PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC07-64

 

 

City of Vaughan

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC07-64

 

 

 

INVESTIGATOR:                                       Cathy Hamilton

 

 

 

INSTITUTION:                                            City of Vaughan

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a privacy complaint from an individual involving the City of Vaughan (the City).  The complaint was that the City had improperly used and disclosed her personal information, in contravention of the provisions of the Municipal Freedom of Information and Protection of Privacy Act (the Act), to mail out applications for a credit card, called the MuniCard, on behalf of a credit card company.

 

Background Information to the Complaint

 

The complainant indicated that:

 

The subject of this complaint is that the City of Vaughan used their tax roll database to mail out applications for a credit card.  The City was paid by the company (GE Capital/MuniCard) to do this.  The credit card application and information/instruction package uses the tax roll personal information and specifically pre-printed name, address and tax roll number as the base information to be used when the credit card application is filled out and submitted.

 

The complainant provided to the IPC a copy of correspondence she had received from MuniCard, which was contained in an envelope with the City’s letterhead displayed on it.  Inside the envelope was an application entitled “MuniCard MasterCard Application” and a cover letter, on MuniCard letterhead, which stated, in part:

 

            It’s here!  A no annual fee credit card that:

1.      Is specifically for the citizens of Vaughan

2.      Helps Property Owners pay their property taxes AND

3.      Gives cardholders special discounts at participating local businesses!!

In addition, the cover letter set out the complainant’s 19 digit Property Tax Roll Number (Roll Number) and stated that “[t]his is the number you will need to complete the enclosed application.” 

 

The complainant also advised the IPC that when she received the application for the MuniCard, she sent an e-mail to the City, expressing a concern that her personal information had been incorrectly disclosed to MuniCard, and notifying the City that she would be filing a complaint with the IPC should the City continue the practice of disclosing personal information to MuniCard.

 

With respect to the complainant’s e-mail to the City, the City advised the IPC that:

 

Prior to the formal complaint made to the IPC, there was an exchange of e-mails between the City and [the complainant] related to the MuniCard program.  The City received a detailed e-mail on October 2, 2007 from [the complainant] raising concerns about the MuniCard program, including questions about the development of the program, the security controls of the credit card company involved and steps taken prior to the agreement being finalized.  This e-mail correspondence was directed to seven members of Council, the City Manager, the Deputy City Manager and Commissioner of Finance, the City Clerk, the City Solicitor and Commissioner of Legal and Administrative Services as well as other Finance Department staff.

 

…an e-mail was sent from the City to Civic Strategies [the company that developed the MuniCard program] on October 7, 2007, attaching [the complainant’s] e-mails and asking for any information or suggestions to assist in addressing [the complainant’s] concerns.  This was done in accordance with the contract between Civic Strategies Inc.  (CSI) and the City of Vaughan in which CSI had the responsibility to address customer or public queries, complaints or comments related to the MuniCard program.

 

With respect to the MuniCard program, the City advised that it was developed by Civic Strategies Inc. and GE Money to ensure that it would be of benefit to City residents and taxpayers.  For example, those who avail themselves of the MuniCard credit card can earn rewards on their purchases and the credit card company will credit the cardholder’s property tax account with an amount based on the previous year’s total purchases.  GE Money pays the City the dollar value of the reward deducted from the property owner’s property tax bill.

 

The City also advised the IPC that the application package for MuniCard was printed and mailed by a third party company that the City uses on a regular basis for printing and distributing various tax-related documents.  Civic Strategies Inc. provided the third party company with the template for the application form, and the City forwarded information such as the property tax payer’s name, address and Roll Number directly to the third party printing company.  As such, the City advised, at no time was any personal information relating to the property owner disclosed to the entities involved with MuniCard. 

 

In addition, the City did not receive remuneration from MuniCard for the mailout other than the cost related to postage.  The cost of printing the application forms was incurred by Civic Strategies Inc.

 

The City also confirmed with the IPC that property owners were notified of the credit card program when they received the application package in the mail, and not through a prior notice.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

At issue in this complaint is the information that was used by the City, specifically, the complainant’s name, address, property tax roll number, and e-mail address, which was disclosed to MuniCard with the complainant’s e-mail communications to the City.

 

The definition of “personal information” is set out in section 2(1) of the Act, which states in part:

 

“personal information” means recorded information about an identifiable individual, including,

…

 

(c)    any identifying number, symbol or other particular assigned to the individual,

…

 

(d)   the address, telephone number, fingerprints or blood type of the individual,

 

Based on the above definition, I am satisfied that the information in question clearly qualifies as “personal information” under the Act.  The parties do not dispute this conclusion.

