Privacy Reports

 

 

 

 

 

            PRIVACY COMPLAINT REPORT

 

              PRIVACY COMPLAINT NO. MC10-1

 

               City of Vaughan

 

                February 1, 2011

 

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

 

PRIVACY COMPLAINT NO.                   MC10-1

 

 

 

INVESTIGATOR:                                       Mark Ratner

 

 

 

INSTITUTION:                                            City of Vaughan

 

 

 

SUMMARY OF COMPLAINT:               

 

The Office of the Information and Privacy Commissioner/Ontario (IPC) received a privacy complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act) from an individual (the complainant) concerning the City of Vaughan (the City).

 

In the letter of complaint, the complainant stated that someone within the City, either a staff member or a member of City Council, had disclosed a confidential report (the Report) containing his personal information, as well as the personal information of other individuals to the media. The complainant was specifically concerned that the City either lacked, or failed to enforce, proper policies respecting the handling of personal information.

 

The complainant pointed out that the Report had been distributed to Council members in advance of a meeting of one of City Council’s committees. The complainant noted that in a different situation, involving a different confidential report to Council, the report was only distributed to members of Council at the beginning of the meeting, and was collected at the end of the meeting.

 

In response to the complaint, the IPC opened this privacy complaint file to assess whether the City had acted in accordance with the Act.

 

Background Information

 

The complainant and the City have provided the following background information concerning this matter to the IPC.

 

 

The Report was prepared by a third party investigator hired by the City to investigate the unauthorized disclosure and distribution of City documents. The investigation culminated in the creation of the Report that is the subject of this complaint. The complainant was one of the individuals interviewed by the investigator, and the complainant’s name appears in the Report.

 

Due to the sensitive subject-matter of the Report, it was treated as a confidential document by the City and was circulated to members of City Council in a sealed envelope under a confidential covering memorandum on June 22, 2009. The memorandum stated that the Report would be discussed in a closed session of the Audit and Operational Review Committee (AORC) on June 29, 2009. The AROC recommendation regarding this matter was forwarded to City Council to be dealt with at a closed meeting of City Council that took place on June 30, 2009. Council members retained the copies of the Report that they received.

 

On June 30, 2009, the City issued a press release referencing the Report, which stated that:

 

… an independent and thorough investigation was undertaken by [an independent investigator] to determine how photocopies of City documents issued to contractors were publicly disclosed and distributed to the media.

 

The investigation report of how photocopies of corporate documents were provided to the media has been provided to the Audit and Operational Review Committee.

 

The Report had been dealt with in a closed session of the AORC and remained a confidential document at that time.

 

On September 11, 2009, a link to the complete Report appeared on the website of a media outlet. On that date, the City Commissioner of Legal and Administrative Services/City Solicitor wrote to the media outlet and advised that the Report had not been made publicly available by the City.

 

The City further stated that on September 30, 2009, the City Commissioner of Legal and Administrative Services/City Solicitor wrote to the media outlet to demand that the Report be removed from its website.

 

The City stated that on October 15, 2009, it became aware that the Report had been removed from the website of the media outlet. The City has also stated that it was not aware of the source of the disclosure of the Report to the media outlet.

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

The Report contains the name of the complainant, as well as details of the investigator’s interview with the complainant.

 Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

…

 

(g) the views or opinions of another individual about the individual, and

 

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual … .

 

I have reviewed the Report and confirm that it identifies the complainant by name and contains the details of the Investigator’s interview with the complainant.

 

I am satisfied that the Report contains personal information as defined under section 2(1) of the Act. The City concurs with this conclusion.

 

Was the disclosure of the “personal information” in accordance with section 32 of the Act?

 

In this case, the Report was in the custody and control of the City, and was distributed by its staff to members of Council so that it could be dealt with in closed sessions of Council and the AORC, a committee of Council. Subsequent to that time, the Report was disclosed to the media outlet, where it was posted to that media outlet’s website.

 

The City has stated that it “has no knowledge of how the release took place” and that it “takes no position on how the [R]eport in question was obtained by the media.”

 

Given the lack of information to the contrary, it is my view that the disclosure of the Report likely took place as a result of a disclosure by either a member of City Council, or a City staff member who had access to the Report.

 

Section 32 of the Act states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(a) in accordance with Part I;

 

(b)  if the person to whom the information relates has identified that information in particular and consented to its disclosure;

 

(c) for the purpose for which it was obtained or compiled or for a consistent purpose … .

 

Was the disclosure subject to the Act?

 

As noted, I have not been able to determine the identity of the individual who disclosed the Report. Both members of City Council and City staff had access to the Report that was in the custody and control of the City. If the source of the disclosure was a City staff member, the disclosure would clearly be considered to be a disclosure by the City under the Act because the record was in the custody or control of the City at the time it was disclosed.

