Privacy Reports
Decision Information
Summary:
• Access and correction request relating to records retained by Police concerning the appellant
• 2(1) “personal information” – records contain personal information of appellant and others
• Sections 28(2) and 29(1) (collection) - complied with
• Section 30 (use and retention) - complied with
• Section 32 (disclosure) not complied with
• Section 31 (use) partly complied with
• Recommendation to develop a police reference check program that complies with O. Reg 265/98 and the Charter. Further recommendation to assess the complainant’s police reference check situation
Decision Content
PRIVACY COMPLAINT REPORT PRIVACY COMPLAINT NO. MC-060020-1 Toronto Police Services Board Tribunal Services Department Services de tribunal administratif Tel: 416-326-3333 2 Bloor Street East 2, rue Bloor Est 1-800-387-0073 Suite 1400 Bureau 1400 Fax/Téléc: 416-325-9188 Toronto, Ontario Toronto (Ontario) TTY: 416-325-7539 Canada M4W 1A8 Canada M4W 1A8 http://www.i pc.on.ca
PRIVACY COMPLAINT REPORT PRIVACY COMPLAINT NO. MC-060020-1 INVESTIGATOR: John Higgins INSTITUTION: Toronto Police Services Board BACKGROUND: The complainant in this privacy complaint was arrested in 2002. The arrest arose from an allegation by his younger brother that the complainant and another individual (a third brother) had sexually assaulted him more than 40 years prior to the arrest. The arrest occurred shortly after the sexual assault allegation was brought to the attention of the Toronto Police Service. As a result, the complainant was charged with indecent assault on a male pursuant to section 148 of the Criminal Code. The charge was eventually withdrawn by the Crown. Prior to making his privacy complaint, the complainant made an access and correction request under the Municipal Freedom of Information and Protection of Privacy Act (the Act) to the Toronto Police Services Board (the Police). This request is the subject of Appeal MA-050181-2. That appeal is addressed in Order MO-2258, which is being issued concurrently with this privacy complaint report. The complainant also engaged in lengthy correspondence with the Police, beginning before he made the access and correction request, and continuing during the processing of this complaint, based on his concern that as a consequence of the charge that was laid against him and subsequently withdrawn, he would not be able to obtain a clear “Police Reference Check”. The complainant is a member of a volunteer organization that has asked him to provide a police reference check. As well, throughout the investigation of this complaint, the complainant has been involved in separate complaint processes with the Toronto Police Services Board in relation to his concerns about his arrest and his problems getting a clear Police Reference Check. The Board found, earlier this year, that “no further action is warranted” in relation to a policy complaint review, and closed that aspect of the matter, but opened a “conduct complaint”. The conduct complaint was recently dismissed as well. These processes, while addressing similar concerns to those raised by the complainant in this privacy complaint and the appeal addressed in Order MO-2258, are nonetheless entirely separate from the privacy complaint and the appeal. [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 2 - SUMMARY OF COMPLAINT: Appeal MA-050181-2 Appeal MA-050181-2, which is addressed in Order MO-2258 (issued concurrently with this report, as noted above) relates to the following request received by the Police under the Act: Correct C.P.I.C. record re: bogus offense. In addition, I wish all documents, records etc. re arrest on bogus offense to be returned to me. I will then be able to have a clear criminal record check. Several days after submitting this request, the complainant wrote to the Police and added that he wanted the records corrected and returned to him. In response to this request, the Police issued a decision letter granting partial access to the responsive records. Access to severed portions of the records was denied pursuant to section 14(1), 14(3)(b) and 38(b) of the Act. The complainant appealed that decision to this office. During the mediation stage of Appeal MA-050181-2, the complainant clarified his view that records relating to the charge against him should not be held by the Police and that all such records should be destroyed. The complainant wrote to this office and submitted the following clarification: ... all records in relation to the alleged sexual assault should be destroyed since the charges were withdrawn. This correspondence from the complainant was forwarded to the Police. In response, the Police issued a decision letter advising the complainant that “you have been removed from the C.P.I.C. database.” The decision letter included a copy of a letter previously sent to the complainant by the Criminal Records Department which confirmed that the complainant’s photographs and fingerprints taken by the Toronto Police Service have been destroyed. The letter also stated that: Other records pertaining to your arrest(s) may exist. These documents will be purged in accordance with the Police Service Record Retention Schedule, By-law 689-/2000. As the above decision did not address the complainant’s request for correction of his police records pursuant to section 36(2)(a), the mediator asked the Police to issue a decision regarding correction of records in their custody. As noted in Order MO-2258, the records identified by the Police which have not been destroyed are the C.O.P.S. (Centralized Occurrence Processing System) Archive Report versions of: (1) the General Occurrence Report, which contains the particulars of the complainant’s younger brother’s allegation and the investigation of that allegation by the Police, and (2) the Record of Arrest. After being asked to address the correction issue by the mediator, the Police issued another decision letter advising the complainant that, pursuant to the Toronto Police Service Record Retention Schedule, City of Toronto By-law 689-2000, records of arrest for this type of offence [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 3 - remain permanently on the Toronto Police Service database, and in this case, the C.O.P.S. records also remain permanently within the