Privacy Reports
Decision Information
SUMMARY OF COMMISSIONER INITIATED COMPLAINT: The Acting Freedom of Information Co-ordinator for the Toronto Police Service (the Police) contactedthe Office of the Information and Privacy Commissioner/Ontario (the IPC) to report a privacy breach.Specifically, a member of her office, in responding to two unrelated requests for the requesters' owncriminal records, placed the records in the wrong envelopes, sending each record to the wrong recipient.On the basis of this information, the IPC initiated a privacy complaint under the Municipal Freedom ofInformation and Protection of Privacy Act (the Act ). The disclosure The Police explained that once an access decision is approved in response to a request under the Act , theanalyst assigned to process the request is responsible for, among other things, mailing the correspondenceand, when access is granted, including the responsive record. In this case, the analyst placed the records inthe wrong envelopes and the criminal record of each requester was mailed to the other. On receiving her envelope, Requester A telephoned the Police to inform them that she had received acriminal record for another individual (Requester B). She correctly concluded that her own criminalrecord had been mailed to someone other than herself. She returned Requester B's record to the Police. The Police checked their files and confirmed the error. The analyst contacted Requester B and advised her of the mistake. Requester B informed the analyst thatshe had moved the previous week and had not received an envelope from the Police. DISCUSSION: The following issues were identified as arising from the investigation: Is the information "personal information" as defined in section 2(1) of the Act ? Section 2(1) of the Act states, in part, that "personal information" means recorded information about anidentifiable individual. The Police acknowledge that the information contained in the two criminal records is the "personalinformation" of the respective requesters, as defined in section 2(1) of the Act . I agree. Was the disclosure of the "personal information" in accordance with section 32 of the Act ? Section 32 of the Act sets out a number of circumstances under which an institution may disclose personalinformation. In light of the circumstances surrounding this case, I find that none of them apply. The Policedo not dispute this conclusion. Steps taken after the breach was identified The Acting Freedom of Information Co-ordinator notified her managers The Police notified Requester B of the error. Requester B returned to her previous residence and enquired with the building superintendentwhether the envelope addressed to her had been received. She was informed that it had not. She also askedthe superintendent and the new tenant in her former apartment to return the envelope to the Police ifreceived. The Acting Freedom of Information Co-ordinator provided Requester B's name and address to thePolice's mailroom supervisor and instructed him to notify her immediately should the envelope bereturned. To date, the envelope has not been returned. The Police provided both requesters their own criminal records. The Acting Freedom of Information Co-ordinator explained to both requesters the steps that havebeen taken to address the situation and offered apologies on behalf of the Police. The Police informed both requesters that the matter would be reported to the IPC and, at herrequest, provided Requester A with a copy of the report of their investigation into this matter. The Police notified the IPC of the breach of privacy and submitted their investigation report. All staff within the Police's Freedom of Information Unit were informed of the error andreminded, verbally and in writing, that when mailing personal information, they must double-check thatthe personal information in the records being sent matches that of the recipient on the accompanyingenvelope. The Police fully acknowledge the seriousness of the privacy breach. They submit that the disclosure wasthe result of human error and all staff have been reminded and are fully aware of the need to placecorrespondence in the correct envelope. After considering the circumstances in this case, I agree that the disclosure of personal information wasthe result of human error. I also feel, however, that in light of the particularly sensitive nature of thepersonal information handled by the Police's Freedom of Information Unit, such information must bemanaged with extra care. I will address this in my recommendations below. CONCLUSION: I have reached the following conclusions based on the results of my investigations: The information in question is "personal information" as defined in section 2(1) of the Act . The disclosure of the "personal information" was not in accordance with section 32 of the Act . The disclosure was inadvertent and was the result of human error. RECOMMENDATIONS: Because of the potential for human error, the mailing of records containing personal information shouldbe subject to checking procedures so that if an error occurs at the initial stage, there is another opportunityto correct the mistake. Accordingly, I recommend that the Police develop a written policy and procedurefor Freedom of Information Unit staff to follow that includes mechanisms for ensuring that errors asdescribed above do not occur. Specifically, when records containing personal information are prepared formailing by a Unit staff member, another staff member should independently confirm that the intendedrecipient is correctly identified on the accompanying envelope. I recommend that the Police ensure that the appropriate staff be made fully aware of the policy andprocedure described in Recommendation 1. Within three months of receiving this report, the Police should provide the Office of the Information andPrivacy Commissioner with proof of compliance with the above recommendations. Alex Kulynych Investigator November 17, 2004
Decision Content
PRIVACY COMPLAINT REPORT
PRIVACY COMPLAINT NO. MC-040022-1
INSTITUTION: Toronto Police Services Board
SUMMARY OF COMMISSIONER INITIATED COMPLAINT:
The Acting Freedom of Information Co-ordinator for the Toronto Police Service (the Police) contacted the Office of the Information and Privacy Commissioner/Ontario (the IPC) to report a privacy breach. Specifically, a member of her office, in responding to two unrelated requests for the requesters’ own criminal records, placed the records in the wrong envelopes, sending each record to the wrong recipient. On the basis of this information, the IPC initiated a privacy complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act).
