PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO. MC08-91 and MC08-92

 

 

City of Vaughan

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC08-91 and MC08-92

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            City of Vaughan

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received two privacy complaints related to the City of Vaughan (the City). The two complaints were based on the same facts, and involved correspondence that two individuals (the complainants) had sent to the City. Specifically, the complainants were concerned that the City had improperly collected, used, and disclosed personal information contained in their correspondence in contravention of the Municipal Freedom of Information and Protection of Privacy Act (the Act).

 

In response to these complaints, the IPC opened privacy complaint files MC08-91 and MC08-92. At the Intake stage of our privacy complaint process, the complainants advised the IPC that they were represented by a named individual (the representative). Subsequently, the complainants advised that the representative was no longer representing them but that all submissions previously made should be considered in these complaints. The complainant in MC08-91 also indicated that the complainant in MC08-92 would represent her in her privacy complaint, and an authorization form was provided to this office to confirm that fact.

 

Because the issues in these complaints are similar, the institution is the same, and the submissions made by the complainants apply equally to both complaints, I have issued one privacy complaint report for both MC08-91 and MC08-92. I will refer to the complainants in both complaint files individually and collectively as the “complainants”.

 

Background Information to the Complaint

 

In their original letter of complaint to our office, the complainants stated that the City had collected, compiled, retained, and disclosed their personal information in contravention of the Act. In addition, the complainants stated that the City had not notified them that their personal information had been collected, retained, used or disclosed. The complainants stated that the City’s collection, retention, use and disclosure of their personal information began in November, 2004 and continued to the date of the complaint.

 

In support of their complaint, the complainants provided the IPC with a Statement of Claim that had been filed by the City in the Ontario Superior Court of Justice, and which named the complainants as defendants in a lawsuit.

 

In the Statement of Claim, the City alleged that the complainants had sent numerous e-mail messages, detailed requests for information, and written letters to the City and its representatives and that this contact constituted harassment. The Statement of Claim refers to a Memorandum of Settlement (MOS) reached between the City and the complainants in which the complainants agreed to “cease and desist from contacting the City, its officials, City Manager, commissioners, directors and managers, other than any contact they may have as taxpayers of the City.”

 

The Statement of Claim detailed the contact between the complainants and the City made subsequent to the execution of the MOS which, in the City’s view, constituted harassment. The City stated that the complainants’ conduct constituted a breach of the terms of the MOS, and documented separate instances where the complainants had communicated with the City by way of e-mail, written letters, or complaints.

 

In addition, on June 25, 2007, the City sent a letter to one of the complainants which made reference to the MOS and requested that the complainant cease and desist from any further contact with two individuals who were former employees of the City.

 

In the materials provided to our office, the complainants drew a distinction between three different classes of correspondence at issue in their complaint. Specifically, the complainants distinguished between the three classes of correspondence as follows:

 

Category A:   communication sent by the complainants to City staff;

Category B:     communication sent by the complainants to former City employees; and

Category C:     communication sent by the complainants to members of City Council, including the Mayor of the City.

 

I adopt these categories for the purposes of this report and will hereinafter refer to the three classes of records as Category A, B, or C records. The complainants state that the City compiled these records and provided them to the City’s legal department, and then to its outside legal counsel. It is the complainants’ position that the City’s collection, use and disclosure of their personal information in these records was not in accordance with the Act.

 

In addition to their concerns regarding these records, the complainants also provided the IPC with a copy of a Memorandum issued by the City’s Manager of Special Projects, Licensing & Permits to City Management on March 7, 2006. The Memorandum states:

 

The City’s current insurance policies cover the City for claims arising under various categories. The main categories include, municipal liability, errors and omissions, environmental liability and property. A majority of claims against the City are based on one of these categories.

 

Prior to commencing a claim against the City, claimants may seek to “build a case” against the Corporation by requesting information and documentation either informally through the respective department or formally through a Municipal Freedom of Information and Protection of Privacy access request. …

 

Should you receive such a request and suspect that it may be used to obtain information to substantiate a claim against the City please NOTIFY ME IMMEDIATELY.

 

In addition, if circumstances arise where you feel the City may be exposed to liability please make me aware of the situation immediately.

 

Early notification will allow the City to take action to mitigate damages and take any and all steps to properly defend itself in the event that the City is served with a lawsuit.