Records Management Section of the Service. The decision advised the complainant that he does “... not qualify for correction under section 36(2)(a) of the Act nor destruction pursuant to the by-law.” The decision also advised that he may submit a “‘Statement of Disagreement’ that can be attached to the general occurrence.” The complainant advised the Mediator that he was not satisfied with the above decision issued by the Police and on that basis, Appeal MA-050181-2 proceeded to the adjudication stage of the appeal process. During the adjudication stage of Appeal MA-050181-2, the complainant wrote to the Police and stated: I belong to a volunteer organization that has applied, to your Police Service, for a [Police Reference Check (PRC)] on myself. I am concerned that any or all records of [my] arrest, alleged assault (of which [named individual] and I were declared innocent) etc. kept by the TPS and/or other Police Services /Agencies may impact on my having a clear PRC. Is the outcome of my PRC available? The Police responded to the complainant by letter and stated: The matter has received careful consideration. However, disclosure of the existence of your file will continue as part of the Police Reference Check program which is specifically designed for screening where vulnerable persons are involved. Privacy Complaint MC-060020-1 During the adjudication stage of Appeal MA-050181-2, the complainant asked that this office conduct a privacy investigation regarding his concerns about the police reference check process. This complaint file (MC-060020-1) was opened and I was subsequently assigned the role of the investigator. As the facts and circumstances of this complaint are related to the facts and circumstances of the appeal, I decided to deal with the appeal and the privacy investigation at the same time. Accordingly, I issued a combined Supplementary Notice of Inquiry and Notice of Privacy Complaint to the Police, inviting supplementary representations on certain issues in the appeal (as discussed in Order MO-2258), and also on the issues relating to the privacy complaint. Although I decided that it would be expeditious and more convenient to the parties if the representations in the appeal and privacy complaint were dealt with together, I advised the parties that I intended to issue a separate order and Privacy Complaint Report at the conclusion of the adjudication and investigation. To be clear, this report disposes of the issues in complaint file number MC-060020-1 and Order MO-2258 disposes of the issues raised in Appeal MA-050181-2. However, in arriving at my decision at the conclusion of the appeal and this investigation, I have taken into account the complete representations of the parties. [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 4 - I received representations from the Police in response to the Supplementary Notice of Inquiry and the Notice of Privacy Complaint. I then sent a Supplementary Notice of Inquiry and Notice of Privacy Complaint to the complainant. I invited him to make representations in response to the Notice, and enclosed the complete copy of the representations of the Police. The complainant submitted representations. Upon receipt of the representations of the complainant, I sent a modified Notice to the Police inviting them to make representations in reply. The representations that I received from the Police raised issues to which I determined that the complainant should be given an opportunity to submit sur-reply representations. As a result, I sent a complete copy of the Police reply representations to the complainant and invited him to submit sur-reply representations. I received sur-reply representations from the complainant. It is also to be noted that during the investigation of this privacy complaint, the complainant met with several representatives of the Police, including the Manager of Records Management Services, and was given copies of the records that would be generated if the Police received a reference check request in relation to the complainant. These can be described as follows: • a letter whose addressee is “Name of Agency”, indicating only that the applicant (i.e., the complainant in this case) “has been mailed a summary sheet outlining the information on file with this service”; and • a letter to the complainant indicating that the “detailed information” on file is a charge of “indecent assault male (withdrawn).” The Police also provided a letter addressed “to whom it may concern” explaining that the record on file pertains to an assault that took place forty-five years ago and that the Police have no record of the complainant “being involved in any alleged activity of a similar nature.” There is no indication, in any material provided to me, to the effect that documentation of this nature has been given to anyone other than the complainant. DISCUSSION: The following issues arising from the investigation will be addressed in this Report: • Is the information in the records “personal information” as defined in section 2(1) of the Act? • Was the collection of the personal information in accordance with sections 28(2) and 29(1) of the Act? • Was the retention of the personal information in accordance with section 30 of the Act? • Does the proposed disclosure of personal information in response to a police reference check request comply with section 32 of the Act? • Was the use of the personal information in accordance with section 31 of the Act? [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 5 - I will deal with each issue below. Is the information in the records “personal information” as defined in section 2(1) of the Act? As noted, the records identified by the Police which have not been destroyed are a general occurrence report, which contains the particulars of the complainant’s younger brother’s allegation and the ensuing investigation, as well as the record of arrest. “Personal Information” is defined in section 2(1) as follows: “personal information” means recorded information about an identifiable individual, including, (a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual, (b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved, (c) any identifying number, symbol or other particular assigned to the individual, (d) the address, telephone