PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-020017-1

 

 

City of Hamilton

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-020017-1

 

 

 

MEDIATOR:                                                            Alex Kulynych

 

 

 

INSTITUTION:                                            City of Hamilton

 

 

 

SUMMARY OF COMPLAINT:

 

On January 1, 2001, the City of Hamilton amalgamated with a number of adjacent municipalities to form the present City of Hamilton (the City).  One result of the amalgamation was the need to repeal and replace a number of by-laws.  As part of that process The City of Hamilton Licensing Code, 1998 (By-law No. 98-203) and various other licensing by-laws of the dissolved municipalities were replaced by the current By-law No. 01-156: A By-law to Licence and Regulate Various Businesses.  Residential care facilities were included as a business covered by the new licensing by-law.

 

The Office of the Information and Privacy Commissioner/Ontario (the IPC) received correspondence from an administrator and owner of a retirement residence.  According to the author, the residence is a residential care home licensed by the City.  City inspectors had attended the facility on two occasions and reviewed the medical and personal care plan records of the residents and did so without the residents’ consent.  Information from these records was also collected in the form of notes taken by the inspectors.  Furthermore, the City did not notify the residents that their personal information would be collected.  The author feels that information from medical and personal care plan records should not be viewed and collected without notice to the residents and without their consent.  She is also concerned that these inspections are to be conducted on a regular basis.

 

According to the author, a number of residents have objected to the inspections.  The IPC has been contacted by a number of individuals, including an MPP, expressing the same concerns. The authors of some of the correspondence object to similar inspections at another facility.

 

On this basis, the IPC initiated Privacy Investigation MC-020017-1 to determine whether the City collected the residents’ information in accordance with the privacy provisions of the Municipal Freedom of Information and Protection of Privacy Act (the Act) and whether the residents were notified of the collection as required by the Act.

 

It is important to understand that my investigation has been completed in accordance with my responsibilities and authority as outlined in the Act.  The findings in this report should not be interpreted as either an endorsement or a criticism of the provisions of By-law 01-156.  The policy reflected in the by-law is a matter for the City to set and revise as required, and it is not within the scope of my authority to comment on these policy matters.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

ISSUE A:       Was the information collected by the City’s inspectors “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(a)                information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b)               information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

…

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

 

…

 

(h)        the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual

 

Section 54(2) of Schedule 20 (Residential Care Facilities) of By-law 01-156 requires the operator of a facility to maintain a separate file for each tenant (i.e., resident of a facility), and lists the specific information that is to be contained in the file.  That list consists of:

 

•          sex, age, date of admission and date of discharge or death;

•          name, address and telephone number of next-of-kin;

•          name and telephone number of the tenant’s attorney for personal care, if any;

•          the name and telephone number of the tenant’s physicians;

•          the name, address and telephone number of any community agency which is providing support to the tenant;

•          tuberculin or chest x-ray testing results, and the dates thereof;

•          a brief medical history of the tenant from the date of his or her admission, including medication information, laboratory results, physicians’ orders as available, and staff notes;

•          a care home information package;

•          particulars of each accident suffered by the tenant while in the facility; and

•          Forms 1 and 2 (where used).

 

Section 55 of the same Schedule requires that a record in a prescribed Form 3 be made of every occurrence of assault or injury and be placed in the tenant’s file and kept available for inspection by the Medical Officer of Health, and that a record in a prescribed Form 4 be made of the death of a tenant resulting from an accident or an undetermined cause, or from a communicable disease affecting the tenant, and that it be delivered forthwith to the Medical Officer of Health and a copy be placed in the tenant’s file.

 

Based on the types of information that the operator of a facility is required to maintain in order to comply with sections 54 and 55 of Schedule 20 of By-law 01-156, I conclude that the information reviewed and collected by City inspectors is the personal information of the tenants. Small portions may also contain the personal information of other identifiable individuals, such as the tenant’s next of kin.