 

Was the use of the “personal information” in accordance with section 31 of the Act?

 

Section 31 of the Act imposes a general prohibition on the use of personal information, but states that personal information may be used in a number of enumerated exceptional circumstances. Section 31 states:

 

 

An institution shall not use personal information in its custody or under its control except,

 

(a)          if the person to whom the information relates has identified that information in particular and consented to its use;

 

(b)         for the purpose for which it was obtained or compiled or for a consistent purpose; or

 

(c)          for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act.

 

[emphasis added].

 

In order for a given use of personal information to be permissible under the Act, the institution in question must demonstrate that the use was in accordance with at least one of the section 31 exceptions.

 

In this instance, the City has taken the position that its use of the complainant’s personal information was in accordance with section 31(b), (i.e., that the use had taken place for the original purpose for which it had been obtained or compiled, or for a purpose that was consistent with that original purpose).

 

In determining whether a given use of personal information is in accordance with section 31(b), it is first necessary to determine the original purpose of the collection.  Next, it is necessary to assess whether the use of this information can be properly characterized as being either for the original purpose of the collection, or for a purpose that is consistent with that original purpose.

 

The City has submitted in its representations that the purpose of the collection of City property owners’ personal information by the City is for the collection of property taxes.  In particular, the City indicates that it collects information for tax billing purposes pursuant to the Municipal Act.  Section 343(2) of the Municipal Act states that the tax bill must contain twelve types of information, some of which is the same information as recorded on the letter to advise residents of the MuniCard program.  In addition, section 14(1) of the Assessment Act lists the 20 particulars that must be included in the Assessment Roll available to the public, including, but not limited to, the name and address of the owner, and the roll number.  This is the same information recorded on the notification letter that was sent by the City to advise its residents of the MuniCard program. 

 

Based on the information provided by the City, the purpose of the City’s collection of property owner’s name, address and roll number is for the purpose of the collection of property taxes.

 

The next step in the section 31(b) analysis is to determine whether the use was for the original purpose of the collection or for a purpose that was consistent with that original purpose.

 

The City’s position is that the use of the personal information constitutes a consistent purpose under the Act, and stated in its representations that:

 

“Consistent purpose,” as used in clause 31(b) of the Act, must be interpreted in its proper context and with reference to the broad purpose of municipalities…

 

“Consistent purpose,” as specifically used in clause 31(b), does not mean “exact” or “identical” …

 

“Consistent purpose,” properly interpreted, means a purpose that is not incompatible and not contradictory to the purpose for which the information was collected.  This interpretation and construction is supported by the specific structure of clause 31(b), the intent of section 31 and within the context of the Act.

 

The purpose of the MuniCard Program is consistent with the City’s use of personal information for the collection of property taxes.  The program provides property owners with an alternative method of making payments to the City.  Specifically, it provides an option to City taxpayers to pay their municipal taxes.  There is no ulterior motive to the program.  The MuniCard Program does not change the purpose for which a property owner’s name, address and roll number are used by the City in connection with its property tax system.  The use of such information was entirely consistent with the purpose for which the information was compiled or collected.

 

The complainant’s position with respect to the City’s use of her personal information is that:

 

The comparison that comes to mind is if CCRA were to use its personal income tax database to promote a VISA card, of course this would not be acceptable.  If VISA were to pay CCRA to mail out the letters then of course, this would then mean the tax database would be used for commercial purposes.  This is the exact parallel to what the City of Vaughan had done with their promotion of a credit card using the personal information collected in their property tax roll database as a means to promote the card.

 

The reason I suggest that this is an improper use of taxpayer information, is that the information the City collects is for the purposes of paying taxes.  It is necessary to collect the information and tie the personal data to a tax roll number in order that the City can collect the appropriate taxes, etc.  The information database, should not, however be available for commercial “for profit” companies to use as a means to generate customers.  Mailing an application for a credit card using the City tax roll informational database and personal information contained in that database, and especially because the City was paid to do this, is most definitely a breach of privacy and misuse of personal information.

 

The final step in the section 31(b) analysis is to look to section 33 of the Act, which provides clarification on whether a given use of personal information constitutes a “consistent purpose” under the Act, by imposing a “reasonable person” test.

 

Section 33 states:

 

The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31(b) and 32(c) only if the individual might reasonably have expected such a use or disclosure.