 

The complainants state that this memorandum demonstrates the City’s intention to improperly disclose personal information relating to FOI requests to City staff who do not need to have the information in order to process FOI requests.

 

I will therefore address the following:

 

•         Whether the Memorandum issued by the City’s Manager of Special Projects, Licensing & Permits constituted a breach of the privacy provisions of the Act; and

 

•         Whether the City’s collection, use and disclosure of the Category A, B & C records breached the privacy provisions of the Act.

 

In the course of my investigation, I have considered the records and responses that have been provided to the IPC by the parties.

 

Included among these records are the records of correspondence that had been referenced in the Statement of Claim, as well as additional records that have also been provided by the complainants during the investigation. It is these records that comprise the Category A, B, and C records. I will consider whether the collection, use and disclosure of these records has been in accordance with the privacy provisions of the Act.

 

Both parties to this matter (the complainants and the City) were provided the opportunity to review a draft version of this Report and provide comments. Where appropriate, comments received by the parties as a result of this review have been considered and incorporated into this Report.

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

The definition of “personal information” is set out at section 2(1) if the Act, which states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

…

 

(d) the address, telephone number, fingerprints or blood type of the individual,

 

(e) the personal opinions or views of the individual except if they relate to another individual,

 

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

 

(g) the views or opinions of another individual about the individual, and

 

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

In order for a given record to be subject to the privacy provisions of the Act, the information in that record must qualify as “personal information” under section 2(1). Accordingly, I will consider whether the records at issue contain information that qualifies as “personal information”.

 

Memorandum sent by the City’s Manager of Special Projects on March 7, 2006

 

With respect to this issue, the complainants have stated:

 

This City directive provides a carte blanche to every city employee to disclose the identity of every FOI requester and the substance of the record that is being requested for access. It can be reasonably concluded that every FOI request can lead to the disclosure of the identity of the requestor under the pretense of a potential claim against the City. This is a purposeful and blatant breach of [the Act] on a multitude of levels.

The City has responded to this issue in the complaint and has stated:

 

The memo dated March 7, 2006 does not instruct City employees to disclose the identity of individuals contacting the City to request information. The memo advises that if an employee becomes aware of a potential claim, he or she is to report same to the City’s Manager of Special Projects, Licensing & Permits, Insurance Risk Management. Employees are not directed to collect personal information; rather, employees are asked to note potential claims. The memo was sent as a result of concerns expressed by the City’s insurers, regarding the City’s liability risks, and does not involve the City’s legal department.

 

I have considered the position expressed by both the complainants and the City and I have reviewed the Memorandum in question.

 

The Memorandum directs City departments to disclose whether a Freedom of Information (FOI) request may be related to a potential legal claim. Having reviewed the Memorandum in its entirety, I am satisfied that it does not direct City staff to disclose the identity of an FOI requester. A City staff member would be able to comply with the directive in the Memorandum by providing a general description of the request to the City manager in question without disclosing the identity of the requester.

 

Because the Memorandum in question does not request the disclosure of the identity of FOI requesters, I conclude that it does not direct the disclosure of “personal information” under the Act. Accordingly, it is not necessary for me to deal with this issue further.

 

I would caution the City that should the identity of FOI requesters be provided to the Manager of Special Projects, Licensing & Permits, it should ensure that such disclosure occurs only when there is a reasonable basis to conclude that a claim is imminent.

 

Correspondence sent by the complainants

 

I have reviewed all of the records that comprise the Category A, B, and C records. I conclude that all of these records contain the complainants’ personal information. I note that both the complainants and the City concur that these records qualify as “personal information” under the Act.

 

Was the collection of the “personal information” in accordance with section 28(2) of the Act?

 

Section 28(2) of the Act states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

 

Section 28(2) imposes a basic prohibition on the collection of personal information and sets out three circumstances where such a collection may be permissible.

 

The records at issue are the correspondence that fall under the Category A, B, and C records. These records were prepared by the complainants and sent to City staff, former City employees and members of City Council.

 

I will proceed to consider the application of section 28(2) to each of the Category A, B, and C records.

 

Category A records

 

The majority of the records at issue in this privacy complaint are the Category A records. These records consist of correspondence prepared by the complainants and sent to the City.

 

The complainants have stated:

 

The collection of the complainant’s personal information is not authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. …

 

Further, section 28(2) cannot be viewed in a vacuum as sections 29, 31, 32, 33 must be considered. …

 

Additionally, the collection of the complainant’s personal information in question does not meet the necessity condition that must also be met.

