PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-020030-1

 

 

City of Niagara Falls

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-020030-1

 

 

 

MEDIATOR:                                                            Warren Morris

 

 

 

INSTITUTION:                                            City of Niagara Falls

 

 

 

SUMMARY OF COMPLAINT:   

           

The office of the Information and Privacy Commissioner/Ontario (the IPC) received a privacy complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) involving the City of Niagara Falls (the City).

 

The complainant is a City employee.  His spouse, a City councillor, had asked the City water department supervisor to send a staff member to their home to take a water sample because the tap water had a bad odour and taste.  The City water supervisor, accompanied by an officer of the Ministry of the Environment and two other City staff members, attended the complainant’s home to conduct the water sample test.  The results showed an unacceptable reading for e-coli/fecal coliform.  A second test was required, but the results would not be available until 48 hours later.  The complainant’s spouse was concerned that the City did not intend to notify their neighbours until the results of the second test were determined.  The complainant’s spouse therefore notified her neighbours, as well as a local newspaper, of the first test results.  She suggested that her neighbours refrain from drinking unboiled tap water until the second test results were received.

 

An issue arose concerning whether the complainant conducted the water testing at his home.  Three councillors made inquiries of the Mayor about the complainant’s involvement in water testing.  The City’s Operations Superintendent provided information on this subject to the Mayor by e-mail.  The e-mail was later provided to the three councillors.  The matter was discussed at a council meeting on August 12, 2002.  A story subsequently appeared in the Niagara Falls Review.  The reporter who wrote the story had obtained a copy of the e-mail. 

 

The complaint therefore relates to three possible disclosures:  (1) by the Operations Superintendent to the Mayor; (2) by the Mayor to the councillors; and (3) to the reporter.

 

DISCUSSION:

 

Is the information contained in the e-mail “personal information” as defined in section 2(1) of the Act?

 

During my investigation I was provided with a copy of the e-mail from the City’s Operations Superintendent to the Mayor.

 

The e-mail sets out general qualifications for individuals conducting water sampling and testing for chlorine residuals.  It also contains the following information about the complainant:

 

1.            confirmation as to whether or not he attended a water testing course;

2.            the results of his written test for the course;

3.            whether or not he was certified to perform water sampling or testing for chlorine residuals;

4.            whether or not he has performed water sampling or testing for chlorine residuals; and

5.            a brief description of his work duties as they relate to water quality testing.

 

Section 2(1) of the Act states the following:

"personal information" means recorded information about an identifiable individual, including,

…

(b)     information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

…

(h)     the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

Personal information must be “about” an identifiable individual.  Information in the e-mail about general qualifications for employees conducting water sampling and testing is not about an identifiable individual and is therefore not personal information.

 

Previous decisions of this office have held that information about an individual in his or her professional or employment capacity does not constitute that individual's personal information where the information relates to the individual's employment responsibilities or position (see Reconsideration Order R-980015 and Order PO-1663), unless the information relates to an evaluation of his or her performance as an employee or an investigation into his or her conduct as an employee (see Orders P-721, P-939, P-1318 and PO-1772).  I have concluded that information about whether the complainant had performed water sampling or testing for chlorine residuals and the brief description of his work duties as they relate to water quality testing relates to the complainant in his professional or employment capacity and therefore does not qualify as “personal information” under the Act.

 

Information about a person’s education is specifically designated as “personal information” under paragraph (b) of the definition.  Accordingly, I have concluded that information relating to the complainant’s attendance at educational courses, the results of his written test for the course, and whether or not he was certified to perform water sampling or testing for chlorine residuals, all qualifies as “personal information” under the Act.

 

Was the disclosure of the “personal information” in accordance with the Act?

 

Introduction

 

As noted previously, this investigation report relates to three possible disclosures: (1) by the Operations Supervisor to the Mayor; (2) by the Mayor to the councillors; and (3) to the reporter.

 

The City acknowledges that the Mayor contacted the Operations Superintendent to determine whether the complainant had conducted the water sample testing at his residence and whether the complainant was qualified to do this type of testing.  The Mayor and the Operations Superintendent discussed the matter by telephone, following which the Operations Superintendent sent the e-mail to the Mayor.  The City advises that the Mayor then gave copies of the e-mail to the three councillors who had inquired about the water testing.  The City denies that the Mayor, or any other City staff, disclosed the e-mail to any members of the press or media, nor was the e-mail given to any councillors who had not made inquiries concerning the incident.  The City states that it does not know how the reporter obtained a copy of the e-mail.