 

However, if the disclosure originated with a member of City Council, the situation is more complex. The IPC has previously concluded that City Councillors are not considered to be “officers or employees” of an institution [Order MO-1264]. However, the activities of City Councillors have been found to be subject to the Act where those activities relate to personal information that is in the custody or control of a municipality [see Privacy Complaint Reports MC-02003-1 and MC-050018].

 

In Privacy Complaint Report MC-02003-1, which related to the disclosure of an e-mail by a municipal councillor, IPC Investigator Warren Morris stated:

 

I have already concluded that City councillors are neither officers nor employees of the City. Nevertheless, records in the possession of a councillor are subject to the Act if they are within the custody or control of the City. This assessment depends, in part, on whether the information was held by the councillor solely in his or her capacity as a constituent representative and never integrated into the municipality’s files (Orders M-846, M-813). In this case, I have concluded that the information related to City business and was not solely a constituency matter, as indicated by the fact that the information was originally provided to the councillors by the City.

 

In Order 120, former Commissioner Sidney B. Linden set out a list of factors to consider in deciding whether records are within an institution’s custody or under its control. Whether the record was created by an officer or employee of the institution, and whether its content relate to the institution’s mandate and functions are both identified as factors to consider, and in my view, these factors, in addition to the fact that the City provided the information to the councillors, and that it did not pertain to constituency matters, all support the conclusion that the e-mail remained within the City’s control. I have therefore concluded that, in the councillors’ hands, the e-mail was under the City’s control [emphasis added].

 

In considering the facts of this complaint, I am satisfied that similar considerations apply. In this case, the City retained an external investigator to prepare the Report on its behalf. Once completed, the Report was provided to the City, where it was circulated to members of City Council. The Report was provided to Council members in confidence, and at all times, remained in the City’s control. As was the case in MC-02003-1, the record in question did not relate to a particular constituency matter as it related to City business. Accordingly, I am satisfied that the Report was in the custody and control of the City, and that any actions taken by Council members with respect to the Report would be subject to the Act.

 

I therefore conclude that, regardless of whether the Report had been disclosed by a City staff member or a member of City Council, the disclosure of the Report constituted a disclosure under the Act.

 

Was the disclosure permissible?

 

The rules outlining the permissible disclosure of personal information under the Act are set out in section 32, which is reproduced above.

 

Section 32 contains a general prohibition on the disclosure of personal information that is subject to a list of exceptions set out in that section. I have reviewed section 32 and note that none of the exceptions listed in that section apply to permit the disclosure of the personal information to a media outlet as occurred in this case.

 

In the circumstances of this case, based on all of the above, and notwithstanding my conclusion below, the disclosure of the Report was not in accordance with the Act.

 

Did the City have reasonable security measures in place in accordance with section 3(1) of Ontario Regulation 823, made under the Act?

 

Section 3(1) of Ontario Regulation 823, made pursuant to the Act states:

 

Every head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.

 

This provision requires that institutions have reasonable measures defined, documented, and put in place to protect records in its custody from unauthorized access, and that these measures take into account the nature of the records in question. In this case, the record is a confidential Report containing personal information that was considered by City Council and one of its committees in closed sessions.

 

In order to determine whether the measures in place in a given institution are reasonable, it is necessary to consider the policies and procedures in place within the institution at the time of the improper disclosure.

 

The City has provided the IPC with a copy of the procedures used by the City Clerk’s staff to distribute reports that are considered in closed meetings of council and its committees. The procedure is titled “Preparation of Agenda for Closed Committee of the Whole (Closed Session) Meetings”. It lists the individuals that are entitled to receive these materials. Included are all members of City Council, the City Manager, the Deputy City Manager, the Commissioner of Legal and Administrative Services, the City Clerk, and the Deputy City Clerk. The procedure further states that materials are placed in white envelopes when they are distributed.

 

A number of individuals within the City, including both members of City Council, and City staff, would have had access to the confidential Report. It is therefore necessary to examine the policies and procedures that apply to both City employees as well as members of Council.

 

The City noted that City employees are subject to the City’s Code of Conduct. Among other things, the Code of Conduct in place at the time of the disclosure stated that municipal employees:

 

shall not disclose or release, by any means, to any member of the public, either in verbal or written form, any confidential information or material acquired by virtue of their official position as an employee.

 

The City stated that municipal employees (specifically staff in the City Clerk’s office and administrative staff in the Mayor and Council members’ offices) have received training from the Records Management Supervisor on the Act and their protection of privacy obligations.

 

With respect to the procedures governing the distribution of the Report to members of Council, the City has stated:

 

Closed session documents are managed by the City Clerk’s Department in a standard manner. All such material is handled and identified as confidential and is circulated in advance to members of Council under confidential cover as part of their agenda package for the meeting. Members of Council are obliged to keep the material confidential.