 

The personal information records collected by the City were concerning taxpayer and resident issues, such as incorrect street signs, expense reports, tendering process etc. The City is a municipal government that is responsible for municipal services.

 

The complainants have also made reference to the decision of the Ontario Court of Appeal in Cash Converters Canada Inc. v. Oshawa (City),[1] where the Court of Appeal interpreted section 28(2) of the Act and stated that an institution:

 

must show that each item or class of personal information that is to be collected is necessary to properly administer the lawfully authorized activity. Consequently, where the personal information would merely be helpful to the activity, it is not “necessary” within the meaning of the Act.

 

In sum, it is the position of the complainants that the City has not demonstrated that it is authorized to collect the information in question under section 28(2) of the Act.

 

In its submission to our office, the City has taken the position that the correspondence was not “collected” by the City as follows:

 

It is the City of Vaughan’s position that the City … did not collect this personal information from the complainant. The complainant voluntarily submitted or provided his personal information and allegations to the City … on his own initiative, so that the City … would address his concerns and possibly provide a reply in this regard. It is the City of Vaughan’s position that no notice is required under section 29 as the City of Vaughn did not contact the complainant to “collect” his personal information. This narrow interpretation of the undefined verb “collect” is reinforced by the words “obtain” and “compile” in sections 31(b) and 32(c). The Act still regulates personal information “obtained” by an institution – i.e. sent voluntarily to an institution – even though the institution has not “collected” that personal information. The verb “obtain” is obviously intended to be broader than the verb “collect.” Therefore, it is the City of Vaughan’s position that no breach occurred… .

 

It is therefore the position of the City that its receipt of the Category A records did not constitute a collection of records under the Act. In support of this position, it notes that the term “collect” is not defined in the Act and maintains that the term should be interpreted so as not to apply to circumstances where information is voluntarily provided, rather than actively obtained.

 

I have considered the respective positions of the complainants and the City. I note that the records that comprise the Category A records are correspondence sent voluntarily by the complainants to the City on an unsolicited basis.

 

In order to determine whether records sent on an unsolicited basis are “collected” under the Act, it is necessary to interpret the meaning of the term “collect”. I note that neither the term “collect” nor the term “collection” are defined under the Act.

 

In determining the meaning of a term that is not defined under a statute, the accepted approach to statutory interpretation is to determine the intent of the Legislature by reading the words of the provision in context in accordance with its grammatical and ordinary sense, harmoniously with the scheme and the object of the statute.

 

The purposes of the Act are set out in section 1, which states in part:

 

The purposes of this Act are,

…

(b) to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information.

 

This provision states that one of the purposes of the Act is the protection of personal information held by institutions. In determining whether the Legislature intended to make the unsolicited receipt of correspondence a “collection” of personal information under the Act, it is instructive to look to the provisions of the Act that regulate the use and disclosure of personal information and give effect to the purposes of the Act.

 

The use and disclosure of personal information are addressed under sections 31 and 32 of the Act respectively. Section 31(b) of the Act states:

 

An institution shall not use personal information in its custody or under its control except,

…

(b) for the purpose for which it was obtained or compiled or for a consistent purpose; … .

 

Section 32(c) of the Act states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

…

(c) for the purpose for which it was obtained or compiled or for a consistent purpose … .

 

I note that the City has made reference to these sections of the Act and has stated that the term “collect” is intended to be narrower than the term “obtained and compiled”. The City has further stated that the employment of this wording in the statute implies that sections 31 and 32 are intended to regulate any information that is obtained or compiled by an institution, rather than only information that is collected.

 

I have considered the City’s position. Sections 31 and 32 of the Act both make reference to personal information having been “obtained or compiled” by an institution. In my view, in drafting the Act, the legislature intended the meaning of the term “obtained or compiled” to be different from the term “collect,” which is employed in section 28. Had the legislature intended sections 31 and 32 to only apply to personal information that is collected, it would have used that terminology in those sections.

 

I note that personal information may come into the custody or control of an institution in a variety of circumstances: it may be actively solicited, it may be passively received, or it may be created by the institution. In my view, the term “obtained or compiled” is intentionally broad, and is intended to accommodate the various ways in which an institution may acquire personal information. This analysis supports the notion that the term “collect” is intended to be interpreted narrowly so as not to apply to situations such as this where correspondence is sent to institutions voluntarily and without solicitation.