 

I will begin my analysis with the disclosures to the Mayor and the councillors, as these raise similar issues.  I will then consider the disclosure to the reporter that resulted in the story in the Niagara Falls Review.

 

Disclosure to the Mayor and the Councillors

 

The City argues that the disclosures of personal information to the Mayor and the councillors were authorized by section 32(d) of the Act.  This section states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution's functions; [emphasis added]

 

This requires analysis of the relationship between the City and the Mayor, and the City and the councillors, and in particular, whether those occupying the offices of Mayor and councillor are officers or employees of the City.

 

Are the Mayor and/or Councillors Officers or Employees of the City?

 

Councillors

 

In Order M-813, Adjudicator Laurel Cropley reviewed the authorities on this subject in considerable detail, as follows:

 

The word “officer” appears in several provisions of the Act (sections 2(3), 7(1), 7(2)(k), 14(4)(a), 29(2)(c), 32(d) and 49(1)), however, this term is not defined.  In my view, in order to determine the issues in this appeal, it is useful to examine the meaning of the term “officer” as it is used in municipal law.

 

The word “officer” is not defined in the Municipal Act or any other related legislation, such as the Ontario Municipal Board Act and the Ontario Municipal Employees Retirement System Act.  It is interesting to note, however, that in some situations these statutes clearly distinguish between “members” of a council or board, and its “officers” or “employees”.  For example, section 187(12) of the Municipal Act provides:

 

Any member of the council or officer of the corporation who applies for any revenues so charged ... is personally liable for the amount so applied ...

 

On the other hand, some provisions of the Municipal Act imply that in certain situations, a member of council can be both a member and an “officer” of the municipal corporation.  For example, section 247(1) of the Municipal Act provides:

 

The Treasurer of every municipality shall ... each year submit to the council of the municipality an itemized statement of the remuneration and expenses paid to each member of council in respect of his or her services as a member of council or as an officer of the municipal corporation in the preceding year ... (emphasis added).

 

Part IV of the Municipal Act, which is entitled “Officers of Municipal Corporations”, sets out the statutory duties and powers of the following “officers”:

 

•           the head of council, which includes a mayor, chair, reeve and warden (section 69);

•           the chief administrative officer, which in some municipalities is also known as the City Manager (section 72);

 

•           the clerk, deputy clerk and acting clerk (section 73);

 

•           the treasurer, deputy treasurer and acting treasurer (section 77);

 

•           collectors (section 85);

 

•           auditors (section 86).

 

Other “officers” of Municipal Corporations derive their authority from statutes other than the Municipal Act, for example:

 

•           medical officer of health (Health Protection and Promotion Act);

 

•           chief building official (Building Code Act).

 

The meaning of the term “officer” in municipal law has also been considered in the courts and has been the subject of academic writing (for example, see: Kenneth Grant Crawford, Canadian Municipal Government (University of Toronto Press, 1954), at p. 177 and Ian MacF. Rogers, Municipal Councillors’ Handbook, 5th Ed. (Carswell: Agincourt, 1988), at pp. 147 - 148).

 

In general, the above sources interpret the term “officer” to refer to a high ranking individual within the municipal civic service, who exercises management and administrative functions, and who derives his or her authority either from statute or from council.  The Alberta Court of Appeal referred to “officers” in Speakman v. Calgary (City) (1908), 9 W.W.R. 264, I Alta. L.R. 454 (C.A.), as summarized in Stephen Auerback and Andrew James, The Annotated Municipal Act (Thomson: Scarborough, 1989), Volume 1, pp. 17 - 33, as those who exercise powers “of an executive and coercive and quasi-coercive character, and are binding upon and affect the rights of the inhabitants and ratepayers of the municipality”.

 

In my view, the authorities referred to above all indicate that, except in unusual circumstances, a member of municipal council is generally not considered to be an “officer” of a municipal corporation.  An example of an unusual circumstance would be where a municipal councillor of a small municipality has been appointed a commissioner, superintendent or overseer of any work pursuant to section 256 of the Municipal Act.  In this regard, the authorities indicate that this would be an extremely unusual situation, and where it occurs, the councillor would be considered an “officer” only for the purposes of the specific duties he or she undertakes in this capacity.  In these cases, a determination that a municipal councillor is functioning as an “officer” must be based on the specific factual circumstances.

