PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-020023-1

 

 

Halton Catholic District School Board

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-020023-1

 

 

 

MEDIATOR:                                                            Warren Morris

 

 

 

INSTITUTION:                                            Halton Catholic District School Board

 

 

 

SUMMARY OF COMPLAINT:               

 

The office of the Information and Privacy Commissioner/Ontario (the IPC) received a privacy complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) involving the Halton Catholic District School Board (the Board).  The complainant is the father of a child who attended two schools within the Board.

 

The privacy complaint has two elements.  First, the complainant has stated that his personal information was collected by the school and placed in his child’s Ontario Student Record (OSR).  The complainant states that the principal placed a copy of a family court transcript, a photograph of the complainant, and a short letter from the complainant’s ex-spouse’s lawyer, in his child’s OSR in 1998.  The complainant indicates that his ex-spouse’s lawyer sent this information to the school.  The complainant states that he was not notified that the school was collecting these documents and photograph nor was he given any notice that the school was maintaining this information in his child’s OSR.  The complainant only became aware of these documents being held by the Board as a result of his request to view the contents of his child’s OSR.

 

The second part of the complaint concerns personal information contained in a temporary court order that the complainant claims was inappropriately disclosed by the school principal to a private investigator hired by his ex-spouse.  The complainant submitted a copy of an affidavit from the private investigator giving his perspective on the incident.  The affidavit states that on February 8, 1999, the principal received a complaint about a vehicle in the school area.  The principal approached the individual in the vehicle.  The individual indicated to the principal that he was a private investigator observing the complainant’s behaviour.  The principal requested that he be kept informed about the surveillance and advised the private investigator that the complainant should not be within 100 metres of the school property.  The complainant states that the principal knew the complainant should not be within 100 meters of the school by virtue of this information being part of a temporary family court order, a copy of which was said to be in his child’s OSR.  The complainant states that the disclosure of this information from the principal to the private investigator violated his privacy.

 

DISCUSSION:

 

Nature of the relevant information in this complaint

 

Although the complainant expresses concern about where the Board kept the records - namely his child’s OSR - this report will focus on whether or not the Board’s actions were in accordance with the Act.  A determination as to where, within the Board, the records are to be maintained is not addressed in the Act.

 

During my investigation, the complainant provided me with a copy of all the records pertaining to him that he found in his child’s OSR.  The records included the following: 

 

• Letter from the Board’s legal counsel to the Board’s Superintendent – Human Resources, dated September 16, 1999, indicating a full court judgement enclosed;
• The last portion of a transcript of hearing containing the judge’s oral reasons for decision on an interim motion involving custody/access issues;
• 3 pages of judge’s hand written endorsements of the court record;
• 2 draft court orders, reflecting the judge’s endorsements;
• Final Order cover page with a photograph of the complainant;
• Faxed letter from complainant’s ex-spouse’s counsel to school principal regarding restraining order;
• First page of court order; and
• Faxed letter from complainant’s ex-spouse’s counsel to school principal, enclosing a copy of a court order.

 

The Board was not able to verify which of the above records had been in the complainant’s child’s OSR when it had been viewed by the complainant.  The Board states that shortly after the complainant voiced his objections to the records being maintained by the Board in his child’s OSR, the principal removed the records.  The Board states that it is no longer in possession of these records.  The Board could not state with certainty whether the records were destroyed or whether the records remain in the possession of the principal, who is no longer a Board employee. 

 

Based on the information provided to me, I am satisfied that the records listed above were, at one time, in the possession of the Board.

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states the following:

"personal information" means recorded information about an identifiable individual, including,

…

(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

“record” means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes,

 

(a) …a photograph…and any copy thereof…

 

In order to meet the definition in section 2(1)(h) of the Act, personal information must be “about” an identifiable individual.  I have reviewed all of the records listed above.  Although most of the records also contain the information of others, each contains at least a reference to the complainant and is clearly information about the complainant.  It is also clear that “records” include photographs.  Accordingly, I have concluded that all the records, including the photograph, qualify as the complainant’s “personal information” as defined by the Act.