 

I have also considered the reference to the term “collection” in section 29(2) of the Act, which mandates that institutions provide Notice of Collection to any individual whose personal information is collected.

 

To interpret the term “collection” in a manner that includes the unsolicited receipt of correspondence would entail that every institution would be required to provide a full Notice of Collection to every individual who chooses to send it correspondence on an unsolicited basis.

 

Where information is provided voluntarily to an institution on an unsolicited basis as in this case, it is not feasible for the institution to provide Notice of Collection. Municipal institutions receive large volumes of unsolicited correspondence on a regular basis, and imposing a notice requirement in every case would be unduly burdensome. Accordingly, in my view, the legislature did not intend on having the notice requirement apply to the unsolicited receipt of correspondence, which further supports the finding that the receipt of unsolicited correspondence does not constitute a “collection” of personal information under the Act.

 

Based on the analysis above, I therefore conclude that in drafting the Act, the Legislature did not intend the terms “collect” and “collection” to apply to the unsolicited receipt of personal information. Accordingly, I am satisfied that, based on the circumstances of this case, the Category A records were not collected under the Act [see also PC08-39].

 

Upon reviewing a draft of this privacy complaint report, the complainants expressed disagreement with the finding that the City did not solicit personal information from the complainants. In support of their position, the complainants provided an e-mail that was sent to them by the City Manager. In the e-mail, the City Manager requests that the complainants provide him with records and documents in their possession that relate to a previous written inquiry that they had made.

 

I have reviewed the City Manager’s e-mail. I note that in the e-mail, the City Manager’s request was for documentation that had been previously referenced by the complainants in their earlier unsolicited correspondence, which the complainants, on their own initiative, had voluntarily offered to provide to the City. I note that other records in question are similar in nature and contain similar requests by City staff for documents referenced in unsolicited correspondence.

 

I do not view the City Manager’s e-mail request for the referenced documentation as constituting a solicitation of information. Rather, the complainants had previously offered to provide these records. In my view, the fact that the City Manager took up the complainant’s offer respecting the records does not mean that they were solicited. I therefore conclude that any documents subsequently provided by the complainants in response to the City Manager’s request were not “collected” under the Act.

 

The complainants have expressed concern regarding the City’s handling of the Category A records after they had been received. As noted above, the subsequent use and disclosure of personal information is dealt with in sections 31 and 32 of the Act respectively and is discussed below.

 

Category B records

 

These records consist of correspondence sent by the complainants to two former City employees. With respect to these records, the complainants have stated:

The data is primarily collected by the City of Vaughan from two sources: one from a City of Hamilton employee, and one from a private citizen. Category B data is data that was not “voluntarily” submitted by the complainants, and in fact had no knowledge their correspondence was being collected by the City or improperly disclosed by third parties… [emphasis in original].

 

To further support their position that the records were actively sought by the City, the complainants have provided our office with portions of the City’s response to a Notice of Inquiry in a Freedom of Information appeal that is related to the Category B records. Specifically, the complainants have made reference to the following statement made by the City:

 

At the time the records were forwarded to the City of Vaughan, the City was anticipating legal action against the appellants for violation of the Memorandum of Settlement executed June 22, 2006.

 

In their response to the draft report, the complainants expressed disagreement with the City’s statement that they had violated the terms of the MOS.

 

The City addressed these records and has stated:

 

Pursuant to the [MOS], [the complainants] agreed they would not contact City officials other than contact they would have as taxpayers.

 

The email of June 16, 2007, from [one of the complainants to a former City employee] constituted a breach of the [MOS]. This email was forwarded to the City by [the former employee] on his own initiative and volition.

 

Similarly, the emails of June 18 and 20, 2007, from [one of the complainants to a former City employee] were forwarded to the City by [the former employee] on her own initiative. The emails from [one of the complainants to the former employee] constituted a breach of the [MOS]. [The former employee] notified the City of this breach on her own volition.

 

The City has taken the position that the Category B records were sent by individuals to the City on the initiative of those individuals on an unsolicited basis.

 

I have already concluded above that records that are obtained on an unsolicited basis are not “collected” under the Act. In this case the City has taken the position that it did not solicit the records in question. The complainants, on the other hand, are of the view that the records were not provided voluntarily.