 

The City indicated in its representations that:

 

Section 33 is the only section in the Act which uses the phrase “might reasonably be expected” and there are no judicial decisions interpreting the meaning of the phrase.  A number of provisions in the Act use the phrase “could reasonably be expected” and there have been a few judicial decisions on the meaning of the phrase.  However, those decisions are distinguishable on their facts.  Specifically, they deal with situations where significant interests were at stake or where the safety or health of an individual was at risk.[1]

 

In this case, there is no such harm at stake and it is unclear what level of expectation will apply to the exemption given that there is no threat to the safety of an individual.[2]  With respect to the personal information provided on the application form, it is information typically used to administer the payment of property taxes regardless of the method of payment chosen.  There is no violation of the Act because the City used personal information that property owners would have expected to see on a document related to their property taxes.  This is especially true because of two key facts:

 

(1)   the application form is sent from the City directly to property owners; and

 

(2)   property owners have the option of participating in the MuniCard Program.

 

In the context of commercially valuable information, the Information and Privacy Commissioner/Ontario has determined that the question was whether disclosure “could reasonably be expected to” lead to a specified result.  In order to meet this test, the parties had to provide “detailed and convincing” evidence to establish a reasonable expectation of harm.  Evidence amounting to mere speculation of possible harm is not sufficient.[3]

 

The Information and Privacy Commissioner/Ontario has also commented on the quality and cogency of evidence required to satisfy the onus of establishing a reasonable expectation of harm (albeit in an access to information situation under the provincial statute).  Specifically, submissions regarding the “reasonable expectation of harm must be detailed and convincing.”[4]  In this case, the complainant had not provided any evidence to establish a reasonable expectation of harm.

 

In view of the purpose of the MuniCard Program and the general broader duties of the City, the use of the personal information was reasonable and reasonably expected.  Asked another way, would City taxpayers not have reasonably expected the City to advise them of any new or alternative methods of reducing their tax payments?  The answer is obvious.

 

I have considered the position put forward by the City and I do not agree. 

 

I have concluded above that the purpose of the City’s collection of property owners’ name, address and roll number is for the purpose collection of property taxes. 

 

The City contends that the MuniCard Program is designed to provide property owners with an alternative way of paying their property taxes.  However, in reviewing the City’s website, the methods of payment that a property owner may choose to pay property taxes are:

 

•         Pre-authorized withdrawals from a bank account;

•         Cheque or money order; or

•         Payment made directly at a bank.

 

The City advised the IPC that property owners cannot pay their property tax bills by way of a credit card, even the MuniCard.  The MuniCard Program that the City has described does not provide property owners with an alternative way of paying their property taxes.  It merely provides the property owner with the potential of earning “rewards” that are then applied to the property tax bill, based on a percentage of the dollar amount of purchases made using the MuniCard. 

 

In my view, there must be a rational connection between the purpose of the collection and the purpose of the use in order to meet the “reasonable person” test set out in section 33.  In the circumstances of this complaint, I do not see a rational connection between the purpose of the collection and the purpose of the use of the personal information, and I conclude that an individual in the complainant’s position would not have reasonably expected the use of their personal information, including their name, address and roll number, to be used to promote a credit card.

 

The IPC has issued two investigation reports on similar, but distinguishable fact situations.  In Investigation Report I93-059P, the provincial health ministry facilitated a mailing, on behalf of a breast screening program, to women over a certain age, to make them aware of, and to invite them to local breast screening clinics.  In that case, the breast screening program provided a form letter to Canada Post, and the ministry provided a list of names and addresses to Canada Post who then inserted that information into the letters by way of a “mail merge.”  The breast screening program did not receive individuals’ personal information until and unless they attended at the breast screening clinics.  The issue in this case was whether the Ministry’s disclosure of personal information to Canada Post, for purposes of the mailout, was in accordance with the disclosure provisions of the Freedom of Information and Protection of Privacy Act (FIPPA).  Former Compliance Review Officer Susan Anthistle determined that the disclosure was made for a purpose (health promotion) consistent with its collection (health planning and co-ordination), and could have been reasonably expected by the affected individuals.  A similar connection does not exist in the present case.  In my view, promoting a credit card, albeit with benefits to taxpayers, is not consistent with the collection of taxes.