number, fingerprints or blood type of the individual, (e) the personal opinions or views of the individual except if they relate to another individual, (f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence, (g) the views or opinions of another individual about the individual, and (h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 6 - The Police submit that the records contain the personal information of individuals other than the complainant who were involved in the investigation. The complainant notes that “all or most” of the information was contained in the Crown disclosure materials given to him and his co-accused brother in connection with the charges against them, but does not directly dispute that this constitutes personal information. Having reviewed the records at issue, I conclude (as I did in Order MO-2258) that both of them contain information about the following identifiable individuals in their personal capacities: the complainant; his co-accused brother; the complainant’s brother who alleged he had been assaulted; the complainant’s parents; and other siblings of the complainant. I conclude that this constitutes the personal information of these individuals. I also note that the personal information pertaining to the complainant only has already been disclosed to him. The withheld information relates to the other individuals. I am therefore satisfied that the information collected by the Police in these records is the personal information of the complainant and other individuals. Was the collection of the personal information in accordance with sections 28(2) and 29(1) of the Act? In this complaint, the information in the records was collected by police officers fulfilling their duty as such in responding to allegations of criminal behaviour. In his representations, the complainant states that the purpose for collecting the personal information was law enforcement. Section 28(2) of the Act addresses the authority for collecting personal information. It states: No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. Under this provision, in order for a given collection of personal information to be permissible, the institution must demonstrate that the activity in question fits into at least one of the three branches of section 28(2) that are set out above. The term “law enforcement” is defined in section 2(1) of the Act, as follows: “law enforcement” means, (a) policing, (b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, and (c) the conduct of proceedings referred to in clause (b); [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 7 - In view of the nature of the records and the history of this matter, as outlined above, I am satisfied that the Police collected and used the information “for the purposes of law enforcement” and accordingly, I conclude that the collection was in accordance with section 28(2). Section 29(1) addresses the manner in which personal information is collected. It states, in part: An institution shall collect personal information only directly from the individual to whom the information relates unless, … (f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or judicial or quasi-judicial tribunal; (g) the information is collected for the purpose of law enforcement. In this instance, although some personal information was collected directly from the individual to whom it relates (i.e. a “direct” collection), the information of concern to the complainant was not collected directly from him, but rather from his younger brother, in the form of allegations of criminal behaviour (an “indirect” collection). The Police submit that sections 29(1)(f) and (g) apply. It is only necessary that one of these sections apply in order to justify the indirect collection, and for the reasons expressed above in relation to section 28(2), I am satisfied that section 29(1)(g) applies. Accordingly, I conclude that the collection of this information by the Police from an individual other than the complainant was in accordance with section 29(1)(g). It is therefore not necessary for me to consider section 29(1)(f). Was the use and retention of the personal information in accordance with section 30 of the Act? Section 30(1) of the Act, in conjunction with section 5 of Regulation 823, prescribes a minimum period of time for the retention of personal information. As well, City of Toronto by-law 689/2000 calls for the record of arrest and the general occurrence report to be retained permanently. In this case, the complainant objects to the information being retained at all, and failure to comply with minimum retention periods is not at issue. Sections 30(2) and (3) deal with ensuring the accuracy of personal information. These sections state: (2) The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date. (3) Subsection (2) does not apply to personal information collected for law enforcement purposes. [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 8 - The Police submit that because of section 30(3), section 30(2) does not apply. The complainant submits that section 30(2) was not complied with and that no law enforcement purpose is evident under section 30(3). I have determined, above, that the personal information in the records was collected “for law enforcement purposes,” and accordingly, I am satisfied that the section 30(3) exception applies. Section 30(2) therefore does not apply in this case. In conclusion, I am satisfied that the retention and use of the personal information in the records by the Police was in compliance with section 30. Does the proposed disclosure of personal information in response to a police reference check request comply with section 32 of the Act? Section 32 states, in part, as follows: An institution shall not disclose personal information in its custody or under its control except, (b) if the person to whom the information relates has identified that information in particular and consented to its disclosure; (c) for the purpose for which it was obtained or compiled or for a consistent purpose; (e) for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement of arrangement under such an Act or a treaty; The Police submit that no disclosure has taken place in relation to the police reference check program. While that may be technically true, the Police have given a