PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-020053-1

 

 

Ministry of Community, Family and Children's Services

 

 

 

 

 

March 25, 2003

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.       PC-020053-1

 

 

 

MEDIATOR:                                                Frances Soloway

 

 

 

INSTITUTION:                                Ministry of Community, Family and Children's    

                                                            Services

 

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

The Office of the Information and Privacy Commissioner (the IPC) received a letter from the Executive Director (the Director) of the Family Responsibility Office (FRO) setting out the circumstances that resulted in an inadvertent disclosure of certain personal information.  Specifically, correspondence intended for one support payor was sent to another support payor.  As a result, the IPC initiated a privacy complaint under the Freedom of Information and Protection of Privacy Act (the Act).

 

The Family Responsibility Office

 

The Family Responsibility Office operates under the authority of the Family Responsibility and Support Arrears Enforcement Act, 1996 to:

 

•         collect support payments and pay them to whom they are owed

•         enforce court-ordered support payments; and

•         enforce certain domestic contracts and paternity agreements filed with the court

 

The disclosure

 

The Director’s letter to the IPC set out the following details regarding the disclosure:

 

On October 22, 2002, a support payor (called party #1) received a letter (dated October 7, 2002) containing the first page of a letter addressed to party #2, but the second page of the letter was correctly addressed.

 

It would appear that party #2 to whom the first page was addressed received no correspondence at all from FRO.  However, party #1 subsequently mailed the entire FRO correspondence that he had received to party #2.

 

Party #2 wrote a letter to the Director of FRO, dated October 25, 2002, indicating that he received a letter from another FRO client.  The letter from party #2 was received by FRO on October 30, 2002 and forwarded to the FRO correspondence unit on October 31, 2002.

 

Party #1 contacted FRO on October 31, 2002, about the issue and indicated that he had not received his own, complete correspondence.

 

During the investigation, I obtained the following additional information concerning the procedures for mailing out correspondence from the Director’s office that were in existence at the time of the incident.

 

When the Director received correspondence that required her response, it was initially routed to a Client Service Associate (the CSA), who in turn retrieved the relevant file and prepared a response for the Director’s approval and signature.  Once the Director approved and signed the response letter, she then provided it to her Executive Assistant (the EA), who in turn mailed the letter and returned the file back to the CSA.  With respect to the incident in question, it appears that the first page of the letter in question was accidentally mixed up with another letter.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information "personal information" as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part, that “personal information” means recorded information about an identifiable individual.

 

I have reviewed the record at issue, namely the first page of the letter dated October 7, 2002 addressed to party #2 and sent to party #1.  The letter contains party #2’s name and address and responds to certain issues with respect to the registration and monitoring of his support order.  I find that this information is clearly personal information as defined in section 2(1) of the Act.   FRO does not dispute this finding.

 

Was the disclosure of the personal information in accordance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.  Clearly, in light of the circumstances surrounding this complaint, I find that none of them apply.  FRO does not dispute this finding.

 

Steps taken by FRO upon learning of the incident

 

1.            FRO investigated the circumstances that led to the incident and concluded that a breach did in fact occur as a result of human error.

 

2.            The misdirected letter in question did not include any case specific information but rather general policy and procedures of the program.  For this reason, the case numbers were not changed.

 

3.            Letters of apology were sent to both parties in question.

 

4.            FRO made a number of changes to the way the Director’s office responds to correspondence.  Specifically, one individual, the CSA, is responsible for routing correspondence to and from the Director’s Office.

 

CONCLUSION:

 

I commend FRO for its prompt response when learning of the improper disclosure of personal information and for seeking the assistance of this office.  I have reached the following conclusions based on the results of our investigation:

 

1.      The information in question is personal information as defined in section 2(1) of the Act.

 

2.      The personal information was disclosed contrary to the Act.

 

3.      The disclosure was inadvertent and was a result of human error.

 

In view of the steps undertaken by FRO in response to this incident, no further action is necessary with respect to this matter and this file is now closed.

 

 

 

 

 

_______________________________                      ____________  March 25, 2003_________

Frances Soloway

Mediator