PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC-050034-1

 

 

City of Vaughan

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC-050034-1

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            City of Vaughan

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) regarding the City of Vaughan (the City).

 

Specifically, the complainant is concerned that his identity as a requester making a Freedom of Information (FOI) request under the Act was inappropriately disclosed to the following three parties: (1) the City’s Director of Legal Services; (2) an external lawyer representing the City in a separate legal dispute involving the complainant’s spouse; and (3) a City Councillor.

 

Background:

 

On August 2, 2005, the complainant filed an FOI request requesting the expense reports of two civil servants employed by the City.

 

On August 7, 2005, the complainant received an e-mail from a City Councillor (the Councillor) written in response to an e-mail question from the complainant on a different issue.  In the response, the Councillor stated: “You have just initiated a request and have had it widely circulated I think needlessly.”  Based on this e-mail, the complainant was given the impression that the Councillor had knowledge of the fact that he had submitted an FOI request.

 

On August 15, 2005, a lawyer that had been retained by the complainant’s spouse in a legal action against the City informed the complainant that the City’s external lawyer had inquired about the complainant’s FOI request.  Based on this information, the complainant had concluded that the nature of his FOI request, as well as his identity as an FOI requester, had been disclosed to the City’s external lawyer.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(h)               the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual … .

 

In this instance, the information in question is the complainant’s name, information relating to the fact that the complainant has submitted an FOI request, and information relating to the nature of that request.

 

Previous Orders and Privacy Complaint Reports issued by this Office have taken the position that someone’s identity as an FOI requester under the Act qualifies as that individual’s personal information under section 2(1) of the Act.  (See, for example, Privacy Complaints MC-040012-1 and MC-050005-1 as well as Order PO-1998).

 

In this case, the City does not dispute that the identity of the complainant as an FOI requester is the complainant’s personal information.

 

Based on these factors, I am satisfied that the information in question is the complainant’s personal information.

 

Was personal information disclosed?

 

The complainant is concerned that his identity as an FOI requester was disclosed to three separate parties: (1) the City’s Director of Legal Services; (2) an external lawyer representing the City in a separate legal dispute involving the complainant’s spouse; and (3) a Councillor.

 

In this case, the City acknowledges that the complainant’s identity had been disclosed to both the Director of Legal Services as well as the external lawyer.  However, the City denies that the requester’s identity had been disclosed to the Councillor.

 

With respect to the Councillor, the City asserts that the Councillor’s reference to the complainant’s “request” in the August 7, 2005 e-mail was not a reference to the complainant’s FOI request, but a reference to a separate non-FOI request made by the complainant for copies of City policies on alcohol consumption by City staff.  The City maintains that the particulars of the complainant’s FOI request were never disclosed to the Councillor.

 

I have reviewed copies of the e-mails in question including the Councillor’s response and accept the explanation provided by the City.  I note that, on August 6 and August 5, the complainant requested copies of newsletters and policies in e-mails that were sent directly to the Councillor. Based on this information, I am satisfied that there is no evidence to indicate that the complainant’s identity as an FOI requester had been disclosed to the Councillor.

 

I will now proceed to consider the permissibility of the disclosure to the City’s Director of Legal Services and the disclosure to the external lawyer retained by the City.

 

Was the disclosure of the “personal information” in accordance with section 32(d) of the Act?

 

In this instance, the City relies on section 32(d) of the Act to justify the internal disclosure of the complainant’s identity as an FOI requester to the City’s Director of Legal Services, as well as the disclosure to the external lawyer retained by the City.

 

The City bases its position on the fact that the complainant’s spouse is involved in a legal action against the City.  The City states that, in order to determine whether the subject-matter of the complainant’s FOI request was subject to solicitor-client privilege, (and therefore exempt from disclosure) the City deemed it necessary to consult with legal counsel.  In doing so, it disclosed the particulars of the FOI request, including the complainant’s identity to the internal and external lawyers.

 

With respect to the internal disclosure to its Director of Legal Services, the City states:

 

There is a correlation between the requested records for the two City employees and the fact that they are named in a wrongful dismissal and harassment claim. The Director of Legal Services needed to know the name of the requester to determine whether or not the correlation between the requested records for the two City employees and the fact that they are named in the wrongful dismissal and harassment claim has legal merit and to make a legal decision as to whether … these records [are] subject to Solicitor-client Privilege … .