clear indication of what they would disclose in the event of a reference check request concerning the complainant, as outlined earlier in this report, and have refused to alter that disclosure in the face of considerable pressure from the complainant. In the circumstances of this case, therefore, it is necessary to consider the implication of such a disclosure in the context of the Act. Section 32(e) As noted, this section authorizes disclosure to comply with an “Act of the Legislature” or an “agreement or arrangement under such Act”. In Investigation I94-023P, this Office found that for the identical provision (42(e)) in the Freedom of Information and Protection of Privacy Act to apply, the statute in question must impose a duty on the institution to disclose the individual’s personal information; a discretionary ability to disclose is not sufficient. [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 9 - In this instance, however, section 41 of the Police Services Act (PSA) deems certain disclosures to be in accordance with section 32(e). Section 41 of the PSA states, in part: (1.1) Despite any other Act, a chief of police, or a person designated by him or her for the purpose of this subsection, may disclose personal information about an individual in accordance with the regulations. (1.2) Any disclosure made under subsection (1.1) shall be for one or more of the following purposes: 1. Protection of the public. 2. Protection of victims of crime. 3. Keeping victims of crime informed of the law enforcement, judicial or correctional processes relevant to the crime that affected them. 4. Law enforcement. 5. Correctional purposes. 6. Administration of justice. 7. Enforcement of and compliance with any federal or provincial Act, regulation or government program. 8. Keeping the public informed of the law enforcement, judicial or correctional processes respecting any individual. (1.3) Any disclosure made under subsection (1.1) shall be deemed to be in compliance with clauses 42(1)(e) of the Freedom of Information and Protection of Privacy Act and 32(e) of the Municipal Freedom of Information and Protection of Privacy Act. [Emphases added.] Notably, section 41(1.1) circumscribes the disclosure power by indicating that it must be “… in accordance with the regulations”. Therefore, in order to be “deemed to be in compliance” with section 32(e), the applicable regulation must be fully complied with. O. Reg. 265/98 under the PSA, entitled “Disclosure of Personal Information”, sets out several categories of authorized disclosures of personal information, and conditions that must be complied with in order for such disclosures to be authorized. O. Reg. 265/98 states, in part, as follows: 1. In this Regulation, an individual shall be deemed to be charged with an offence if he or she, (a) is arrested and released in accordance with Part XVI of the Criminal Code (Canada); or (b) is served with a summons under Part III of the Provincial Offences Act in relation to an offence for which an [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 10 - individual may be arrested, even if an information has not been laid at the time the summons is served. 3. (1) A chief of police or his or her designate may disclose personal information, as described in subsection (2), about an individual to any person if the individual has been charged with, convicted or found guilty of an offence under the Criminal Code (Canada), the Controlled Drugs and Substances Act (Canada) or any other federal or provincial Act. (2) If subsection (1) applies, the following information may be disclosed: 1. The individual's name, date of birth and address. 2. The offence described in subsection (1) with which he or she has been charged or of which he or she has been convicted or found guilty and the sentence, if any, imposed for that offence. 3. The outcome of all significant judicial proceedings relevant to the offence described in subsection (1). … 6. In deciding whether or not to disclose personal information under this Regulation, the chief of police or his or her designate shall consider the availability of resources and information, what is reasonable in the circumstances of the case, what is consistent with the law and the public interest and what is necessary to ensure that the resolution of criminal proceedings is not delayed. [Emphasis added.] I also note that section 5 of O. Reg. 265/98 addresses the disclosure of personal information to “... any person or agency engaged in the protection of the public, the administration of justice or the enforcement of or compliance with any federal or provincial Act, regulation or government program.” In my view, that section is not applicable here as there is no indication that the program for which the complainant requires the Police Reference Check meets these criteria. In any event, the crucial section for the purposes of this discussion is section 6, which applies, moreover, to disclosures under section 5. This regulation was recently considered in the Privacy Complaint Report issued in Privacy Complaint Files MC-050045-1 and MC-050047-1 (Toronto Police Services Board). In that report, Investigator Mark Ratner dealt with disclosures of personal information under the police reference check program. The information in that case was about individuals who had not been charged with any offences; rather, they had previously been the subject of detainments by Police pursuant to section 17 of the Mental Health Act. He found that O. Reg 265/98, and consequently section 32(e), did not apply. He stated: [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 11 - I have carefully reviewed the wording of Ontario Regulation 265/98, and note that all of the disclosures permitted under that Regulation relate to situations where the individual in question has either been charged, convicted, or under investigation with respect to an offence under a federal or a provincial Act. I note that in the case of the complainants, neither has been charged, convicted or been under investigation with respect to an offence. Rather, both have been the subject of a non-criminal detainment under the Mental Health Act. As such, I am not satisfied that the disclosure that took place was in accordance with any of the provisions of Ontario Regulation 265/98, which