 

I agree with this analysis.  I have not been provided with any information that suggests that this is one of the “unusual circumstances” in which councillors would be considered to be officers, and I have therefore concluded that they do not have that status.  It is therefore necessary to determine whether they qualify as “employees”.

 

Adjudicator Cropley considered that issue in Order MO-1264.  She concluded that:

 

… the Municipal Act consistently distinguishes between “employees” and “members” when describing their rights and duties (See: ss. 100, 102.1, 24(b), paras. 46 - 50 of section 207, 253, 288(1) and 331(3)).  Of particular relevance is section 37(1)1 of the Municipal Act which states:

 

The following are not eligible to be elected a member of a council or to hold office as a member of a council:

 

Except during a leave of absence under section 30 of the Municipal Elections Act, 1996, an employee of the municipality or of a local board as defined in the Municipal Affairs Act, other than a person appointed under section 256. [emphasis added]

 

Section 256 states:

 

A member of the council of a village or township having a population of 3,000 or less may be appointed commissioner, superintendent or overseer of any work, other than a highway, undertaken wholly or in part at the expense of the corporation, and may be paid the like remuneration for his or her services as if he or she were not a member of the council. R.S.O. 1980,

 

In my view, even when the exception in section 256 is taken into consideration, the status of “employee” and “councillor” appear to be mutually exclusive.

 

… On the basis of the provisions of the Municipal Act, I find that there is no employer/employee relationship between the City and its municipal councillors.

 

I agree with these conclusions and in my view they are equally applicable in the circumstances of this investigation.  I have therefore concluded that the councillors are not employees of the City.

 

To summarize, I have concluded that municipal councillors are neither “officers” nor “employees” of the City in the circumstances of this investigation.

 

The Mayor

 

I will now consider the status of the mayor.  As Adjudicator Cropley noted in Order M-813, section 69 of the Municipal Act indicates that the head of council, whether mayor, chair, reeve or warden, is an officer.  In Order MO-1403, Adjudicator Donald Hale found that the mayor of the City of Mississauga is an “officer” of that institution.  Similarly, I have concluded that the Mayor is an “officer” in the circumstances of this case.

 

Were the Disclosures to the Mayor and the Councillors authorized under section 32(d)?

 

Given that the councillors are neither officers nor employees of the City, section 32(d) could not justify the disclosures made to them.  I will consider, below, whether there was any further authority for the disclosure to them.

 

The Mayor, however, is an officer, and having met that requirement, the disclosure to him would be authorized by section 32(d) if:  (1) he needed the information in the performance of his duties, and (2) the disclosure was necessary and proper in the performance of the institution’s functions.

 

The City states that the matter in question involved the health and welfare of residents of the City, and as such, the Mayor was fulfilling his duty to respond to inquiries made by City councillors in this regard.  The City states that the disclosure of the e-mail was necessary and proper in the discharge of the functions of the City and in particular, as a matter of concern to several councillors who had asked the Mayor to inquire on their behalf.

 

As noted previously, the Mayor had asked whether the complainant had done the water testing and whether he was qualified to do so.  In my view, the disclosure of that particular information  in the e-mail was necessary for the Mayor to perform the duties of his office, and proper in the discharge of the institution’s functions, because questions had arisen concerning the manner in which the water testing at the councillor’s home was carried out.  Therefore, I conclude that the disclosure of whether the complainant conducted the test and whether he was certified to perform water sampling or testing for chlorine residuals was authorized by section 32(d).

 

However, I have concluded that the Mayor did not require the remaining personal information (which relates to the complainant’s attendance at educational courses and the results of a written test) to perform his duties as Mayor, nor was its disclosure “necessary and proper” in the performance of the City’s functions.  The disclosure of this remaining information (which according to the City, the Mayor had not even asked for) was therefore not in accordance with section 32(d).  The City has not argued that any other part of section 32, or the Act, applies to authorize this disclosure.  In my view, no such provision applies.  I have therefore concluded that the disclosure of the remaining information to the Mayor was not in accordance with the Act.

 

Were the disclosures to the Councillors authorized under any other provision of the Act?

 

Both the Act and the Municipal Act contain provisions indicating that, in certain circumstances, council could be expected to receive personal information from the municipality in the course of performing its management functions.