 

ISSUE B:       Was the collection of the “personal information” in accordance with section 28 of the Act?

 

Section 28(2) of the Act sets out the circumstances under which an institution under the Act, like the City, can collect personal information.  This section states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

 

The City needs to satisfy only one of the three criteria identified in section 28(2) in order to be in compliance with this section.

 

Used for the purposes of law enforcement

 

"law enforcement" is defined in section 2(1) of the Act as:

 

(a)        policing,

 

(b)        investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, and

 

(c)        the conduct of proceedings referred to in clause (b);

 

By-law 01-156 requires that residential care facilities be licensed and allows for the inspection of these facilities and their operation in order to determine compliance with the provisions of the by-law relating to the care and safety of the tenants.

 

Section 56 of Schedule 20 of By-law 01-156 states:

 

(1)               The Medical Officer of Health, the Building Commissioner, the Chief Fire Prevention Officer, the Chief of the City of Hamilton Police, the Issuer of Licences, or an inspector, at all reasonable times, may inspect any facility and the list of tenants required by subsection 54(1).

 

(2)               The Medical Officer of Health or a member of a regulated health profession authorized by him or her, at any time may inspect the file of any tenant required by subsection 54(2), and may make copies of the contents of such file.

 

Section 57 of the Schedule states:

 

The operator of a facility shall allow the Medical Officer of Health or a member of a regulated health profession authorized by him or her, as often as he or she deems reasonably necessary, to make inspections of the facility and its operation in order to determine compliance with the provisions of this Schedule relating to the care and safety of the tenants.

 

It is therefore clear that section 56(2) of Schedule 20 to the by-law authorizes the Medical Officer of Health, or a member of a regulated health profession authorized by him or her, to inspect the file of any tenant and to make copies of the contents of the file.  Earlier, I described the types of information that are kept in individual tenants’ files pursuant to sections 54(2) and 55 of Schedule 20.

 

The by-law provides for orders to be issued and charges to be laid for violations or non-compliance with the by-law.  If charged with an offence under the by-law, an operator must attend Provincial Offences Court.  An operator’s licence may be suspended, revoked or have conditions imposed following a hearing before the City’s Licensing Committee and a decision by City Council.

 

Previous orders of the IPC have consistently found that municipal by-law enforcement activities fall within the definition of “law enforcement” in section 2(1) of the Act (see, for example, Orders M-16 M-582 and MO-1295). 

 

It is implicit in the scheme of the by-law that the inspections contemplated by sections 56 and 57 are intended to promote the by-law’s law enforcement purpose, stated in section 57 as determining “compliance with this Schedule relating to the care and safety of tenants”.

 

I have reviewed the licensing provisions of the by-law and have found that inspections of the facilities could lead to proceedings in a Court where a penalty or sanction could be imposed. Having considered the IPC’s findings in the orders referred to above and based on the definition of “law enforcement” found in section 2(1) of the Act, I am satisfied that the City’s collection of the tenants’ personal information was used for the purpose of law enforcement and was in accordance with section 28(2) of the Act.

 

ISSUE C:       Was the manner of collection in accordance with section 29 of the Act?

 

Section 29(1)(g) of the Act reads:

 

An institution shall collect personal information only directly from the individual to whom the information relates unless,

           

the information is collected for the purpose of law enforcement; or

 

I have already concluded in ISSUE B that the City’s collection of the tenants’ personal information was used for the purpose of law enforcement.  Accordingly, I find that the City is exempt from the requirement to collect the personal information directly from the individual to whom the information relates and may collect the information indirectly, that is, through the inspection of tenants’ files.  Therefore, I conclude that the City’s manner of collection was in accordance with section 29 of the Act.

 

ISSUE D:       Was notice of the collection provided in accordance with section 29 of the Act?

 

Sections 29(2) and 29(3) of the Act read:

 

(2) If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,

 

(a)    the legal authority for the collection;

 

(b)   the principal purpose or purposes for which the personal information is intended to be used; and

 

(c)    the title, business address and business telephone number of an officer or employee of the institution who can answer the individual's questions about the collection.