leads to the conclusion that the disclosure was not in accordance with section 41(1.1) of the PSA. The situation here is different. The complainant has been charged, and therefore the provisions of section 41 of the PSA and O. Reg. 265/98 come into play. In their extended correspondence with the complainant, the Police continually refer to City of Toronto by-law No. 689/2000, whose purpose is “[t]o establish a schedule of retention periods for records of the [Police].” As noted previously, it specifies that the retention period for occurrence reports and records of arrest, the two records known to be retained by the Police in relation to the complainant, is “permanent”. While the Police do not say so directly in their representations or elsewhere, they appear to assume that if records of this nature are retained pursuant to the by-law, their existence must be disclosed in response to a police reference check request. For example, in a report about the complainant’s concerns delivered by the Chief to the Toronto Police Services Board, reference is made to the letters given to the complainant showing what would be disclosed in response to a police reference check request (as discussed above). The report states: The complainant expressed his dissatisfaction with the letters, despite clear explanation of the legislative requirements of the … Record Retention Schedule [i.e., by-law 689/2000] that govern the collection, maintenance and retention of police records. He reiterated his position that the original police report should be destroyed in order that he may continue to participate in volunteer activities with an agency that requires proof that no such record exists. In my view, the position that the existence of retained records must be disclosed in response to a police reference check request is not sustainable in the face of the clear direction provided by section 6 of Regulation 265/98, which requires a discretionary approach to the disclosure of personal information. However, rather than addressing Regulation 265/98 in their representations, the Police instead take the position that even in the event of an actual police reference check request, “… there still would have been no release by this institution. … [I]f a match is found on a police database, the particulars of the match are sent directly to the applicant; NOT to the agency representing them.” [Emphases in original.] [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 12 - I do not accept this submission. The letter the Police provided to the complainant in relation to what they would disclose to the agency in question names the complainant and states that “… the aforementioned applicant has been mailed a summary sheet outlining the information on file with this service.” I also note the following statement on the consent form the Police require applicants to sign before a police reference check is conducted: In the event no information about me is found as part of [the police reference check], I consent to the Toronto Police Service disclosing that fact to the organization identified below. In the event that pertinent information is provided to me, I consent to the Toronto Police Service disclosing that fact to the organization identified below.” In other words, the information provided to the agency is different depending on whether the search for records produces any information relating to the individual in question. If no match is found, the Police inform the agency of this fact. If a match is found, a letter disclosing the fact that the applicant has been sent “information on file” with the Police is sent to the agency (as evidenced by the letter the Police provided to the complainant in this case, in order to show him what would be disclosed). In my view, revealing that a named individual has “information on file” with a police force is a very significant disclosure of sensitive personal information, even if no particulars are provided. As well, although this disclosure does not include all types of information mentioned in section 3 of O. Reg. 265/98, the context makes it clear that this regulation is applicable in the circumstances of this complaint. In that regard, it is important to note that the letter proposed to be sent to the complainant discloses his name, date of birth, the charge and the outcome of the proceedings. The letter to the agency discloses a subset of this information and makes direct reference to it by stating that the applicant has been mailed a summary sheet outlining this “information on file.” In my view, this is precisely the sort of disclosure that section 41 of the PSA, and O. Reg. 265/98 is intended to address. I note, as well, that section 41 of the PSA states that one of the purposes for which disclosure is mandated is “protection of the public”, which is a principal purpose of the Police Reference Check program. Accordingly, I conclude that section 6 of O. Reg. 265/98 must be complied with in relation to the disclosure the Police would make in response to a reference check application in this case. As indicated previously, this section requires that in deciding whether to disclose, the Police must “… consider the availability of resources and information, what is reasonable in the circumstances of the case, what is consistent with the law and the public interest….” In this complaint, although the Police have met with the complainant and have offered to provide a letter outlining that the alleged incident occurred 45 years ago and there is no indication he has been involved in anything similar since that time, I am not satisfied that the Police have complied with section 6 of the regulation. For example, they appear not to have considered the option of not disclosing the existence of records to the agency, nor have they considered factors such as the non-conviction outcome in this case, the nature of the volunteer work the [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 13 - complainant proposes to undertake. All of these considerations are relevant in determining “what is reasonable in the circumstances.” As noted above, section 41 of the PSA permits disclosure “in accordance with the regulations,” and such disclosure is “deemed to be in compliance” with section 32(e) of the Act. The mandatory provisions of section 