 

The City relies on similar reasoning to justify the disclosure to the external legal counsel.

 

Section 32 of the Act states, in part:

 

 32.  An institution shall not disclose personal information in its custody or under its control except,

 

…

 

(d)               if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution’s functions … [emphasis added].

 

This section of the Act permits an institution to disclose personal information (such as the identity of an FOI requester) to an officer or employee of an institution as long as the disclosure is “necessary and proper in the discharge of the institution’s functions.”

 

In order to determine whether section 32(d) applies to this situation, it is necessary to determine whether the disclosures that took place were necessary in order to facilitate the institution’s response to the FOI request.  To assist this process, it is helpful to look at the principles underlying Ontario’s freedom of information and protection of privacy regime, as set out in the Act, which states at section 1:

 

The purposes of this Act are,

 

(a)                to provide a right of access to information under the control of institutions in accordance with the principles that,

 

(i)                 information should be available to the public,

 

(ii)               necessary exemptions from the right of access should be limited and specific, and

 

(iii)             decisions on the disclosure of information should be reviewed independently of the institution controlling the information; and

 

(b)               to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information.

 

This provision clearly reflects the joint purposes of the Act: to make government records accessible to the public by limiting barriers to the right of access, and to protect the privacy and confidentiality of individuals that interact with government.

 

With respect to the facts involved in this privacy complaint, it is incumbent upon the City to be guided by the joint purposes underlying the Act.

 

An additional consideration is that employees of an institution involved in the processing of a request for general records rarely require the identity of a requester in order to make a determination as to whether or not a particular request may be granted.  This principle is based on the fact that once records are disclosed to a particular individual, the institution no longer controls the information, and the requester is able to share the records with whomever he or she pleases.  As such, disclosure to one individual can therefore be equated with “disclosure to the world.”

 

IPC Practice 16: Maintaining the Confidentiality of Requesters and Privacy Complainants states:

 

Any employee who assists the Co-ordinator in responding to requests for personal information should be reminded that all information about the requester’s identity and the request should remain confidential.  This information can be disclosed to co-workers, managers, supervisors or officers of the institution only if they need it to perform their duties and carry out a function of the institution.

 

This principle has also been enunciated in the 2000 Annual Report issued by the IPC (see page 4) as well as various Orders and Privacy Complaint Reports issued by this office. (See, for example, Order PO-1998).

 

As expressed in IPC Practice 16, there is an exception to this principle of confidentiality.  The identity of a requester may be internally disclosed where the requester is seeking access to his or her own personal information, and the provision of the identity of the requester is necessary in order to properly process the request.  In this case, the records at issue were expense reports of two civil servants and did not include the personal information of the requester.

 

Therefore, I am of the view that the disclosures to the City’s internal and external legal counsel were not necessary in order to determine whether the requested records were exempt under the FOI provisions of the Act.

 

I do not accept the City’s position that legal counsel needed the requester’s name in order to determine the appropriate response to the FOI request.  From the City’s perspective, the impact of the disclosure of these records would have been the same regardless of whether the requester happened to be the spouse of someone involved in a legal dispute with the City, or some other member of the public.  There is no connection between an institution’s ability to claim the solicitor-client privilege exemption and the identity of an FOI requester.  As expressed above, disclosure to one person is the equivalent of “disclosure to the world.”  To reach any other conclusion would unreasonably create a barrier to the right of access, and would compromise the underlying purposes of the Act.

 

Based on this reasoning, I conclude that the disclosures in question were not in accordance with section 32(d) of the Act.

 

CONCLUSION:

 

I have reached the following conclusions based on the results of my investigations:

 

•         The information in question qualifies as “personal information” as defined in section 2(1) of the Act.

 

•         The identity of the complainant as an FOI requester was not disclosed to the Councillor.

 

•         The disclosure of the identity of the complainant as an FOI requester to the City’s Director of Legal Services was not in compliance with the Act.

 

•         The disclosure of the identity of the complainant as an FOI requester to the external lawyer retained by the City was not in compliance with the Act.

 

RECOMMENDATION:

 

•         The City should engage in a program of training all staff that may be involved in processing FOI requests on the importance of maintaining confidentiality with respect to the identity of requesters.

 

By June 30, 2006, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

 

 

Report Signed By                                                                               March 31, 2006                      

Mark Ratner Investigator