PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-020059-1

 

 

Ministry of Community, Family and Children's Services

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.       PC-020059-1

 

 

 

MEDIATOR:                                                Frances Soloway

 

 

 

INSTITUTION:                                Ministry of Community, Family and Children's Services

 

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

The Office of the Information and Privacy Commissioner (the IPC) received a letter from the Executive Director (the Director) of the Family Responsibility Office (FRO) setting out the circumstances that resulted in an inadvertent disclosure of certain personal information. Specifically, correspondence intended for a particular support payor was sent to another party who was not a FRO client.  As a result, the IPC initiated a privacy complaint under the Freedom of Information and Protection of Privacy Act (the Act).

 

The Family Responsibility Office

 

The Family Responsibility Office operates under the authority of the Family Responsibility and Support Arrears Enforcement Act, 1966 to:

 

•         collect support payments on behalf of recipients

•         enforce court-ordered support payments; and

•         enforce certain domestic contracts and paternity agreements filed with the court

 

One of FRO’s enforcement initiatives allows for the suspension of a support payor’s drivers licence.  The threat of suspension and suspension itself is hoped to encourage the support payor to deal with outstanding arrears and bring the case into compliance.

 

The disclosure

 

The Director’s letter to the IPC set out the following details regarding the incident in question:

 

•         On October 2, 2002, FRO mailed a first notice of intent to suspend a driver’s licence notice to a party.

 

•         On November 12, 2002, FRO received a call from the spouse of the first party who indicated that they had received correspondence from FRO which contained a notice to suspend the first party’s driver’s licence and a statement of the balance of arrears owing on a case.  The spouse indicated that they did not know anything about this matter.  FRO advised the spouse that FRO could not discuss the case with a person who is not a client of the program unless they have written authorization from the client.

 

•         On November 18, 2002, the Ministry of Transportation suspended first party’s driver’s licence as per FRO’s procedures on driver licence suspension.

 

•         On November 29, 2002 the first party attended at FRO, in person, to indicate that he is not a FRO client and that the wrong person’s driver’s licence had been suspended.  He returned the correspondence he had received in error at that time.

 

•         After further review of case materials, FRO determined that the first party was not a FRO client and that his driver’s licence should not have been suspended.

 

During the investigation, I obtained the following additional information concerning the procedures that were in existence at the time of the incident with respect to driver’s license suspension.

 

FRO’s Driver’s Licence Suspension Policy and Procedure identifies a number of criteria before a driver’s licence suspension can be initiated.  One of the criteria is to “confirm current payor address on file”.  Although the policy does not identify the specific steps that must be undertaken in this respect, FRO explained that this would involve cross referencing the information within the Ministry of Transportation’s (MTO) database, with the information on file at FRO. In order to ensure that the correct individual has been identified, the individual’s name, address and date of birth must all be verified, before proceeding.

 

In the current case, the CSA checked the name and address of the support payor who was in default against the MTO’s database.  Although the last name matched, the first name and the address did not.  The Client Service Associate (the CSA) did not check whether or not the birthdate matched.  She subsequently sent the suspension notice to the address indicated on the MTO database.  Unfortunately, the person to whom the suspension notice was sent, and who subsequently had his licence suspended, was not the intended individual.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information "personal information" as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part, that “personal information” means recorded information about an identifiable individual.

 

I have reviewed the record at issue, namely the First Notice of Intent to Suspend a Driver’s License Notice to the Party.  This notice contains the support payor’s name, statement of account and case number. Since the statement of account and case number relate to both the support payor and the support recipient, I find that this information is clearly personal information of both of these individuals as defined in section 2(1) of the Act.   FRO does not dispute this finding.

 

Was the disclosure of the personal information in accordance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.  Clearly, in light of the circumstances surrounding this complaint, I find that none of them apply.  FRO does not dispute this finding. 

 

Steps taken by FRO

 

Upon verifying that the wrong individual’s driver’s licence was suspended, FRO immediately requested cancellation of the license suspension and the licence has now been reinstated.  FRO explained that other actions taken to remedy the breach include the following:

 

• On December 2, 2002, FRO changed the case number for the support payor to whom the FRO correspondence was intended to restore confidentiality for both the payor as well as for the support recipient associated with this case.

 

• On December 4, FRO sent letters to both support payor and recipient to advise them of the steps FRO has taken to protect their personal information.

 

• On December 4, FRO sent an apology letter to the first party for suspending his driver’s licence in error.

 

• On December 3, FRO management issued a reminder to enforcement staff to practice due diligence when confirming the identity of support payors prior to issuing driver’s licence suspension notices.

 

• FRO is revising its procedures for staff receiving telephone inquiries on how to take information without compromising the privacy of FRO clients, from persons who claim that FRO has taken actions against the wrong party.

 

During this investigation and in response to discussions with the Director, FRO sent out another notice to staff concerning driver’s licence suspensions and the need to confirm the identity of the payor.  The notice stated that in any situation where there may be doubt as to the identity of the payor, the CSA is required to use two other trace and locate sources to confirm identity, prior to issuing a notice. The notice also emphasised that the issuance of the driver’s licence suspension notice has serious consequences for the payor, and due diligence must be exercised when a CSA is reviewing a file for suspension.

 

The notice also addressed what should be done in the event that a caller indicates that he/she has received correspondence from FRO in error.  The notice advises that the issue should be investigated.  Specifically, information should be sought with respect to the nature of the documentation that was received in error and the individual should be requested to return it back to FRO.

 

In addition to the above, FRO advised that the following will be undertaken to ensure that the driver’s licence suspension process is completed correctly, and that there are no further incidences of improper licence suspension:

 

• The Driver’s Licence Suspension Policy and Procedure will be amended to reflect a higher level of detail regarding identifying the correct person when initiating a driver’s licence suspension notice.

 

• A detailed check list will be created, including identity verification, which the CSA will be required to review prior to the issuance of the drivers licence suspension notice.

 

• FRO will be conducting Driver’s Licence Suspension refresher training in February with the staff, and these issues will be reviewed further at that time.

 

CONCLUSION:

 

Although FRO did not take immediate action when it was first notified of the incident, FRO responded promptly once it was confirmed that the wrong individual’s driver’s licence was suspended.

 

I have reached the following conclusions based on the results of our investigation:

 

1.   The information in question is personal information as defined in section 2(1) of the Act.

 

2.  The personal information was disclosed contrary to the Act.

 

3.  The disclosure was inadvertent and was a result of human error.

 

RECOMMENDATIONS

 

1.      FRO should complete revising the Driver’s Licence Suspension Policy and Procedure to reflect a higher level of detail regarding identifying the correct person when initiating a driver’s licence suspension notice.  This should include a detailed description of the steps to be undertaken when conducting identity verification prior to the issuance of the driver’s licence suspension notice.

2.      FRO should revise its policies and procedures to address what should be done in the event that FRO is advised that someone has received any of its documentation in error.

3.      FRO should ensure that the appropriate employees are aware of the amended policies and procedures as referred to above.

 

The Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations no later than June 17, 2003.

 

 

 

 

 

 

 

 

 

                                                                                                                 March 17, 2003

Frances Soloway Mediator