6 of O. Reg. 265/98 have not been complied with, and I therefore conclude that the disclosure would not be “in compliance with the regulations.” On this basis I conclude, as well, that the disclosure cannot be “deemed to be in compliance” with section 32(e). No other basis for the application of section 32(e) has been advanced. I have therefore determined that section 32(e) does not authorize the proposed disclosure of information to the agency. Section 32(b) As noted above, this section authorizes disclosure “if the person to whom the information relates has identified that information in particular and consented to its disclosure.” Neither the Police nor the complainant provided specific representations on this issue. However I have examined the consent form that the Police require to have completed by reference check applicants. It states: I hereby request the Toronto Police Service to undertake a Police Reference Check on me by searching the appropriate data banks both, national and local to which the Service has access, and provide me with a summary of any information revealed pursuant to the Police Reference Program. In the event that no information about me is found as part of that check, I consent to the Toronto Police Service disclosing that fact to the organization identified below. In the event that pertinent information is provided to me, I consent to the Toronto Police Service disclosing that fact to the organization identified below. An earlier version of this form was analysed in the Privacy Complaint Report issued in Privacy Complaints MC-050045-1 and MC-050047-1. In that Report, Investigator Ratner concludes that the consent was not specific enough to encompass records related to the Mental Health Act, and that section 32(b) was not complied with in that case because the individuals did not “identify that information in particular.” As a consequence, the Investigator recommended that the Police “… amend its form so that it complies with the statutory requirement to obtain informed consent prior to disclosing personal information.” In my view, a similar difficulty arises here, in light of the very vague description of the databases to be searched. This problem could be addressed by further amendments to identify the specific databases, both national and local, that may be searched. In this case, however, I have further reservations about the use of section 32(b) as a basis for disclosing information through the police reference check program. I accept Investigator [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 14 - Ratner’s conclusion that an amended form of consent could mean that, depending on how the consent is worded, section 32(b) is a valid basis for disclosing the existence of Mental Health Act records. For the reasons that follow, I have reached a different conclusion here. As noted previously, Investigator Ratner determined that O. Reg. 265/98 did not apply in that case because there had been no criminal charges or convictions. I concluded, above, that it does apply here. In my view, where there is a legislated standard in relation to the disclosure of personal information, such as that provided by section 41 of the PSA and outlined with further specificity in O. Reg. 265/98, it is inappropriate to rely on consent as the basis for disclosure where the legislated standard is not met. The Legislature has provided very specific direction on this issue by these enactments. This view is reinforced by the nature of the consent that is obtained in the context of police reference checks. Applicants are required to provide their consent in the form chosen by the Police. An individual seeking to participate in a program requiring a police reference check has no choice but to sign the form, including the consent, or no reference check will be performed. As the complainant states in his representations: If I refuse to complete a Police Reference Check (PRC) application, I must resign my Volunteer position. If I receive the results of a PRC and refuse to supply the agency with the results, I must also resign my Volunteer position. Through no fault of my own, I am compelled to resign a Volunteer position because of damaging personal information being kept by [the Police], initiated by bogus and false information supplied by the “victim”…. In my view, relying on consent in these circumstances and thereby avoiding the requirements of section 41 of the PSA and O. Reg. 265/98 would circumvent the clear direction of the Legislature on this issue. Accordingly, I conclude that section 32(b) does not provide a basis for the proposed disclosure in this case. Section 32(c) As noted above, this section provides authority for disclosure of personal information “for the purpose for which it was obtained or compiled or for a consistent purpose.” Section 33 provides a definition for “consistent purpose” where the personal information has been collected directly. This section states: The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31(b) and 32(c) only if the individual might reasonably have expected such a use or disclosure. [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 15 - Where information was collected indirectly (i.e. from someone else), as the complainant’s personal information was in this case, the Act provides no definition of “consistent purpose”. As established by Privacy Investigation Report I93-009M, with respect to indirectly collected information, a use that is “reasonably compatible with the purpose for which it was collected” would be a “consistent purpose”. In this case, as the complainant notes in his representations (reproduced above in the discussion of section 32(b)), the damaging allegations that are the subject of this complaint were obtained from the complainant’s younger brother, which is an “indirect” collection. In my view, the purpose for the collection was to investigate an alleged criminal offence. In this instance, the charges were withdrawn by the Crown. In my view, disclosure of this information in the context of a police reference check request without an appropriate exercise of discretion that takes the particular circumstances of the case into account is not “reasonably compatible” with the original purpose of investigating an alleged crime. In this regard, I consider the