 

In addition, in Privacy Complaint Report PC06-85, where a university sent invitations, on behalf of an honour society, to students to join the honour society, IPC Investigator Mark Ratner specifically distinguished between uses of personal information for private sector companies.  In that case, the invitations were processed and mailed by the university and the honour society did not receive students’ personal information until and unless students accepted the honour society’s invitation.  Investigator Mark Ratner determined that the university’s use of the students’ personal information on behalf of the honour society was in accordance with the use provisions of the Freedom of Information and Protection of Privacy Act.  However, in coming to that conclusion, he also stated, in part:

 

…I am mindful of the fact that the Society is a not-for-profit organization that exists in order to provide benefits for its members.  Had the University been involved in facilitating mailings in order to assist with the marketing activities of a private sector company, my conclusion that follows may not have been the same.

 

I agree and adopt Investigator Ratner’s distinction.  It cannot be said the MuniCard Program is a not-for-profit organization.  It is a private sector for-profit company and, despite the reward program being offered to its cardholders, the main recipient of the benefit of the MuniCard Program is the credit card company itself.

 

In addition, the City’s representations with respect to section 33 and its discussion of case law must be placed in their proper context.  The cases cited by the City relate to that portion of the Act that sets out the provisions relating to freedom of information, and not to the protection of privacy.  The City itself acknowledges that its section 33 arguments are in the context of an “access to information situation.”  I have determined that these arguments are not relevant to this privacy complaint.  More importantly, the City appears to have misstated the test set out in section 33 by injecting a “harms” requirement.  The representations state, “[i]n this case, the complainant has not provided any evidence to establish a reasonable expectation of harm.”  A plain reading of section 33 shows that a use or disclosure does not require a reasonable expectation of harm in order to be consistent.

 

The City also indicated in its representations that personal information, such as property owners’ names, addresses and roll numbers are available for public inspection at the City’s Civic Centre.  Under section 39(2) of the Assessment Act, a city clerk, upon receipt of the assessment roll, must make it available for inspection by the public during office hours.  The fact that this information is available for inspection by the public does not alter my conclusions, as the onus is on the party seeking the information to attend at the Civic Centre and take down the information from the assessment roll.  It is quite a different matter when the City undertakes to use that information on behalf of a third party, as in this case, for an inconsistent purpose. 

 

In summary, I have concluded that the City’s use of personal information by mailing out credit card applications that contain the personal information of property owners, on behalf of MuniCard, is not in accordance with Section 31 of the Act.

 

I recognize that the MuniCard offers advantages that many taxpayers will take advantage of.  However, the benefits of the MuniCard can be offered to the taxpayers of Vaughan in a manner that does not misuse the information collected from taxpayers for the purpose of tax collection.  The services of Canada Post could be used to facilitate a drop off of flyers, for example, to all residents of Vaughan making the option of MuniCard known to taxpayers.  I note that general mailings to all residents is a common form of solicitation for credit card companies.  Opportunities to allow taxpayers to opt-in to the program could also be identified, for example, the City could promote the program on its Website and let taxpayers proactively identify themselves if they want to be involved.  Finally, MuniCard itself could advertise its advantages through regular advertising without using the City’s tax roll to target taxpayers.

 

Was the “personal information” disclosed to MuniCard by the City in accordance with section 32 of the Act?

 

With respect to the complaint that the City disclosed property tax payers’ personal information to MuniCard, the City advised the IPC that the property tax payers’ names, addresses and roll numbers were:

 

[S]ent directly to the City’s external printer who prints all of the City of Vaughan’s tax bills.  At no time was this information provided to MuniCard.  This information was sent directly to the property owners.  The information provided in the recent mailing was intended to provide property owners with information regarding a possible benefit related to their property tax bills.  It is the decision of the property owner to determine whether or not to engage in an agreement with the credit card company.  If a property owner decides to enter into such an agreement, this information is required in order to obtain property tax credits.  The property owner must agree to the terms and conditions as outlined in the Account Agreement Summary.  By signing such an agreement, the property owner would be consenting to the disclosure of their personal information in accordance with the Act.

 

As previously mentioned, Civic Strategies Inc. provided the City’s third party printer with the application form for the MuniCard, and the City forwarded the name, address and Roll Number of property tax payers directly to the third party printer.  I am satisfied with the explanation provided by the City on this issue that property tax payers’ personal information was not sent directly to MuniCard and, therefore, not disclosed to MuniCard.

 

However, the City has acknowledged that it did disclose the complainant’s personal information to MuniCard in light of the concerns expressed by the complainant in her e-mail to the City, sent prior to filing her complaint with the IPC, regarding the MuniCard program.  I must now analyze whether that disclosure was in accordance with Section 32 of the Act.