 

(3) Subsection (2) does not apply if,

 

(a)    the head may refuse to disclose the personal information under subsection 8(1) or (2) (law enforcement) or section 8.1 (Remedies for Organized Crime and Other Unlawful Activities Act, 2001);

 

(b)   the Minister waives the notice; or

 

(c)    the regulations provide that the notice is not required.

 

Although the City’s collection is for law enforcement purposes, this does not necessarily mean that the exception to the notice provided by section 29(3)(a) would apply.

 

The City has acknowledged that it has not complied with the notification provisions of the Act. During the investigation, the City and I discussed ways for the City to comply with the provisions relating to notice to individuals.  As a result, the City has agreed as follows:

 

(a)                The City will ensure that operators of residential care facilities permanently post in a highly visible location in each of the City’s licensed residential care facilities, for public inspection, appropriate written notice containing: (1) the legal authority for the collection of personal information by the City’s inspectors, (2) the principal purpose or purposes for which the personal information is intended to be used, and (3) the title, business address and business telephone number of an officer or employee of the City who can answer questions of the individual to whom the information relates, about the collection; 

 

(b)               The City will provide letters to the operators of each of the City’s licensed residential care facilities explaining the collection process and providing them with notice containing the information specified in paragraph (a) above.  The City will ensure that the operators distribute the letters to all current tenants.

 

(This is a one-time mailing to inform existing tenants who would not be otherwise informed by (c) below).

 

(c)                When a new tenant first moves into the facility, the City will require operators to provide the tenant with a one-time written notice, containing the information specified in paragraph (a) above;

 

(d)               Only those records and reports listed in the Licensing Code, Schedule 20, Part IX Sections 54(1) and (2) and 55 (1) and (2) will be placed in the tenants’ files for inspection by the City.  The City will require operators to ensure that all other personal information about the tenants will be maintained in a separate file.

 

The City’s agreement to comply with these requirements relates to inspections of licensed facilities.   In the event that the City inspects non-licensed residential care facilities, the City must still comply with collection and notification requirements in sections 28 and 29 of the Act.

 

In addition, in my view, compliance with the requirements of paragraphs (a) through (d) is not sufficient to comply with the notification requirements of section 29 of the Act in all inspections of licensed facilities.  The provisions of section 29 are mandatory and require notice to be given whenever personal information has in fact been collected unless one of the exceptions in section 29(3) applies.  This is addressed in the Recommendations below.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

• The information reviewed and collected by City inspectors is the personal information of the tenants and other individuals;

 

• The collection of the tenants’ personal information was in compliance with section 28 of the Act;

 

• The City’s manner of collection was in accordance with section 29 of the Act; and

 

• Notice of the collection was not provided in accordance with section 29 of the Act.

 

RECOMMENDATIONS:

 

1.         As noted above, the City has agreed to take specific steps to comply with the provisions of the Act relating to notification.  As a result, I request that the City provide this office with a copy of the notices and letter described in (a), (b) and (c) above and proof of compliance with (d) above.

 

2.         I recommend, where personal information has actually been collected by the City by means of recording the information or making a copy during inspections, that the City provide, within a reasonable period of time, notice containing the information specified in paragraph (a) above to each tenant on each occasion when the tenant’s personal information has been collected unless an exception under section 29(3) of the Act applies.

 

3.         In light of the public attention surrounding the City’s inspections of residential care facilities, I recommend that the City review the types of information listed in section 54(2) of Schedule 20 of By-law 01-156 to ensure that all of the personal information contained in the files required by that section is necessary in order for the purpose of the by-law to be realized.

 

With respect to the above recommendations, I request that the City provide this office with proof of compliance by March 19, 2003.

 

 

 

 

 

 

 

 

                                                                                                            December 19, 2002

Alex Kulynych Mediator