PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-020035-1

 

 

Ministry of the Attorney General

 

 

 

 

 

April 22, 2003

 

PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO.                   PC-020035-1

 

MEDIATOR:                                                            Shaun Sanderson

 

INSTITUTION:                                            Ministry of the Attorney General

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

On June 24, 2002, the Office of the Information and Privacy Commissioner/Ontario (the IPC) received a telephone call from the Executive Assistant and Counsel to the Deputy Attorney General regarding the theft of two vehicles belonging to a Crown Attorney.  The IPC was advised that the trunk of one of the stolen vehicles contained a videotaped witness statement and other documents relating to a criminal investigation.  The IPC received a follow-up letter dated June 25, 2002, from the Deputy Attorney General, setting out the circumstances surrounding the theft of the vehicles.  The letter indicated that sometime in the late hours of Friday, June 21, 2002, two vehicles were stolen from the driveway of a Crown Attorney’s home.  The trunk of one of the stolen vehicles contained a videotaped witness statement and handwritten notes pertaining to a prosecution before the courts, as well as a confidential legal memorandum pertaining to an ongoing criminal investigation.  The Crown Attorney’s personal appointment book was also locked in the trunk.  The letter indicated that the police had been notified and an investigation was underway.   

 

On the basis of this letter, the IPC initiated a privacy complaint under the Freedom of Information and Protection of Privacy Act (the Act).   

 

Particulars concerning the incident:

 

The Ministry of the Attorney General (the Ministry) agreed to conduct an internal investigation into the circumstances surrounding the theft, and to provide the IPC with a written report.  The Ministry’s investigation report set out the following background and findings in relation to this incident:

 

In the late hours of June 21, 2002, or the early hours of June 22, 2002, two vehicles were stolen from the driveway outside the home of a Crown Attorney.  His home was broken into some weeks previously, and it is believed that spare keys to the vehicles were stolen at that time.  The trunk of one of the stolen vehicles contained a videotaped witness statement and handwritten notes pertaining to a complex and serious prosecution before the courts.  These had been brought home by the Crown to work on over the weekend in anticipation of Monday’s court date.  The trunk also contained a confidential legal memorandum pertaining to a sensitive ongoing criminal investigation that was received by the Crown Attorney that day, as well as his appointment book. 

 

 

The Ministry’s report indicates that the police conducted a vigorous and thorough investigation into the thefts, and that within two weeks of the theft both vehicles had been recovered.  The Ministry indicates that everything from the Crown Attorney’s car was recovered except a set of golf clubs and the videotaped witness statement.  All other property relating to Ministry work was recovered from the trunk.  To date, the videotape has not been recovered.

 

With respect to notification, on August 7, 2002, the Director of Crown Operations for that region wrote a letter to the witness whose videotaped statement was stolen from the trunk and notified him of the theft.  Although the Ministry acknowledged that there is additional personal information contained in the documents at issue, it has provided this office with a reasonable explanation as to why notice to these individuals is not appropriate under the circumstances. 

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Issue A:          Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except where they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

 

(h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;”

As noted in the Ministry’s report, the trunk contained a videotaped witness statement and handwritten notes pertaining to a prosecution before the courts.  The trunk also contained a confidential legal memorandum pertaining to an ongoing criminal investigation.  The Ministry’s report indicates that this document contained personal information.

 

I find that the information in the videotape, notes and legal memorandum is clearly personal information as defined in one or more of the subsections of section 2(1) of the Act as set out above.  The Ministry does not dispute this finding.

 

The IPC was also advised that the trunk contained the Crown Attorney’s personal appointment book; however, the Ministry’s report indicates that it did not contain names, addresses, or any other personal information.  During further discussions with the Ministry, I was advised that the only information regarding Ministry-related work consisted of times and dates for meetings with Ministry staff.  In view of the fact that the Crown Attorney’s appointment book did not contain any personal information related to Ministry business, its contents will not be discussed further in this report.    

 

Issue B:           Was the disclosure of the “personal information” in accordance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.  Clearly, in situations where there has been a theft of personal information, none of those circumstances apply.  The disclosure, therefore, was not in accordance with the Act. 

 

Additional Comments:

 

A previous investigation report dated June 15, 2001 (PC-000043-1) dealt with an investigation at the Ministry involving the theft of several briefcases from a Crown Attorney’s locked vehicle.  The briefcases contained a number of Crown files pertaining to criminal matters that were currently before the courts.  Another investigation report dated June 27, 2001 (PC-000026-1 & PC-010009-1) dealt with two privacy investigations at the Ministry involving two separate incidents in which laptop computers were stolen from the trunks of Crown Attorney’s vehicles.     

 

As a result of these incidents, the Ministry, in co-operation with the IPC, undertook a broad review of its policies and procedures for the handling of private and confidential materials.  In August 2001, the Ministry finalized its Policy on Confidential Information, which addresses the following four areas:

 

Part A – Document Security;

Part B – Transporting Confidential Information;

Part C – Faxing Procedures; and

Part D – Telephone Inquiry Procedures.    

 

In September 2001, the Deputy Attorney General distributed a memorandum to all Ministry staff, notifying them of the Ministry’s finalized Policy on Confidential Information.  The memorandum stressed the importance for all Ministry staff members to be aware of the requirements outlined in the Policy.  The Ministry should be commended for developing and implementing a comprehensive set of policies and procedures for ensuring the protection and proper handling of confidential material. 

 

However, while clearly certain staff (including Crown Attorneys) must take files out of the office in the performance of their duties, this incident raises ongoing concerns about the awareness of staff with regard to the Act and issues pertaining to privacy protection.  In this case, the theft of the Crown Attorney’s vehicles was an unfortunate incident over which the Ministry had no control.  However, it is evident that had the materials been brought into the house at night, rather than left in the trunk of the vehicle, the disclosure of these confidential materials could have been avoided in this instance. 

 

Part B of the Ministry’s Policy on Confidential Information relates to the transporting of confidential information, and outlines procedures that must be followed when it is necessary to remove confidential information for work-related purposes.  These procedures state, in part:

 

Keep the confidential information with you at all times, or keep it locked in a safe place.  If it is necessary to leave any confidential information or work related materials in your car, ensure that they are securely locked in the trunk of your car.  Do not leave any confidential information in a car that does not have a trunk.

 

In its report the Ministry indicates that its policy for transporting confidential information was complied with, although it would have been preferable for the material to have been taken into the house.  As noted above, information should only be left in the trunk of a car “if it is necessary”.  In this case, it is questionable whether it was “necessary” to leave the documents in the trunk overnight.  The Ministry notes, and I agree, that it is preferable for materials to be taken into the house.  To avoid future ambiguity regarding this matter, I will therefore recommend that the Ministry revise this aspect of its policy.               

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

1.      The information in question was personal information as defined in section 2(1) of the Act.

 

2.      The disclosure was inadvertent as it was caused by the theft of a Crown Attorney’s vehicle, which contained the personal information in question. 

 

RECOMMENDATIONS:

 

1.      I recommend that the Ministry revise Part B of its Policy on Confidential Information, particularly with respect to the procedures for transporting confidential information.  This policy should include measures for safeguarding material and ensuring the protection of personal information overnight.  Specifically, employees should be advised against leaving materials in locked vehicles overnight.

 

2.      I recommend that the Ministry take appropriate actions to ensure that all staff (including all Crown Attorneys) are notified and educated about these procedures.    

 

 

By July 22, 2003, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

 

 

                                                                                                            April 22, 2003

Shaun Sanderson Mediator