 

I have considered the respective positions of both parties. I have also reviewed the City’s representations in the related FOI appeal provided to me by the complainants. I note that these representations state:

 

The City of Vaughan did not actively collect the records. They were, rather, sent to the City of Vaughan by the two named former employees.

 

The above passage demonstrates that the City has been consistent in maintaining its position that the records in question were not collected, but were rather obtained on an unsolicited basis from a former employee.

 

I further note that I have not been provided with any information from either party that shows that the City had actively solicited the Category B records.

 

Upon reviewing a draft of this privacy complaint report, the complainants stated that they disagreed with the finding that the City did not actively solicit the records in question from the former City employee. In support of this position, the complainants have provided the IPC with additional representations prepared by the City in relation to the related FOI appeal, where the City states that “the dominant purpose of the two former City employees in transmitting the e-mail to the [City] was to conduct or aid in the conduct of litigation.”

 

I have reviewed the additional representations referred to by the complainants. I note that the City’s representations in the FOI appeal do not contradict the information provided in the context of this complaint. Rather these representations state:

 

The two former City employees were aware of the Minutes of Settlement reached by the City and the appellants. They would be aware that the appellant’s attempts to contact them was a breach of the Minutes of Settlement.

 

I continue to be of the view that the City did not actively solicit the records in question from the former employees. On the contrary, the FOI representations support the position of the City that the former employees decided, of their own volition, to provide the records to the City.

 

In consideration of the above, I conclude that the records that comprise the Category B records were not collected by the City.

 

As with the Category A records, the complainants have expressed concern regarding the subsequent use and disclosure of their personal information contained in the Category B records. The use and disclosure of personal information is regulated under sections 31 and 32 of the Act and will be discussed below.

 

Category C records

 

These records consist of e-mail correspondence sent by the complainants originally provided to the Mayor of the City and members of City Council. I have reviewed each of the records in Category C.

 

 

 

 

With respect to these records, the complainants have stated:

 

This data is correspondence sent to elected representatives of the city. Several instances occur where the data is marked confidential. Correspondence sent to elected officials is not under the custody or control of the city.

 

When data is sent to elected officials, the resident and taxpayer has an expectation of privacy. It is clear and there are several rulings in this regard on such being, Order M-813… [emphasis in original].

 

The City has not addressed the issue of custody or control, but has stated that it did not actively solicit the records in question.

 

I will first consider the issue of custody or control. As I understand it, the complainants’ position is that the City did not have custody or control of the records because they were sent to members of City Council and not to the City. The complainants maintain that the subsequent compilation of the Category C records by City staff was therefore a novel collection of personal information.

 

The complainants have made reference to Order M-813, an order of our office that concluded that constituency records of a City Councillor were not records within the custody or control of the institution in the circumstances of that case. It is the position of the complainants that because the records in question were sent to members of City Council, they were not sent to the City.

 

I have reviewed M-813 and note that the record in question was a letter sent to a municipal councillor. In M-813, Inquiry Officer Laurel Cropley ruled that because a municipal councillor is not an officer of the municipality, constituency records in his or her possession would not be considered to be records under the custody or control of the institution.

 

However, Order M-813 distinguishes the role played by a municipal councillor from that of the Mayor, as head of council, who also functions as an officer of the municipality. In that case, the Mayor of a municipality was considered to be an officer of an institution.

 

The fact that the Mayor of a municipality, as head of Council, is an officer of the institution is supported by section 225 of the Municipal Act, which states:

 

It is the role of the head of council,

 

(a)     to act as chief executive officer of the municipality;

 

(b)     to preside over council meetings so that its business can be carried out efficiently and effectively;

 

(c)     to provide leadership to the council;

 

 

(c.1)  without limiting clause (c), to provide information and recommendations to the council with respect to the role of council described in clauses 224 (d) and (d.1);

 

(d)    to represent the municipality at official functions; and

 

(e)     to carry out the duties of the head of council under this or any other Act [emphasis added].

 

This provision clarifies that the head of council (the Mayor) is considered to be Chief Executive Officer of the municipality. As an executive office holder, the Mayor of a municipality is an officer of a municipality.

