions with the London Police’s Freedom of Information Coordinator (“FOI Co-ordinator”) and written materials provided to our office.
Background
London Police had received a request under the Act for a copy of an occurrence report. The individual requesting the report (the “requester”) indicated to London Police that he was only interested in the information in the report that pertained to him and that he was not interested in information pertaining to other individuals. As a result, London Police decided to release to the requester a severed version of the report, deleting the personal information of individuals other than the requester.
Having prepared the severed version of the report, London Police subsequently notified the requester that his records package was ready and that he could come by any time during office hours to pick up the package.
London Police’s procedures require that the Freedom of Information Analyst (the “FOI Analyst”) place the records being released to a requester in an envelope together with the decision letter, and then place the envelope in the bottom shelf of the filing cabinet. The procedures also require that the person retrieving the package from the filing cabinet check the contents of the package to ensure that what is being released is in fact the severed copy.
In this case, when the requester attended at London Police’s office to pick up his package, it was lunch hour and both the FOI Co-ordinator and FOI Analyst were out of the office. An individual from the Records Department, who fills in at reception when the usual back up person is not available, was handling the reception desk.
When the receptionist went to retrieve the package from the filing cabinet, she found the requester’s file containing both the severed and unsevered report, but no records package for the requester. The receptionist tried to contact the FOI Analyst at home, but could not reach her. She also tried to contact the individual who usually fills in at reception, but could not reach her either. The receptionist ultimately decided to prepare the records package herself, rather than ask the requester to wait or return later. She placed both the unsevered and severed copy of the occurrence report in an envelope, which she then gave to the requester. The FOI Analyst and Co-ordinator learned of the error when they returned to the office about an hour later.
Steps Taken by London Police
Upon learning of the error, the FOI Co-ordinator immediately instructed the FOI Analyst to call the requester and advise that they would be sending a police officer to the requester’s residence to retrieve the package. Upon receiving the call, the requester volunteered to personally return the package. About 30 minutes later, the requester attended at London Police’s office and returned the package.
The FOI Co-ordinator also contacted the IPC that same day to advise of the incident. In a follow up conversation the next day, the IPC suggested that the FOI Co-ordinator specifically ask the requester whether he had viewed or had copied the unsevered document and whether he would be willing to swear an affidavit. The FOI Co-ordinator later called the requester, who advised her that he had neither viewed nor copied the documents and further indicated that he was willing to swear an affidavit to that effect.
The requester did later swear an affidavit, stating that during the time the documents were in his possession and prior to returning them to London Police, they remained in his personal automobile and that he did not have the opportunity to view them.
London Police indicated that based on this affidavit, no personal information had been disclosed to the requester and no benefit would be served in notifying the individuals whose information had been contained in the report.
In addition to the above steps, the FOI Co-ordinator obtained reports from the staff involved and notified the Superintendent of London Police of the incident. She also spoke with the staff directly and reminded them of the FOI procedures and the distinctions between severed and unsevered documents. According to the FOI Co-ordinator, individuals who work in the FOI office, including those from other departments who provide reception back up, receive training in FOI procedures and issues. The FOI Coordinator also advised that although there is no memo posted at reception regarding pick-up of FOI documents, the FOI manual is located near the reception desk, to assist staff who may be filling in at reception.
The FOI Co-ordinator indicated that the error had occurred as a result of staff not having followed the proper procedures regarding preparing and pick-up of records. She advised the IPC that as a further measure to prevent similar incidents from occurring in the future, weekly audits would now be conducted (rather than monthly audits) to ensure that the severed documents and decision letters are placed in packages for the requesters.
CONCLUSIONS:
Where an institution has made a disclosure of personal information, the IPC considers whether the disclosure was in accordance with section 32 of the Act.
The circumstances of this case are unique. Although it is clear that the envelope provided to the requester contained personal information as defined by section 2(1), I am not persuaded that this personal information was actually disclosed to him. Based on the information provided by the London Police and the contents of the requester’s sworn affidavit, in my view, it is reasonable to conclude that the requester did not view the personal information contained in the records. The envelope containing this information was in his exclusive possession during the short period of time between its release to the requester and its return to the London Police. The requester is the only person who could potentially have viewed the personal information during this time period, and he swears that he did not. It appears that the requester cooperated fully with the London Police, and that the error on their part was corrected quickly, without compromising the privacy interests of any other individual.
Given the particular and unique circumstances of this case, I am prepared to accept the position of London Police that no personal information was actually disclosed to the requester, and it is therefore not necessary for me to consider section 32 of the Act. In making this finding it is important to emphasize that the facts of this case are unusual, and my conclusions should not be interpreted as having broader or more generalized application to the more typical circumstance involving a potential disclosure of personal information under section 32, where it is not possible to conclude with certainty that personal information has not been exposed to the risk of improper disclosure through the actions of an institution.
I am satisfied with the measures taken by London Police, once they learned of the error and I commend the FOI Co-ordinator for her prompt action in dealing with this matter. I am also pleased that the FOI Co-ordinator contacted the IPC to advise of the error and seek further assistance from this office.
RECOMMENDATIONS:
I do recommend that as a further measure:
• London Police review its FOI training programs for staff (including temporary and back-up staff) to ensure that its training programs are adequate
• London Police review its written policies and procedures regarding preparation and pick-up of record packages and amend the written policies and procedures accordingly to reflect any changes made
• London Police provide the IPC with proof of compliance with respect to the above two recommendations by May 6, 2002.
Mediator