The disclosure
The Police explained that once an access decision is approved in response to a request under the Act, the analyst assigned to process the request is responsible for, among other things, mailing the correspondence and, when access is granted, including the responsive record. In this case, the analyst placed the records in the wrong envelopes and the criminal record of each requester was mailed to the other.
On receiving her envelope, Requester A telephoned the Police to inform them that she had received a criminal record for another individual (Requester B). She correctly concluded that her own criminal record had been mailed to someone other than herself. She returned Requester B’s record to the Police.
The Police checked their files and confirmed the error.
The analyst contacted Requester B and advised her of the mistake. Requester B informed the analyst that she had moved the previous week and had not received an envelope from the Police.
DISCUSSION:
The following issues were identified as arising from the investigation:
Is the information “personal information” as defined in section 2(1) of the Act?
Section 2(1) of the Act states, in part, that “personal information” means recorded information about an identifiable individual.
The Police acknowledge that the information contained in the two criminal records is the “personal information” of the respective requesters, as defined in section 2(1) of the Act. I agree.
Was the disclosure of the “personal information” in accordance with section 32 of the Act?
Section 32 of the Act sets out a number of circumstances under which an institution may disclose personal information. In light of the circumstances surrounding this case, I find that none of them apply. The Police do not dispute this conclusion.
Steps taken after the breach was identified
• The Acting Freedom of Information Co-ordinator notified her managers.
• The Police notified Requester B of the error.
• Requester B returned to her previous residence and enquired with the building superintendent whether the envelope addressed to her had been received. She was informed that it had not. She also asked the superintendent and the new tenant in her former apartment to return the envelope to the Police if received.
• The Acting Freedom of Information Co-ordinator provided Requester B’s name and address to the Police’s mailroom supervisor and instructed him to notify her immediately should the envelope be returned. To date, the envelope has not been returned.
• The Police provided both requesters their own criminal records.
• The Acting Freedom of Information Co-ordinator explained to both requesters the steps that have been taken to address the situation and offered apologies on behalf of the Police.
• The Police informed both requesters that the matter would be reported to the IPC and, at her request, provided Requester A with a copy of the report of their investigation into this matter.
• The Police notified the IPC of the breach of privacy and submitted their investigation report.
• All staff within the Police’s Freedom of Information Unit were informed of the error and reminded, verbally and in writing, that when mailing personal information, they must double-check that the personal information in the records being sent matches that of the recipient on the accompanying envelope.
The Police fully acknowledge the seriousness of the privacy breach. They submit that the disclosure was the result of human error and all staff have been reminded and are fully aware of the need to place correspondence in the correct envelope.
After considering the circumstances in this case, I agree that the disclosure of personal information was the result of human error. I also feel, however, that in light of the particularly sensitive nature of the personal information handled by the Police’s Freedom of Information Unit, such information must be managed with extra care. I will address this in my recommendations below.
CONCLUSION:
I have reached the following conclusions based on the results of my investigations:
- The information in question is “personal information” as defined in section 2(1) of the Act.
- The disclosure of the “personal information” was not in accordance with section 32 of the Act.
- The disclosure was inadvertent and was the result of human error.
RECOMMENDATIONS:
- Because of the potential for human error, the mailing of records containing personal information should be subject to checking procedures so that if an error occurs at the initial stage, there is another opportunity to correct the mistake. Accordingly, I recommend that the Police develop a written policy and procedure for Freedom of Information Unit staff to follow that includes mechanisms for ensuring that errors as described above do not occur. Specifically, when records containing personal information are prepared for mailing by a Unit staff member, another staff member should independently confirm that the intended recipient is correctly identified on the accompanying envelope.
- I recommend that the Police ensure that the appropriate staff be made fully aware of the policy and procedure described in Recommendation 1.
Within three months of receiving this report, the Police should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.
Alex KulynychInvestigator
|
|
|