PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT PC-010008-1

 

 

Ministry of Environment

 

 

 

 

 

 

 

 

October 15, 2001

 

 

 

 

 

 

                                                                 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT  NO.                  PC-010008-1

 

 

 

MEDIATOR:                                                            Kileen Dagg Centurione

 

 

 

INSTITUTION:                                            Ministry of Environment

 

 

 

SUMMARY OF THE COMPLAINT:                  

 

On March 7 and 8, 2001, the Office of the Information and Privacy Commissioner (IPC) received two letters dated February 20, 2001 from the complainant, the essence of which were that the Ministry had violated her privacy by disclosing her e-mail correspondence regarding the hauling of sludge, addressed to the Ministry, to two named companies and to two Sludge Co-coordinators who work in the Ministry’s regional office but who are not provincial employees.  In the course of clarifying the complaint with this office, the complainant also objected to the way in which a Ministry employee answered a telephone call.

 

Disclosure to the company and the sludge hauler

 

The complainant sent an e-mail to a District Manager stating that she understood that a named company was hauling sludge into a particular municipality, and asking the name of the facility it was being hauled to and for what purpose.

 

The District Manager sent the complainant a reply e-mail and copied the reply e-mail to the named company.  He also provided a hard copy of the e-mail to another named individual who was the sludge hauler.  The reply e-mail included the original text of the complainant’s e-mail, her name and her e-mail address.

 

Disclosure to the Sludge Co-ordiantors

 

The same e-mail was also copied to six internal recipients, two of whom held the positions of Sludge Co-ordinators.  The complainant objects to the two Sludge Co-ordiantors receiving copies of the e-mail, claiming that these individuals were neither officers nor employees of the Ministry and were therefore not entitled to disclosure. 

 

Answering the complainants telephone call

 

The complainant states that a Ministry employee answered a Ministry telephone extension with a greeting that included the complainant’s first name [for example, “Hi, (complainant’s name).  The complainant feels that the employee’s use of telephone call display (Caller ID) in that manner was an invasion of her privacy.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Was the information disclosed in the e-mail “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part, that “personal information” means recorded information about an identifiable individual, including:

 

(c)  any identifying number, symbol or other particular assigned to the individual;

 

(f)  correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence; and

 

(h)  the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

I have reviewed the e-mail and reply.  It includes the complainant’s name and

e-mail address in the form of “firstname.lastname@sympatico.ca” with no indication that the e-mail was sent on anyone else’s behalf.

 

The Ministry is of the view that the email did not contain the complainant’s personal information: 

 

…[the complainant] makes requests of or provides information to the Ministry as a representative of specific organizations [named organizations], she is considered to have made the requests in her professional capacity as a consultant, not a private citizen…it is appropriate, and indeed consistent with the past practice and decisions of the IPC that [the complainant’s] name not be considered personal information under FIPPA. 

 

The complainant gave no indication in the e-mail that the inquiry was being made in a professional capacity.  The complainant’s name and e-mail address in the form of “firstname.lastname@sympatico.ca” and the text of the e-mail itself gave no indication to the Ministry that the e-mail was sent on behalf of any organization.

 

In my view, the information in the e-mail qualifies as the complainant’s “personal information” under paragraphs (c), (f) and (h) in the definition of “personal information” at section 2(1) of the Act.

 

Was the disclosure of the personal information by the Ministry in accordance with section 42 of the Act?

 

The disclosure of personal information is regulated by section 42 of the Act, which states, in part:

 

42.  An institution shall not disclose personal information in its custody or under its control except,

 

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(d) where the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties where disclosure is necessary and proper in the discharge of the institution’s functions.

 

Disclosure to the Sludge Co-ordinators

 

I will begin this analysis by considering whether the disclosure to the Sludge Co-ordinators  is permitted under section 42(c).  In interpreting this section, it is important to note the provisions of section 43 of the Act, which states:

 

Where personal information has been directly collected from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might have reasonably expected such a use.

 

The complainant’s original e-mail to the Ministry was an inquiry regarding the purpose for hauling sludge produced by the company into a particular municipality, and seeking to identify the facility to which it was being hauled.  It is clear that the Ministry’s original purpose for obtaining the complainant’s personal information was to respond to her inquiry.

 

According to the Certificate of Approval relating to the use of sludge in this case, a copy of which was provided to me, the function of the Sludge Co-ordinators is to monitor compliance with the Certificate of Approval and with applicable provincial regulations and legislation, and to respond to inquiries and complaints from the public.

 

In her letter of complaint regarding the disclosure to the Sludge Co-ordinators, the complainant stated as follows:

 

The Ministry of the Environment … office has two people in their office who are not provincial employees.  That office of the Ministry has decided to allow waste proponents to pay the salary of two staff people who are called “sludge co-ordinators” and who answer correspondence and respond to complaints from the public. [emphasis added]

 

In view of the role of the Sludge Co-ordinators as outlined in the Certificate of Approval, and this statement by the complainant, I have concluded that this disclosure “might reasonably have been expected” by the complainant and was therefore made for a “consistent purpose” as defined in section 43.  This disclosure was therefore permitted pursuant to section 42(c).  Moreover, the reasonableness of the expectation is not negated by the fact that, in this particular circumstance, the initial response to the complainant’s e-mail was prepared by the District Manager, who is a Ministry employee.