 

Section 32 of the Act imposes a general prohibition on the disclosure of personal information, but states that personal information may be disclosed in a number of enumerated exceptional circumstances.  Section 32 states, in part:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(c)    for the purpose for which it was obtained or compiled or for a consistent purpose…

 

[emphasis added].

 

In order for a given disclosure of personal information to be permissible under the Act, the institution in question must demonstrate that the disclosure was in accordance with at least one of the section 32 exceptions.

 

In this instance, the City has taken the position that its disclosure of the complainant’s personal information was in accordance with section 32(c), (i.e., that the disclosure had taken place for the original purpose for which it had been obtained or compiled, or for a purpose that was consistent with that original purpose).

 

As noted earlier, section 33 of the Act provides clarification on whether a given disclosure of personal information constitutes a “consistent purpose” under the Act, by imposing a “reasonable person” test.

 

The City’s position is that the disclosure of the complainant’s personal information to MuniCard constituted a consistent purpose under the Act, and stated in its representations that the City’s actions were solely intended to respond to the complainant in an effort to resolve her concerns.  The City relied on Investigation Report MC-990048-1, where Assistant Commissioner Tom Mitchinson stated:

 

The Township disclosed the complainant’s personal information contained in letter #1 to the outside planning consultant for the same purpose for which it had been collected, namely to consider the content of the complainant’s objection and to provide the Township Council with advice as to what steps should be taken in response.  I find that this disclosure falls within the scope of section 32(c) of the Act.

 

In addition, the City relied on Privacy Complaint MC-040019-1, in which Investigator Brian Bisson stated:

 

In my view, it is not reasonable for a complainant to write to the Mayor, members of council and employees for assistance in resolving his/her issue and expect the matter to be dealt with behind closed doors…

 

In my view, the City disclosed the letter at the open council meeting for the same purpose that the complainant had intended – to resolve the issue that was the subject matter of the letter.  I conclude that the disclosure of personal information was for the original purpose for which it was obtained or compiled i.e. to address the issue raised by the complainant, and was therefore in accordance with section 32(c) of the Act.

 

The City also noted that in the above matter (MC-040019-1), the complainant had even marked the letter in question “confidential” and that in this case, the complainant had not marked her e-mails to the City “confidential.”  In addition, the City noted that after receiving the complainant’s initial e-mail regarding her concerns about the use of personal information in connection with the MuniCard program, they forwarded her e-mail to MuniCard the following day.  Two weeks later, the City responded in writing to the complainant’s concerns.  After receiving the City’s response, the complainant sent a responding e-mail to the City on the issue, copying several City staff members, four City Councillors and a reporter.  The City concluded that the complainant did not have a reasonable expectation of privacy, given that she disclosed her concerns and her identity, to third parties.

 

Lastly, the City relied on the contractual agreement between the City and CSI (the company that developed the MuniCard program) in which CSI has the responsibility to address customer or public queries, complaints or comments related to the MuniCard program.

 

The complainant’s position with respect to the City’s disclosure of her personal information is that it was not authorized under section 32(c) of the Act and it was not a disclosure that she had expected.

 

I have considered the position put forward by the City and I do not agree. 

 

The complainant sent her concerns to the City, not to MuniCard.  The complainant’s main concern was the use and disclosure of personal information by the City to MuniCard.  At no time was the complainant a MuniCard customer, nor was her complaint related to how MuniCard was administering the program.  Given that the crux of the complainant’s concern was her belief that personal information had been inappropriately disclosed by the City to MuniCard, it is unlikely that a person in the complainant’s position would have reasonably expected the City to then disclose her personal information to MuniCard.

 

The City has relied on two IPC reports in support of its position.  In MC-990048-1, a resident of a Township filed an objection with the Township Clerk concerning certain proposed development activity under consideration by the Township.  The objection was disclosed to an external planning consultant who had been retained by the Township to provide services within his area of expertise, which was land use planning issues involving the Township.  Former Assistant Commissioner Mitchinson found that the disclosure of the resident’s personal information to the external planning consultant was in accordance with section 32 of the Act, as it was for the same purpose for which it had been collected, namely to consider the content of the complainant’s objection and to provide the Township Council with advice as to what steps should be taken in response, by considering the land use planning implications of the objection made by the complainant.  It is clear from this case that the external consultant was retained to provide guidance to the Council based on his particular area of expertise, as there was no one in the employ of the Township who had that type of expertise.  In essence, the external planner was seen as being no different than a Township employee.  The same cannot be said in this case.  Similarly, the complainant in this case took issue with the City’s actions, not MuniCard.  The City did not require MuniCard to help it respond to the complaint that it had disclosed personal information improperly.