 

In response to the draft privacy complaint report, the complainants stated that a mayor of a municipality is not considered to be an officer of the municipality under the Act. They referred to the decision of the Ontario Superior Court in Vaughan (City) v. Ruffolo, 2009 CanLII 38509 (ON S.C.) in support of their position. That case involved an application to examine a Mayor of a municipality as a representative of the municipality. In the decision, Master D. E. Short ruled that the Mayor of the municipality in question was not examinable for discovery. Master Short made reference to Rule 31.03(2)(a) of the Rules of Civil Procedure, which states:

 

the examining party may examine any officer, director or employee on behalf of the corporation, but the court on motion of the corporation before the examination may order the examining party to examine another officer, director or employee… [emphasis added].

 

In considering whether it is appropriate for the Mayor of a municipality to be examined for discovery, the Court considered the purposes of the discovery process, and noted that one such purpose is to obtain admissions that will be binding at trial. In this respect, the Court reasoned that the individual examined for discovery should have the ability to legally bind the municipality in question. The Court further noted that because the Mayor of a municipality, acting alone, does not have the ability to legally bind the municipality, she (or he) is not the type of officer of a municipality that is examinable under Ontario’s Rules of Civil Procedure.

 

However, contrary to the suggestion of the complainants, I am satisfied that the court decision in question does not contain a finding that a mayor of a municipality is not an officer of the municipality under the Municipal Act. Therefore, I am not persuaded that Master Short’s findings support the conclusion that a mayor of a municipality is not an officer of the municipality for the purposes of the Act.

 

With respect to the present case, I note that most of the correspondence in question was sent to members of Council, as well as the Mayor. Because the Mayor of the City is its Chief Executive Officer, I am satisfied that she qualifies as an officer of the City for the purposes of the Act. Accordingly, the fact that the records that comprise Category C were sent to the Mayor entail that they were sent to the City and were therefore in the custody or control of the City.

One of the records is question was a chain of e-mail correspondence between the complainants and a member of City Council. The City Council member’s responses to the complainants were copied to the City, which entailed that it was also in the City’s custody or control.

 

I will now address the question of whether the records that comprise the Category C records were “collected” under the Act.

 

With respect to the Category A and B records, I concluded that the records in question were not “collected” under the Act because they had been received on an unsolicited basis. In the case of the Category C records, the records in question were also provided to the Mayor on an unsolicited basis. For the same reasons provided above, I am satisfied that the Category C records were not collected under the Act.

 

To the extent that councillors may have forwarded the records to City staff for action, at the request of City staff or voluntarily, I am of the opinion that such action was not a collection by the City because the forwarding of the unsolicited records by the Mayor and other councillors would be properly characterized as an internal dissemination of the records, and therefore a use, rather than a collection of the information.  

 

The complainants have expressed concern regarding the subsequent use and disclosure of their personal information contained in the Category C records. As with the Category A and B records, the use and disclosure of these records will be dealt with below.

 

Conclusion on the collection of personal information

 

Having considered all of the information provided by both parties to this matter, and based on all of the above, I conclude that the Category A, B, and C records were not collected by the City under the Act. Accordingly, I conclude that the City has not contravened section 28(2) of the Act.

 

Was Notice of Collection provided in accordance with section 29(2) of the Act?

 

The requirement to provide Notice of Collection is set out in section 29(2) of the Act, and it only applies where personal information is collected.

 

Given that I have concluded above that the Category A, B, and C records were not collected under the Act, the municipality was not required to give notice under section 29(2).

 

Was the use of the personal information in accordance with section 31 of the Act?

 

The City has acknowledged that it received the correspondence that comprises the Category A, B, and C records that were originally prepared by the complainants. The City has further stated that, once received, it compiled this correspondence and provided it to its legal services department, for legal advice. This internal dissemination of the complainants’ personal information constitutes a “use” of personal information under the Act.

 

Because all of the Category A, B, and C records were treated in the same manner by the City, it is not necessary to separately discuss each category of records. Accordingly, I will proceed to consider whether the City’s use of all of the records was in accordance with section 31 of the Act.

 

The provisions governing the use of personal information are set out at section 31 of the Act, which states:

 

An institution shall not use personal information in its custody or under its control except,

 

(a) if the person to whom the information relates has identified that information in particular and consented to its use;

 

(b) for the purpose for which it was obtained or compiled or for a consistent purpose; or

 

(c) for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act.

 

Section 31 imposes a basic prohibition on the use of personal information and lists a set of exceptions where personal information may be used. In order for a given use of personal information to be permissible under this section, the institution in question must show that it accords with at least one of the exceptions of that section.