fact that such a disclosure would not be in compliance with O. Reg. 265/98, and particularly section 6 of that regulation, to be a very relevant factor. Again, in my view, given the clear direction provided by the Legislature in relation to this type of disclosure, it would be inappropriate to rely on a broad application of “consistent purpose” to authorize the proposed disclosure. Rather, the police reference check program should conform to the requirements of the regulation and then section 32(e) would be available as the authority for disclosure. I conclude that section 32(c) does not authorize the proposed disclosure in this case. Section 32 – Conclusion To summarize, I conclude that section 32 does not authorize the proposed disclosure of personal information in this case. Was the use of the “personal information” in accordance with section 31 of the Act? Section 31 states, in part: An institution shall not use personal information in its custody or under its control except, (a) if the person to whom the information relates has identified that information in particular and consented to its use; (b) for the purpose for which it was obtained or compiled or for a consistent purpose; … It is evident from the information provided to me that the Police used the information in the records in relation to their criminal investigation of the complainant and the laying of sexual [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 16 - assault charges, which is (as noted above) the purpose for which the information was originally collected. Accordingly, this use was for the purpose for which the information was originally collected, and it is therefore authorized by section 31(b). Turning to the proposed use in relation to the police reference check program, the analysis under sections 31(a) and (b) is identical to the discussion of sections 32(b) and (c), above. In my view, it is more appropriate to characterize the proposed response to a police reference check request as a “disclosure”, but in any event, for precisely the reasons articulated in relation to sections 32(b) and (c), I conclude that this use is not authorized by section 31(a) or (b). As stated above, in the context of the reference check program, the Legislature has provided clear direction on the disclosure of this type of information in the PSA and O. Reg. 265/98. Whether the response to a police reference check request is seen as a use or a disclosure, in my view, the reference check program must comply with those legislative requirements before such a response would be authorized under the Act. CONSTITUTIONAL ISSUES In the Supplementary Notice of Inquiry and Notice of Privacy Complaint, I invited the parties to comment on whether the Canadian Charter of Rights and Freedoms (the Charter) has an impact on the interpretation of the sections of the Act that are the subject of this Report. The issues under the Charter are extensively canvassed in Order MO-2258 and it is not necessary to repeat that detailed analysis here. The essential question is whether these sections of the Act should be interpreted “consistently with Charter values”. As noted in Order MO-2258, the Supreme Court of Canada discussed this principle in Bell ExpressVu Limited Partnership v. Rex, [2002] S.C.J. No. 43. The Court states that Charter values may be applied in statutory interpretation where the statute is ambiguous: it must be stressed that, to the extent this Court has recognized a "Charter values" interpretive principle, such principle can only receive application in circumstances of genuine ambiguity, i.e., where a statutory provision is subject to differing, but equally plausible, interpretations. [Emphasis added.] In my view, the sections of the Act considered in this Report are not ambiguous in this sense. It is possible to distinguish among competing interpretations and determine that which is most plausible, as I have done in the analysis conducted in this report. Accordingly, I am not in a position to apply “Charter” values. However, as I stated in Order MO-2258: … it is important to note that the continuing retention of the appellant’s personal information in the circumstances of this case may be a continuing seizure, to which the standards found in section 8 of the Charter would apply, just as the retention of fingerprints was found to be a continuing seizure in Doré. My reasoning, above, should not be interpreted as a finding of fact that there is no [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 17 - continuing seizure. However, because of Bell ExpressVu, I am not able to apply Charter values in the interpretation of section 36(2). If there is a Charter violation, it must be addressed in another forum. Similarly, the conclusions in this report are not to be construed as a finding that the police reference check program is in compliance with the Charter. CONCLUSIONS AND REMEDY My conclusions in this Report may be summarized as follows: • The information in the records is “personal information” as defined in section 2(1) of the Act. • The collection of the personal information was in accordance with sections 28(2) and 29(1) of the Act. • The retention of the personal information is in accordance with section 30 of the Act. • The proposed disclosure of personal information in response to a police reference check application would not comply with section 32 of the Act. • The use of the personal information by the Police in conducting their investigation was in accordance with section 31 of the Act. The use in responding to a police reference check application would not comply with section 31 of the Act. On the question of remedy, the complainant’s main objective is a clear Police Reference Check. He refers to the destruction of the records maintained by the Police as a way to accomplish this. In Order MO-2258, I concluded that the records did not require correction under section 26(2)(a), and destruction was therefore not ordered in that context. I also note that section 46(b)(ii) of the Act authorizes the Commissioner to “destroy collections of personal information that contravene this Act.” In this case, however, I have found that the information was collected in accordance with the Act, and in the absence of any other indication that the collection of personal information