 

Was the collection of the “personal information” in accordance with section 28 of the Act?

 

During my investigation, the Board clarified that they had not taken any initiative to collect the complainant’s personal information.  Although the Board acknowledged receiving information related to, and including, the court order, it did not seek out this information.  Even if it had sought to collect such information, the Board’s position is that they have a duty under the Education Act to use every reasonable effort in order to ensure the safety of students.  Further, the Board stated that since the school was specifically named in the court order, the Board felt it was within its rights to be kept informed and to make such information available to the principal. 

 

The fact that the Board did not actively solicit the information is not material to my investigation.  Although the school was specifically named in one of the court orders, there is nothing to indicate that the Board was a party to the court proceedings or otherwise required to receive notice of the court proceeding.

 

Of the information at issue listed above, there is one record whose character is different from the others in the list.  This is the letter from the Board’s legal counsel to the Board’s Superintendent.

The record is communication from the Board’s legal representative to the Board.  Since the Board did not collect this record, it is not necessary to address it in this section of the report.

 

Section 28 of the Act states the following:

….

(2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

The Board needs to satisfy only one of the three criteria identified in section 28(2) in order to be in compliance with the section. 

Necessary to the proper administration of a lawfully authorized activity

 

Section 265(1) of the Education Act states:

 

It is the duty of a principal of a school, in addition to the principal's duties as a teacher,

…

(j) to give assiduous attention to the health and comfort of the pupils, to the cleanliness, temperature and ventilation of the school, to the care of all teaching materials and other school property, and to the condition and appearance of the school buildings and grounds;

…

(m) subject to appeal, to refuse to admit to the school or classroom a person whose presence in the school or classroom would in the principal's judgment be detrimental to the physical or mental well-being of the pupils;

…

The Education Act provides authority for the school principal to refuse persons’ admission to the school or classroom in certain circumstances.  The court order and accompanying records are reasonably connected to the principal’s exercising his/her authority under subsection 265(m) of the Education Act.  As well, in view of the court order, the health and comfort of pupils was potentially at issue (subsection 265(j)).  As such, I conclude that the collection of the records was reasonably necessary to the proper administration of a lawfully authorized activity, and therefore in accordance with section 28 of the Act.

Did the institution provide notice of the collection in accordance with section 29 of the Act?

The provisions of the Act relating to the requirement that an institution notify individuals of personal information collection is found in Section 29.  Sections 29(2) and 29(3) of the Act read:

(2) If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,

(a)        the legal authority for the collection;

(b)        the principal purpose or purposes for which the personal information is intended to be used; and

(c)        the title, business address and business telephone number of an officer or employee of the institution who can answer the individual's questions about the collection.

(3) Subsection (2) does not apply if,

(a)        the head may refuse to disclose the personal information under subsection 8(1) or (2) (law enforcement) or section 8.1 (Remedies for Organized Crime and Other Unlawful Activities Act, 2001);

(b)        the Minister waives the notice; or

(c)        the regulations provide that the notice is not required.

 

The complainant states that he did not receive any kind of notice indicating that the Board was collecting his personal information.  During my investigation, the Board acknowledged that no notification was given to the complainant.  In their response to our office, the Board states that it did not feel that it was required to provide the complainant a notification that this information was being collected since the information was a direct result of a court proceeding in which the complainant was named.  The Board’s position was that the complainant would have complete knowledge of the court proceedings and the order.  The fact that the complainant was aware of the court proceedings and the records related to them, does not in any way serve as notice to the complainant that the records were being collected and maintained in his child’s OSR.  As such, I am satisfied that the complainant did not receive notice from the Board and was unaware of the Board’s collection of the records until he viewed his child’s OSR.

 

Based on the above information and my review of and conclusion that none of the provisions of section 29(3) of the Act apply, I conclude that the Board did not provide the notice of collection required under section 29(2) of the Act.