 

The complainants have stated that the use of their personal information was not in accordance with the Act, and that the correspondence in question was:

 

… submitted for a specific purpose, That purpose was to address resident complaints. Each of these complaints resulted in an action being taken by the City to correct street signs, move planters, abuse of taxpayer money, etc. The implied consent for the use and disclosure of this data is limited to the exact use as outlined in each complaint.

…

The City failed to obtain consent prior to compiling the data and clearly this is a new use. The City also failed to notify the complainants of the new use. … The … failure of the city to either notify or obtain consents are both breeches [sic].

 

The complainants further state:

 

The personal information in the records was collected without notice as required under sections 29(2) and 29(3). The complainants did not consent to the use of their personal information records.

 

The personal information was not used for the purpose for which it was obtained or compiled. The purpose of the personal information records sent by the complainants was to deal with a multitude of different and distinct taxpayer issues. The complainants did not consent to the use of the personal information for purposes other than the specific issue in each individual record.

 

To summarize the position of the complainants, they have stated that the records in question were originally prepared for the purpose of making complaints on distinct taxpayer issues. They objected to the fact that the City did not notify them, or seek their consent prior to compiling these records and providing the records to their legal department. The complainants further stated that the personal information was not used for the purpose for which it was obtained or compiled.

 

The City has also addressed its use of the complainants’ personal information and expressed that it was in accordance with section 31(b) of the Act as follows:

 

The purpose for which personal information was used would constitute a consistent purpose under section 31(b) of the Act, only if the individual might reasonably have expected such a use. Section 33 is the only section in the Act which uses the phrase “might reasonably be expected” and there are no judicial decisions interpreting the meaning of the phrase.  …

 

… section 33 of the Act provides clarification on whether a given disclosure of personal information constitutes a “consistent purpose” under the Act, by imposing a “reasonable person” test. The complainant was aware that her correspondence was sent to a number of different City Departments, as well as the Mayor and Members of Council. The complainant[s] received correspondence from a number of City Departments who responded to [their] complaints. In addition, the complainant[s] received a written letter from the City to ask that [they] cease and desist with further communication. Therefore, it is the City of Vaughn’s position that the complainant[s] should have reasonably expected that the City of Vaughan would use [their] personal information to commence a legal action as described in the Statement of Claim.

 

I have considered the information supplied by both parties. At issue is the correspondence that originated with the complainants, was compiled by the City, and was eventually provided by the City to its legal department.

 

In their representations, the complainants make reference to the fact that the City had neither notified them, nor obtained their consent prior to compiling their personal information.

 

Having reviewed the Act, I note that it does not contain a requirement to either notify or obtain the consent of an individual prior to the use of his or her personal information. The section 29(2) notice provision, which is addressed above, only requires notice for personal information that is collected. The statute does not require that data subjects be notified of all uses of their personal information. Accordingly, I am satisfied that the City was not required to notify the complainants of its uses of their personal information.

 

Similarly, I note that the Act does not impose any requirement on institutions to obtain consent from individuals prior to using their personal information.

 

With respect to section 31, the City has relied upon section 31(b), which permits the use of personal information “for the purpose for which it was obtained or compiled or for a consistent purpose”. In order for a given use of personal information to be found to be in accordance with section 31(b), the City must show that it was used for the same purpose for which it was originally obtained or compiled, or that it was used for a purpose that was consistent with that original purpose.

 

In the circumstances of this case, the personal information in question was correspondence received from the public. Receiving correspondence from the public is one of the responsibilities of a municipality, and in my view, the records were received for the purpose of the effective administration of a municipality.

 

The correspondence was then compiled and provided to the City’s legal department in order to obtain legal advice with respect to issues arising from the correspondence and the MOS. Obtaining advice with respect to legal issues that arise is also a responsibility of a municipality, and is directly related to the effective administration of a municipality. In this case, the legal issue that arose related to whether there had been a violation of the terms of the MOS. Accordingly, I am satisfied that the records in question were used for the original purpose for which they were obtained or compiled, namely, the effective administration of a municipality.

 

Because the records that comprise the Category A, B, and C records were used for the same purpose for which they were obtained or compiled, I am satisfied that this use was in accordance with section 31(b) of the Act.

 

Was the disclosure of the personal information in accordance with section 32 of the Act?

 

Section 32 of the Act states, in part:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(a) in accordance with Part I;

 

(b) if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

 

(d) if the disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions.