 

The complainant’s letter also objects to the payment of the Sludge Co-ordinators’ salaries by an environmental consulting firm.  The complainant further claims that the consulting firm is reimbursed for this expense by the company and the sludge hauler.  These issues fall outside the context of a privacy complaint.  However, the Ministry acknowledges that the Sludge Co-ordinators are not its employees, but states that they work under the Ministry’s supervision. In so doing, the Ministry states that the Sludge Co-ordinators were advised that they must maintain confidentiality with respect to all matters they deal with, or information they come into contact with, as part of their management of the issues related to the Certificate of Approval.  As well, the Sludge Co-ordiantors have been provided with copies of a directive dealing with privacy issues and their compliance with those requirements is monitored.  While the Ministry has made efforts to ensure the protection of privacy, nevertheless, in these circumstances it is important that a proper agreement is in place to ensure the confidentiality of personal information that may come into their possession as a result of their positions as Sludge Co-ordinators.  I will address this issue in my recommendations.

 

Disclosure to the Company and the Sludge Hauler

 

As with the disclosure discussed in the preceding section, I will begin this analysis under section 42(c).  The Ministry has not provided evidence to support a conclusion that the original purpose of the collection was to provide the information to either the company or the sludge hauler.  Moreover, this is not a disclosure that the complainant might reasonably have expected, and it therefore cannot be justified as having a consistent purpose.  I have therefore concluded that section 42(c) does not justify this disclosure.

 

In order to qualify under section 42(d) the person to whom disclosure is made must be an officer or employee of the institution.  Neither the company nor the sludge hauler was an “officer” or “employee” of the Ministry.  Accordingly, section 42(d) of the Act cannot apply to justify the disclosure to the company or the sludge hauler.

 

Summary

 

I am of the view that the disclosure to the Sludge Co-ordinators was in accordance with section 42(c) of the Act, but that contractual arrangements with those individuals are required in order to ensure the protection and the confidentiality of personal information that they obtain as a result of occupying those positions.

 

Neither section 42(c) nor (d) applies to permit the disclosures to the company or the sludge hauler.  In addition, I have concluded that no other parts of section 42 could apply with respect to those disclosures.

 

Was the use of Caller ID at the Ministry in accordance with the IPC Caller ID Guidelines (December 1992)?

 

It must be noted that in its initial response to this part of the complaint, the Ministry disagreed with the complainants recounting of events.  The Ministry states that the employee greeted the complainant by name only after answering the telephone and hearing the complainant say hello; that this is because the employee is familiar with the complainant. 

 

While I am unable to conclude which version of events is correct, nevertheless, I feel it is useful to highlight some of the issues surrounding the use of Caller ID.

 

The Ministry’s views on the issue of Caller ID were focussed on IPC Caller ID Guidelines (December 1992) with respect to this subject matter.  The Ministry indicated that:

 

…[it] adheres to the principles and direction provided in the Caller ID Guidelines published by the Information and Privacy Commissioner/Ontario, December 1992.  This Guideline permits the use of Caller ID, but suggests that it may not be appropriate in situations where the confidentiality of the caller should be withheld, even from the government [i.e. persons requiring anonymity regarding sexual harassment and pay equity].  None of the work currently carried out by the Ministry represents a situation where the use of Caller ID would be considered inappropriate.  The use of the Caller ID is left to the discretion of the individual office or ministry [emphasis added].

 

The IPC encourages all government organizations to carefully evaluate the usefulness and appropriateness of Caller ID.  The concern here is not that the Ministry uses Caller ID; rather, the following excerpt from page 5 of the IPC’s Caller ID Guidelines is more to the point:

 

Identity of Caller

 

Government employees need to be aware that the displayed telephone number may not belong to the caller.  For example, a client may be calling from another individual’s home or business…  In addition, special care should be taken not to inadvertently disclose personal information as a result of Caller ID.  This means that employees responding to a telephone inquiry should not assume the identity of a caller based on a displayed telephone number.   Employees of government organizations should take all reasonable and appropriate steps to verify the identity of the caller before disclosing personal information over the phone [emphasis added].

 

Clearly, a mistaken assumption regarding the identity of a caller, based on Caller ID, may result in the improper disclosure of personal information.  While in this complaint I am unable to conclude that there was disclosure, and even if there  had been , the disclosure of the complainant’s personal information would have been to the complainant herself, nevertheless it is a dangerous practice to respond in that manner.  Rather,  “employees responding to a telephone inquiry should not assume the identity of a caller based on a displayed telephone number” as the IPC Caller ID Guidelines suggest.

 

 

CONCLUSIONS:

 

I reached the following conclusions based on the results of my investigation:

 

1. The information contained in the e-mail meets the requirements of paragraphs 2(1)(c),(f) and (h) in the definition of “personal information” at section 2(1) of the Act.

 

2. The disclosure of the complainant’s personal information to the two Sludge

Co-ordinators was in accordance with section 42(c) of the Act.

 

3. The disclosures of the complainant’s personal information to the company and the sludge haulers were not in accordance with section 42 of the Act.

 

RECOMMENDATIONS:

 

I recommend the following:

 

1.         Ministry staff should be instructed that, when the Ministry receives correspondence (electronic or otherwise) from an individual, containing the author’s personal information, staff must carefully consider the provisions of sections 41 and 42 of the Act before engaging in a particular use or disclosure. If there is any doubt as to their application, the Ministry should only do so after contacting the individual in question to obtain their consent.

 

2.         The Ministry should enter into contracts to ensure that the Sludge Co-ordinators and their employer are bound by the access and privacy provisions of the Act, with respect to personal information they obtain in the course of their duties.  Alternatively, in the event that contracts already exist, the Ministry should review and if necessary revise the contracts for this purpose.  The IPC’s “Model Access and Privacy Agreement” published in August 1997 contains examples of the necessary provisions.

 

3.         The Ministry should create a Ministry wide bulletin for circulation on the appropriate use of Caller ID in accordance with the IPC Caller ID Guidelines (December 1992).

 

The Ministry should provide the IPC with proof of compliance with the above recommendations by no later than January 15, 2002.

 

 

 

 

 

                                                                                                            October 15, 2001

Kileen Dagg Centurione Mediator