 

As noted above, the Report was provided to members of Council under a covering memorandum stating that the Report was “Strictly Private and Confidential”. The City also advised that at the time of its distribution, in accordance with the procedure, the Report had been placed in a white envelope that was marked “Confidential”. A Staff Report from the City Manager that accompanied the Report stated:

 

The Report … is provided to the Audit and Operational Review Committee under separate cover, as it is Strictly Private and Confidential. Notwithstanding the public interest around this highly publicized issue, the City is obligated to protect the personal privacy of identifiable individuals and as such the Report will not be publicly available.

 

The City provided a copy of the policy titled “Code of Ethics and Conduct for Members of Council” that was in effect at the time of the disclosure of the Report. This policy document did not specifically address the disclosure of confidential materials, but contained the following provisions, which are relevant:

 

4. A councillor is governed by the highest ideals of honesty and integrity in all his/her public and personal relationships.

 

…

 

7. A councillor will not violate the public trust by discussing matters of municipal concern in an appropriate [sic] place or in an unsuitable manner.

 

The City has further stated that later in 2009, subsequent to the disclosure of the Report, Council adopted a revised Code of Conduct for members of Council, which is titled “Code of Ethical Conduct for Members of Council”. This updated Code of Conduct is more detailed than the previous Code of Conduct, and contains the following explicit statement regarding confidential materials:

 

No Member shall disclose or release by any means to any member of the public, any confidential information acquired by virtue of their office, in either oral or written form, except when required by law or authorized by Council to do so.

 

As noted above, one of the concerns expressed by the complainant related to the fact that the Report had been distributed to members of Council in advance of the committee meeting, and was not collected at its conclusion. The complainant noted that he was aware of a situation in the past where Council members were required to return a confidential report at the end of a Council meeting.

 

The City addressed this concern, and explained the reason why the Report was distributed in advance of the AORC meeting:

 

… in order for Members of Council to be properly prepared for deliberations … materials are distributed to them in confidential envelopes approximately 3 - 4 days in advance. The report in question is particularly lengthy and complex, and there was no other effective way to enable Members to digest the report in advance of the meeting so that they would be prepared to discuss it.

 

The City explained that “there may be some confusion … as to the City’s procedures for the distribution of materials to Members of Council for consideration in a closed session.” The City acknowledged that there had been instances where confidential materials had been collected at the end of a meeting in the past, and stated:

 

While there have been occasions where information has been distributed and collected during a closed session, this is the exception rather than the rule. On the occasions this has happened, it is primarily if the material was for information purposes only, as opposed to requiring Council to take action. This was clearly not the case regarding [the Report].

 

 

The City further stated that Council members are “entitled to receive any materials, confidential or otherwise that are relevant to their decision making process,” and noted that Council members are not required under either the Municipal Act or the City’s Procedure by-law to return confidential materials after the resolution of a matter.

 

I have considered the information provided by the City. To summarize, the City stated that it had taken the following steps to protect the confidentiality of the Report:

 

•         The Report was distributed in white envelopes marked “Confidential”;

 

•         The covering memorandum enclosed with the Report noted that the Report was “Strictly Private and Confidential”;

 

•         At the time of the disclosure, members of Council were guided by the “Code of Ethics and Conduct for Members of Council” which referred to ethical conduct including honesty and integrity as well as maintaining the public trust; and

 

•         City employees were subject to a Code of Conduct that prohibited the disclosure of confidential materials.

 

In my view, these measures, taken together, entail that the City had reasonable measures in place to prevent unauthorized access to the Report as required under section 3(1) of Regulation 823. Although the disclosure that took place was inappropriate, I am satisfied that it did not occur as a result of a lack of reasonable security measures on the part of the City. Rather, I note that the Report was likely disclosed by an individual or individuals who knew, or ought to have known, that the disclosure was inappropriate and in contravention of City policy.

 

As noted above, since the disclosure, the City has issued a new Code of Conduct for Members of Council titled “Code of Ethical Conduct for Members of Council”. The City stated that members of Council have received training on this revised Code of Conduct. The City indicated that it has also updated the Code of Conduct for municipal employees, and that training on the new employee code will take place in the near future.

 

In my view, the implementation of these new Codes of Conduct for both employees and members of Council, along with training, are positive developments. These new Codes of Conduct strengthen existing protections of confidential information and specifically prohibit the improper disclosure of personal information. I hope that the implementation of these new Codes of Conduct will reduce the risk of further breaches of privacy of this nature in the future.

 

CONCLUSIONS:

 

1.            The Report contains “personal information” as defined under section 2(1) of the Act.

 

2.            The disclosure of the Report was not in accordance with section 32 of the Act.

 

 

3.            The City did have reasonable security measures in place as required under section 3(1) of Ontario Regulation 823, and these measures continue to be enhanced.

 

 

 

 

 

Original Signed by:                                                                             February 1, 2011

Mark Ratner Investigator