…

 

Section 32 establishes a basic prohibition on the disclosure of personal information, but states that there are certain exceptional circumstances where personal information may be disclosed. In order for a given disclosure of personal information to be permissible under this section, it must be shown to accord with at least one of the section 32 exceptions set out above.

 

In the circumstances of this case, the disclosure of personal information at issue is the disclosure that took place when the City provided the complainants’ personal information contained in correspondence to its external legal counsel. Because the correspondence that comprises the Category A, B and C correspondence were all treated in the same manner by the City, I will deal with all of these Categories together.

 

In this regard, the complainants have stated:

 

The disclosure of personal information in the records was not in accordance with section 32 of the Act. The purpose of the personal information records sent by the complainants was to deal with a multitude of different and distinct taxpayer issues.

 

The complainants have also stated:

 

The City has implied consent for this data gathered as a result of taxpayer complaints. The City, however, does not meet the criteria of section 32(c) as the purpose is linked to the original implied consent and the purpose of compiling data is not consistent with the implied consent. The City cannot rely on this.

 

In sum, it is the position of the complainants that the records in question were submitted to the City in order for the City to address issues they were raising as taxpayers. Because the disclosure in question did not take place to address these issues, the complainants are of the view that the disclosure was inappropriate under the Act.

 

The City has addressed the disclosure of the personal information and made reference to section 32(d) of the Act, which permits the disclosure of personal information to “an officer, employee, consultant or agent of the institution”:

 

The City of Vaughan may acquire outside expert advice to assist with various matters. In the circumstances of this complaint, the City … retained the services of an outside legal firm … [which] … was retained in the capacity as a consultant or agent of the institution, to advise regarding legal remedies available to the City, arising from the correspondence.

…

It is the City of Vaughan’s position that [the external legal counsel] required the litigation file (which contains the complainant’s correspondence) in the performance of their duties, and that the disclosure was necessary and proper in the discharge of the institution’s functions. This is because part of the responsibility and function of [the external legal counsel] was to prepare a Statement of Claim on the City’s behalf. [The external legal counsel] would not be able to fulfill that function without viewing the litigation file (which contains the complainant’s correspondence).

 

I have considered the positions put forward by both the complainants and the City.

 

The City had decided to seek outside legal advice regarding the correspondence it had received from the complainants. In order to obtain the advice, it was necessary to provide the correspondence to the lawyer it had retained for this purpose.

 

I am satisfied that an external lawyer hired by the City is an “officer, employee, consultant or agent” of the institution within the meaning of section 32(d). I am also satisfied that the external lawyer would have required the records in question in order to perform his or her duties.

 

I therefore conclude that the disclosure accords with section 32(d), and is therefore in accordance with section 32 of the Act.

 

The complainants’ representations make reference to section 32(c) of the Act, but not section 32(d) of the Act. Because I have already concluded that the disclosure in question is in accordance with section 32(d), it is not necessary to consider the potential application of section 32(c) of the Act.

 

Based on all of the above, I am satisfied that the disclosure was in accordance with section 32 of the Act.

 

OTHER MATTERS

 

The complainants stated that the draft Report improperly accepted the City’s claim that they had violated the terms of the MOS. However, the draft report and this final report do not contain any such findings. This Report merely addresses the collection, use, and disclosure in question, and the corresponding obligations under the Act. I understand that there is litigation pending between the parties related to this matter. Indeed, Statements of Claim and Defence have been filed. A court is the proper forum for addressing the legal question of whether the MOS had been breached.

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

Personal Information

 

1.      The information contained in the complainants’ correspondence qualifies as “personal information” under section 2(1) of the Act.

 

2.      The information described in the Memorandum issued by the City’s Manager of Special Projects, Licensing and Permits does not qualify as “personal information” as defined under section 2(1) of the Act.

 

Collection

 

3.      The personal information contained in the Category A, B and C records was not “collected” under the Act.

 

Notice of Collection

 

4.      Notice of Collection was not required with respect to the Category A, B, and C records.

 

Use

 

5.      The personal information contained in the Category A, B, and C records was used in accordance with section 31 of the Act.

 

Disclosure

 

6.      The personal information contained in the Category A, B, and C records was disclosed in accordance with section 32 of the Act.

 

 

 

 

 

 

Original Signed By:                                                                                 July 8, 2011

Mark Ratner Investigator