 

Is the disclosure of personal information in accordance with the Act?

The complainant has stated that the then principal at his child’s school inappropriately disclosed information concerning the restraining order to a private investigator hired by his ex-spouse.  To support his claim, the complainant has provided a copy of an affidavit sworn by the private investigator that included the statement “…(the principal)… advised that …(the complainant)… should not be within 100 meters of the school property”. 

During my investigation, the Board responded by stating that they discussed the matter with the former principal.  The former principal recalled the conversation with the private investigator.  Contrary to the affidavit, it was the principal’s recollection that it was the private investigator that informed him of the court order.  Thus it is the Board’s position that there was no disclosure of personal information.  

Since the private investigator was an independent witness and provided his evidence by sworn affidavit, I accept his account and am satisfied that the disclosure of the complainant’s personal information did in fact occur as stated in the affidavit of the private investigator. 

The obligations of an institution with respect to the disclosure of personal information are governed by section 32 of the Act.  Under the Act, an institution cannot disclose personal information in its custody or under its control except in accordance with the specific circumstances outlined in sections 32(a) through to 32(l) of the Act.

The relevant subsections of section 32 read:

An institution shall not disclose personal information in its custody or under its control except,

…

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose;

…

(e)        for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act or a treaty;

…

I have reviewed the provisions of section 32 of the Act.  In my view, section 32 does not authorize this disclosure, and as there are no other provisions of the Act that would permit it, I conclude that the disclosure was not in compliance with the Act.

 

OTHER ISSUES ARISING FROM THIS INVESTIGATION:

 

During my investigation, the Board stated that shortly after the complainant voiced his objections to the records being maintained in his child’s OSR, the principal removed the records.  Unfortunately, the Board could not state with certainty whether the records were destroyed or whether the records remain in the possession of the principal, who is no longer a Board employee.  This raises two concerns, first the safe keeping of records, and second the retention and destruction of records.

 

Section 3(1) of Regulation 823, as amended, states that:

 

Every head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.

 

Since the Board was not able to identify where the records are today, I am not satisfied that the Board has taken reasonable measures to prevent the unauthorized access to these records.  As such, I conclude that section 3(1) of Regulation 823 has not been complied with.  As well, I am not satisfied that appropriate processes are in place with respect to the retention and/or destruction of records.

 

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

1.                  The records at issue contain the complainant’s “personal information” as defined by section 2(1) of the Act;

 

2.                  The collection of the complainant’s personal information was in accordance with section 28 of the Act as it was necessary to the proper administration of a lawfully authorized activity;

 

3.                  The Board did not provide the notice of the collection in accordance with section 29 of the Act;

 

4.                  The disclosure of the complainant’s personal information was not in compliance with the Act; and

 

5.                  Reasonable measures to prevent the unauthorized access to records have not been taken, contrary to section 3(1) of Regulation 823.

 

RECOMMENDATIONS:

 

1.                  I recommend that the Board take steps to remind their staff the importance of adhering to the Municipal Freedom of Information and Protection of Privacy Act, specifically with respect to the collection and disclosure of personal information.  Consideration should be given to section 28, the notification requirements contained in section 29 and the disclosure provisions in section 32 of the Act; and

 

2.                  I recommend that the Board create a policy/protocol to address the handling of personal information within the Board’s possession.  This policy/protocol should address the following:

 

a.                   Disclosure - verbally and otherwise, of records containing personal information;

 

b.                  Retention - what is to be done with records containing personal information removed from a student’s OSR; and

 

c.                   Destruction of records containing personal information – ensure that this section  is prepared in compliance with the standards set out in IPC Practices Number 26 titled “Safe and Secure Disposal Procedures for Municipal Institutions”;

 

With respect to the above recommendations, the Board should provide this office with proof of compliance by May 24, 2004.

 

 

 

 

 

 

 

Original Signed by:                                                                             February 24, 2004

Warren Morris Mediator