 

In MC-040019-1, a resident of a City wrote to the Mayor, seeking his assistance in a matter relating to his suspension from a voluntary organization, which had been formed to co-ordinate sporting activities, such as hockey, for neighbourhood associations.  The City’s involvement with this voluntary organization related to the allocation of ice-time in City-owned arenas.  The letter, containing the individual’s personal information, was subsequently discussed at an open council meeting and the minutes of the meeting were placed on the City’s website.  Investigator Brian Bisson found that the disclosure of the individual’s personal information was in accordance with section 32 of the Act, as it was for the same purpose that the complainant had intended, which was to resolve the issue that was the subject matter of the letter.  However, it is important to note that the subject matter of the suspension of certain individuals from the voluntary organization, including the complainant, had been the subject of prior discussions, had already been in the public arena and was in the public interest.  The complainant did not forward her complaint to the City as part of a public process.  Similarly, the City disclosed her identity only to MuniCard and as a result cannot say that the disclosure was required as part of a public process. 

 

In addition, as previously indicated, the City relied on the contract between the City and CSI, which gives CSI the responsibility of addressing customer or public queries, complaints or comments related to the MuniCard program.  In my view, the reasonable person would only expect such a contractual arrangement between the City and MuniCard after he/she had become a customer of MuniCard and not before.  It would be reasonable and understandable for the City to pass on complaints to MuniCard about the administration of the program, for example if a cardholder had questions about charges or had not received the right credits.  In this case, the issue was the validity of the disclosure by the City and its compliance with the Act, a question that MuniCard could not assist the City in answering.

 

However, even if the City chose to consult with MuniCard in an attempt to respond to the complainant’s concerns, it could have easily forwarded the substance of the complaint to MuniCard, without including the complainant’s name and e-mail address.  A similar situation was examined in the IPC’s Investigation I96-016P. 

 

In that case, a number of employees working for a Ministry funded not-for-profit agency sent a letter to the Ministry, outlining their concerns with the agency’s operations.  The Ministry subsequently disclosed the letter to a member of the agency’s Board of Directors in the course of conducting its review.  The Board member then disclosed the letter to agency staff, other similar agencies in the community and to a local newspaper.  Former Compliance Review Officer Susan Anthistle found that the concerns outlined in the letter about the agency’s operations, were of a general and systemic nature and, therefore, the signatories’ concerns could have been brought to the attention of the Board without the disclosure of any names.  If the Ministry wanted to include the letter as part of its review, the names of the signatories could have been severed, which would not have prevented the Ministry and the Board from dealing with the issues that had been raised.  Therefore, the Ministry’s disclosure to the Board of the complainant’s personal information could not be said to have been for the same purpose for which it was obtained or compiled and was not, accordingly, in compliance with section 42(c) of the Freedom of Information and Protection of Privacy Act.  I agree with Former Compliance Review Officer Anthistle’s analysis and adopt it to this case.

 

In addition, the City disclosed the complainant’s personal information to MuniCard the day after receiving her initial e-mail.  At the outset, the complainant had a reasonable expectation of privacy in these particular circumstances, despite the fact that, two weeks later, she copied a reporter on a subsequent e-mail to the City.  However, had the complainant copied a reporter in her initial e-mail to the City, I may have come to a different conclusion on this issue.

 

Therefore, I conclude that the City’s disclosure of the complainant’s personal information to MuniCard by forwarding a copy of her e-mail to them was not in accordance with Section 32 of the Act.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

•               The information in question qualifies as “personal information” as defined in section 2(1) of the Act.

 

•               The City’s use of personal information was not in accordance with section 31 of the Act.

 

•               The personal information of property tax payers was not disclosed to MuniCard.

 

•               The complainant’s personal information contained in the e-mail she sent to the City prior to filing the complaint with the IPC was disclosed by the City to MuniCard and the disclosure was not in accordance with section 32 of the Act.

 

RECOMMENDATIONS:

 

In light of the above conclusions, I make the following recommendations:

 

1.            That the City cease the practice of using the name and address of individuals and property tax roll number to solicit potential customers on behalf of a credit card company.

 

2.            That the City review and revise its policies and procedures relating to receiving complaints from individuals to ensure that disclosure of personal information to third parties is in accordance with the Act.

 

By three months from the date that this report becomes final, the institution should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.

 

 

 

 

 

Original Signed By:                                                                           

Cathy Hamilton Investigator

July 16, 2008