contravenes the Act, I have concluded that this section does not apply in this case. In my view, the retention of records by the Police and the disclosure of information in response to a police reference check request are two separate issues. Neither Order MO-2258 nor this Report concludes that the retention of the records by the Police is not authorized. However, in this Report I have concluded that the proposed disclosure in response to a police reference check application is not authorized under the Act in the present circumstances, based essentially on non-compliance with section 6 of O. Reg. 265/98. My recommendations will therefore focus on bringing the police reference check program into conformity with that provision, because it has a direct bearing on whether disclosure in this context would be authorized under section 32(e). [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 18 - RECOMMENDATIONS: In the Report on Privacy Complaints MC-050045-1 and MC-050047-1, Investigator Ratner recommended the adoption of a discretionary process in responding to police reference check requests. He stated: I note that the difficulties posed by Police Reference Checks discussed in this Privacy Complaint Report are not unique to the TPS, nor are they unique to Ontario. Other police services and jurisdictions in Canada have also attempted to facilitate Police Reference Checks in a manner that protects vulnerable persons while providing some privacy protections to individual applicants. In Ontario, some police services have also attempted to create processes where an assessment of the potential risk posed by the individual is considered prior to disclosing the fact that a record exists. I note that at least one other police service in the province of Ontario appears to be introducing a process whereby risk is assessed on a case-by-case basis for each applicant. In my view, adding a discretionary risk assessment component to the process is an approach that is preferable to the current TPS process. … I would recommend that the TPS reconsider its policy of automatic disclosure of records of a non-criminal detainment under the Mental Health Act pursuant to Police Reference Checks. As an alternative approach, I would recommend that the TPS consider implementing a discretionary process of assessing risk on a case-by-case basis before sending a letter to an organization indicating prior contact with the police. In making this assessment, the TPS should consider the events relating to the original detainment, and whether such events are indicative of a potential risk. To reiterate, section 6 of O. Reg 265/98, which I have found applicable to the police reference check process, states: In deciding whether or not to disclose personal information under this Regulation, the chief of police or his or her designate shall consider the availability of resources and information, what is reasonable in the circumstances of the case, what is consistent with the law and the public interest and what is necessary to ensure that the resolution of criminal proceedings is not delayed. [Emphasis added.] I recommend that the Police adopt a discretionary process for responding to police reference check requests that will conform to the requirements of this provision. In developing this process, I recommend that the Police bear in mind that this is a discretionary process, in which relevant factors must be considered, not irrelevant ones. The words of this section provide considerable guidance in this regard. It is to be noted, as well, that this determination must be made on a case-by-case basis. Deciding that all charges in relation to a particular category of [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
- 19 - offence, whether or not they result in convictions, must always produce a response indicating that information is on file regarding the applicant, would not comply with this requirement. In my view, a non-conviction outcome requires very close scrutiny in deciding whether or not to disclose the existence of information. On the other hand, a guideline stating that a conviction for a particular offence or category of offences would normally produce a reference check response indicating the existence of information, except in unusual circumstances, may be in compliance. The discretion required by section 6 of O. Reg. 265/98 is provided for in this approach because it allows for a variation from the usual response in appropriate circumstances. In responding to this recommendation, I would encourage the Police to develop a police reference check process that is consistent with this office’s previous submissions on the Police’s proposed policy on the destruction of records, i.e., an approach that does comport with Charter values and privacy concerns. In this regard, I recommend that the Police give careful consideration to the requirements of sections 7, 8 and 11(d) of the Charter. By March 21, 2008, the Police should provide the Office of the Information and Privacy Commissioner with proof of compliance with this recommendation. I also recommend that the Police exercise discretion pursuant to section 6 of O. Reg. 265/98 in relation to the complainant’ s proposed Police Reference Check, and advise him of their position in writing, with a copy to me, not later than January 21, 2008. In doing so, I recommend that the Police bear in mind that the charges against the appellant have been withdrawn, the absence of any other charges and/or convictions, the historical nature of the allegation that led to the charge, and the nature of the proposed volunteer work. In my view, it is also relevant that the complainant’s photographs and fingerprints qualified for destruction, and the information concerning him has been removed from C.P.I.C. Further, as I noted in the postscript to Order MO-2258, the provision in section 11(d) of the Charter (that a person has the right to be presumed innocent until proven guilty) is of particular importance. The complainant has not been found guilty of anything. Original signed by: December 21, 2007 John Higgins Senior Adjudicator/ Investigator [IPC Privacy Complaint MC-060020-1 / December 21, 2007]
You are being directed to the most recent version of the statute which may not be the version considered at the time of the judgment.