PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. PC-030014-1

 

 

Workplace Safety and Insurance Board

 

 

 

 

 

 

 

         

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   PC-030014-1

 

MEDIATOR:                                                            Maria Tzimas

 

INSTITUTION:                                            Workplace Safety and Insurance Board

 

 

SUMMARY OF COMMISSIONER INITIATED COMPLAINT:

 

On March 11, 2003, the Office of the Information and Privacy Commissioner/Ontario (the IPC) received an e-mail message from the Workplace Safety and Insurance Board (WSIB) regarding a possible privacy breach relating to correspondence that had been generated by the WSIB in December 2001.  It explained that a claimant of the WSIB sent an e-mail to them in March 2003 advising that system generated forms relating to two other claimants were attached to his correspondence.

 

On the basis of this information from the WSIB, the IPC initiated a privacy complaint under the Freedom of Information and Protection of Privacy Act (the Act).

 

Particulars Concerning the Incident

 

The WSIB agreed to conduct an internal investigation into the circumstances surrounding the possible breach and to provide the IPC with a written response.  The WSIB’s response set out the information outlined below.

 

On March 5, 2003, the WSIB received an e-mail from a claimant advising them of a potential privacy breach as a result of receiving correspondence belonging to other individuals.  On March 11, 2003, the WSIB contacted the claimant by telephone to discuss the particulars of the incident.  The claimant indicated that he received a letter from the WSIB in December 2001 and attached to it were two or three other pieces of mail belonging to other individuals.  The claimant explained that he had only kept one document because all of the other documents had been damaged significantly and he therefore threw them out.  The claimant agreed to return the one document to the WSIB.

 

On March 21, 2003, the WSIB sent one of its Investigators to the claimant’s home to retrieve the document sent to him in error.  At this time, the claimant signed an undertaking confirming that he has not retained this document in any form whatsoever, nor any portion of the information.  The undertaking also confirmed that the claimant has not disclosed, nor will he disclose in the future any of the information to another person. 

 

Upon retrieval of the document, the WSIB proceeded to notify the individual whose personal information was disclosed (affected party) by way of a letter dated April 2, 2003.  In this letter, the affected party was advised that a copy of correspondence from his claim file dated December 12, 2002 was inadvertently mailed to another WSIB claimant, that steps were taken to retrieve the document from the claimant, and that the WSIB is looking at ways of preventing this kind of incident from recurring.  The WSIB also apologized to the affected party for this error.

 

The WSIB provided the IPC with a copy of the signed undertaking dated March 21, 2003, a copy of the notification letter to the affected party and a copy of the document that was inadvertently sent to the wrong claimant.

 

In its report to the IPC, the WSIB attempted to piece together the events that took place in and around December 2001 that would have lead to this incident, keeping in mind the challenges that exist in going back in time by approximately 14 months.  At issue here are two pieces of correspondence:  a letter dated December 13, 2001 addressed to a WSIB claimant and a letter dated December 12, 2001 addressed to an employer in relation to the affected party who is also a WSIB claimant.  Both of the letters would have been authored in the WSIB Ottawa office and then picked up and delivered to the mailroom located in the same building.  The WSIB provided certain information with respect to the processing of mail, which  includes the use of a particular machine for the handling of outgoing mail.  The mail would then have been sorted and assigned to different job lots as the equipment has different settings for single page and multi-page documents. 

 

The WSIB explained that its problem log indicates that a technician was called in on December 5 and 6, 2001 to repair a recurring problem with a shield in the base feeder of the machine.  On December 7, 2001, the take-away belts were cleaned and adjusted, on December 17, 2001, the turner component of the machine was serviced and on December 27, 2001 new turner parts were ordered.

 

The WSIB went on to explain that, from the information available, it is their understanding that the claimant received one or more documents showing evidence of “mangling” by a machine.  This leads them to believe that the one page letter relating to the affected party received by the claimant may have been caught up inside the mail machinery and was picked up and folded along with the letter to the claimant.  The WSIB suspects that the turner component that was adjusted and then later replaced could have been the cause of this problem. 

 

The WSIB also reported that the malfunction of machinery is taken seriously by WSIB staff and that every effort is made to ensure that mailroom machinery is operating properly.  Technicians are notified whenever problems with the equipment are encountered.  The WSIB is not aware of any similar incidents since the one in December 2001, which is currently under investigation.   

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Issue A:  Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

(c) any identifying number, symbol or other particular assigned to the individual,

 

(d) the address, telephone number, fingerprints or blood type of the individual,

 

(e) the personal opinions or views of the individual except where they relate to another individual,

 

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

 

(g) the views or opinions of another individual about the individual, and

 

(h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

The record at issue in this investigation consists of a letter addressed to an employer that contains the name and medical information of a claimant of the WSIB who has been identified as an affected party in this privacy complaint.  I find that the information contained in this letter is clearly personal information as defined in one or more of the subsections of section 2(1) of the Act as set out above.  The WSIB does not dispute this finding.

 

Issue B:  Was the Disclosure of the “personal information” in accordance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information.  Clearly, in situations where there has been an inadvertent disclosure as a result of a technical glitch, as appears to be the case in this investigation, none of the circumstances outlined in section 42 of the Act apply.  The disclosure, therefore, was not in accordance with the Act.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigation:

 

1.  The information in question was personal information as defined in section 2(1) of the Act.

 

2.  The disclosure was inadvertent and appears to have been caused by a technical glitch of the mail equipment used at the WSIB.

 

In light of the actions taken by the WSIB with respect to this matter and in the circumstances of this case, no further action is necessary and this file is now closed.

 

 

 

 

 

 

 

 

 

                                                                                                            July 4, 2003

Maria Tzimas Mediator