 

For example, section 239(2) of the Municipal Act authorizes council to meet in the absence of the public in specified circumstances.  It states, in part, as follows:

 

A meeting or part of a meeting may be closed to the public if the subject matter being considered is,

 

(b)     personal matters about an identifiable individual, including municipal or local board employees;

 

(d)    labour relations or employee negotiations.

 

The exemption at section 6(1)(b) of the Act reflects the power of municipal councils to hold closed meetings when authorized to do so by legislation.

 

Similarly, section 239(3) permits council to hold a closed meeting “if the subject matter relates to the consideration of a request under the Municipal Freedom of Information and Protection of Privacy Act if the council, board, commission or other body is the head of an institution for the purposes of that Act.”  Under section 3 of the Act, council is the “head” of a municipal corporation unless it delegates this role, and is responsible for making decisions about the disclosure or non-disclosure of any record, of whatever nature, that is within the City’s custody or control and which becomes the subject of an access request.  In this context, it is to be expected that, at times, council would need to be made aware of the contents of records held by the City, which could include personal information.

 

These provisions do not, in and of themselves, provide for disclosure of information to municipal councillors, but they do provide evidence of an assumption within the structure of the Municipal Act that personal information will be disclosed to council as a whole in some circumstances.  It is noteworthy that these disclosures would be to council as a whole, rather to individual councillors.

 

In the context of the Act, these provisions do suggest that in appropriate circumstances, disclosure of personal information to council as a whole in connection with its management functions may be authorized by section 32(c) of the Act, which applies where the disclosure of personal information is “for the purpose for which it was collected or for a consistent purpose.”  In the circumstances of this investigation, employment-related information collected to permit the City to manage its relationship with its employees may, for example, be disclosed to council where the disclosure would be for that original purpose or one that is “consistent” with it.

 

Where information has been collected directly from an individual, section 33 indicates that a purpose may be considered to be consistent “… only if the individual might reasonably have expected such a use or disclosure.”  Where personal information has not been collected directly from the individual, but from some other source, previous investigation reports have indicated that in order to qualify under “consistent purpose”, the use or disclosure must be “reasonably compatible” with the purpose for which it was obtained or compiled (see Investigation Report #I95-008M).

 

In this case, the disclosure was not to council as a whole, but to three councillors only.  In my view, disclosure in that context does not relate to the management functions of council, nor to the three councillors’ participation in that function.  It is also not “reasonably compatible” with that purpose, nor would the complainant have “reasonably expected” his information to have been disclosed to individual members of council.  In my view, therefore, section 32(c) does not authorize the disclosure of any of the complainant’s personal information to the councillors.

 

The City has not suggested any other provisions that might authorize the disclosure to the three councillors.  In my view, no such provision applies.  I have therefore concluded that this disclosure was not authorized under the Act.

 

Disclosure to the Reporter

 

As noted previously, a story about the water testing issue involving the complainant appeared in the Niagara Falls Review.  The complainant provided a copy of the article, which stated that the e-mail was given to a Review reporter at a council meeting.  The City states that neither the Mayor nor any other City employee was responsible for disclosing the e-mail to the reporter.  Although the source of the disclosure to the reporter cannot be definitively determined, the newspaper article makes it quite clear that it was either a City employee or a member of council.

 

A disclosure by a City employee in connection with his or her employment responsibilities would qualify as a disclosure by the City and would be subject to the Act on that basis.

 

As regards a possible disclosure by the Mayor, who is also a member of council, Adjudicator Cropley determined in Order M-813 that an “officer” of the City would be considered part of the institution, and records maintained by an officer in conjunction with his or her position would therefore be subject to the Act.  Since I have already concluded that the Mayor is an officer, who received the e-mail in connection with his duties as such, a disclosure by the Mayor to the reporter would also be subject to the Act.

 

As regards disclosure by a councillor other than the Mayor, I have already concluded that City councillors are neither officers nor employees of the City.  Nevertheless, records in the possession of a councillor are subject to the Act if they are within the custody or control of the City.  This assessment depends, in part, on whether the information was held by the councillor solely in his or her capacity as a constituent representative and never integrated into the municipality’s files (Orders M-846, M-813).  In this case, I have concluded that the information related to City business and was not solely a constituency matter, as indicated by the fact that the information was originally provided to the councillors by the City.

 

In Order 120, former Commissioner Sidney B. Linden set out a list of factors to consider in deciding whether records are within an institution’s custody or under its control.  Whether the record was created by an officer or employee of the institution, and whether its content relate to the institution’s mandate and functions are both identified as factors to consider, and in my view, these factors, in addition to the fact that the City provided the information to the councillors, and that it did not pertain to constituency matters, all support the conclusion that the e-mail remained within the City’s control.  I have therefore concluded that, in the councillors’ hands, the e-mail was under the City’s control.

 

To summarize, therefore, regardless of whether the disclosure of the e-mail to the reporter was effected by a City employee, or the Mayor, or one of the councillors, the information that was disclosed is subject to the Act.

 

I have reviewed the provisions of section 32 to determine whether any of them would authorize the disclosure, and I have concluded that none of them does so.  Therefore the disclosure was not authorized under the Act.

 

The disclosure of the e-mail to the reporter raises an additional privacy concern relating to security.  Section 3(1) of Regulation 823, made under the Act, states that “[e]very head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.”  The fact that the e-mail was disclosed to three councillors and found its way into the hands of the reporter, all in contravention of section 32, indicates that the “reasonable measures” required under section 3(1) of the Regulation have not been defined, documented, or put into place.  Alternatively, if they were in place, they were not followed in this instance.  For example, if the personal information whose disclosure to the mayor was authorized under section 32 had been distributed to the whole council at a meeting, their security could have been ensured by numbering the copies and requiring their return at the end of the meeting.  I will address this in the recommendations set out below.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

1.                  Information relating to the complainant’s attendance at educational courses, the results of his written test for the course, and whether or not he was certified to perform water sampling or testing for chlorine residuals, all qualifies as “personal information” under the Act.

 

2.                  Information about general qualifications for employees conducting water sampling and testing is not about an identifiable individual and is therefore not personal information.

 

3.                  Information about whether the complainant had performed water sampling or testing for chlorine residuals and a brief description of his work duties as they relate to water quality testing relates to the complainant in his professional or employment capacity and does not qualify as “personal information” under the Act.

 

4.                  The disclosure by the City’s Operations Superintendent to the Mayor of whether the complainant was certified to perform water sampling or testing for chlorine residuals was in compliance with section 32(d) of the Act.  The disclosure of the remaining personal information in the e-mail by the Operations Superintendent to the Mayor was not in compliance with the Act.

 

5.                  The disclosure of the personal information in the e-mail by the Mayor to the three councillors was not in compliance with the Act.

 

6.                  The City’s disclosure of the e-mail to the reporter, regardless of whether it was by a City employee, the Mayor or a councillor, was not in compliance with the Act.

 

7.                  The “reasonable measures” to prevent unauthorized access to City records required under section 3(1) of the Regulation have not been defined, documented, or put into place.  Alternatively, if they were in place, they were not followed in this instance.

 

RECOMMENDATION (S):

I recommend that the City take steps to ensure that personal information is disclosed only in accordance with section 32 of the Act.  Specifically, I make the following recommendations:

1.                  The City is to circulate this report to all City employees and City councillors, including the Mayor.

 

2.                  All City councillors, including the Mayor, are to be provided a copy of the booklet titled “Working with the Municipal Freedom of Information and Protection of Privacy Act: A Councillor’s Guide” published by the Information and Privacy Commissioner/Ontario in partnership with the City of Ottawa.

 

3.                  The City is to create a privacy protocol addressing how requests for and the disclosure of information, both among and within City employees/officers and councillors, can be accomplished in compliance with section 32 of the Act.  The protocol should contain steps that are to be taken when making an internal request for information.  The requester should be required to identify the subsection of section 32 of the Act that provides the authority under which the information can be disclosed.  For example, if section 32(d) is cited, the requesting officer/employee or councillor should state why the information is required in the performance of their duties or in properly discharging the City’s functions.

4.                  The privacy protocol referred to in Recommendation 3 must also address the City’s obligations under section 3(1) of Regulation 823, to ensure that reasonable measures to prevent unauthorized access to records in the custody or under the control of the City are defined, documented and put in place.

 

5.                  The City is to take steps to implement and educate officers/employees and councillors regarding the privacy protocol developed under Recommendations 3 and 4 above, including, but not limited to, providing them with a copy of the privacy protocol.

 

On or before August 27, 2003, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with Recommendations 1 through 4, above.  Regarding Recommendation 5, proof of compliance should be provided no later than November 27, 2003.

 

 

 

 

 

Original signed by:                                                                              May 27, 2003

Warren Morris Mediator