PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT PC18-18

Ministry of Transportation

November 22, 2019

Summary: The Office of the Information and Privacy Commissioner of Ontario received a complaint alleging that the Ministry of Transportation contravened the Freedom of Information and Protection of Privacy Act when it disclosed the complainant’s personal information to the War Amputations of Canada. This report finds that the information at issue is “personal information” as defined in section 2(1) of the Act and that the personal information was disclosed in accordance with section 42(1)(c) of the Act.

Statutes Considered: Freedom of Information and Protection of Privacy Act, sections 2(1), 41, 42(1), 43, Highway Traffic Act, section 205.

Orders and Investigation Reports Considered: PC07-21 and MC16-4

BACKGROUND:

[1]  On April 3, 2018, the Office of the Information and Privacy Commissioner/Ontario (the IPC) received a privacy complaint under the Freedom of Information and Protection of Privacy Act (the Act) against the Ministry of Transportation (the ministry or MTO). The complaint related to the disclosure of the complainant’s personal information to the War Amputations of Canada (War Amps).

[2]  According to the complainant, she received a solicitation letter from the War Amps addressed to her at her home address. The complainant advised that she had not provided her information to the War Amps and after receiving the solicitation letter, she contacted the War Amps and was told that her personal information had been provided to them by the ministry. The complainant’s complaint is that she did not consent to the disclosure of her personal information by the ministry to the War Amps and that this disclosure contravenes the Act.

[3]  During the intake stage of this complaint, the ministry provided background information about its Authorized Requester Program as it relates to the concerns outlined by the complainant and stated the following:

Personal information is collected by MTO under the authority of section 205 of the Highway Traffic Act. The information is used for creating a record that is maintained as a public record and used for the administration of the ministry’s driver, vehicle and carrier programs.

Access to residential address information is restricted to Authorized Requesters who enter into a contractual agreement with [the ministry] after the purpose of their request is reviewed and determined to meet the ministry’s criteria. Only those organizations with a legitimate need for this information may become Authorized Requesters. Examples of such needs include parking enforcement, investigation of claims and judicial services, debt collection and automobile insurance underwriting. In addition, Authorized Requesters must be properly licensed to conduct their business.

A public notice about the program is placed in all Driver and Vehicle Licence Issuing Offices, is on the ministry’s website at; http://www.mto.gov.on.ca/english/about/collection.shtml, and noted in the newsletter that is inserted with all Vehicle Licence Renewal Applications.

[4]  The ministry stated that the War Amps is an Authorized Requester for the purposes of operating the key tag program. The ministry described the key tag program, stating that it provides the War Amps with the address information of all drivers in the ministry’s driver database. The War Amps mails out key tags, free of charge to all individuals in the database. It is my understanding that if a set of keys with a key tag is lost, the War Amps will identify the owner and return the keys to the owner at no charge.

[5]  The ministry also stated that individuals can opt-out of being on the War Amps’ mailing list by making a request to the ministry or to War Amps.

[6]  This matter was then moved to the investigation stage of the IPC’s process under the Act and I was assigned as the investigator.

INVESTIGATION:

[7]  During my investigation, I requested and received representations from both the ministry and the complainant’s legal representative. In its representations, the ministry provided additional information regarding the collection, use and disclosure of the information at issue in this complaint as it relates to the War Amps and provided clarification to some of the information that it provided at the intake stage.

ISSUES:

[8]  The following issues were identified in this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act?
2. Was the disclosure of the information authorized by the Act?

DISCUSSION:

Issue 1: Is the information at issue “personal information” as defined by section 2(1) of the Act?

[9]  Section 2(1) of the Act states in part:

 “personal information” means recorded information about an identifiable individual, including,

…

c) any identifying number, symbol or other particular assigned to the individual,

d) the address, telephone number, fingerprints or blood type of the individual,

…

h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[10]  While the ministry’s initial representations at the intake stage only referred to the disclosure of name and address information, it was subsequently clarified that the ministry’s disclosure to the War Amps also includes drivers’ licence numbers. Therefore, the information at issue in this matter is the complainant’s name, address and driver’s licence number. Based on the above definition, I am satisfied that the information in question clearly qualifies as “personal information” under the Act. The ministry does not dispute this.

[11]  I therefore find that the information at issue is “personal information” as defined in section 2(1) of the Act.

Issue 2: Was the disclosure of the information authorized by the Act?

[12]  Section 42(1) of the Act imposes a general prohibition on the disclosure of personal information except in a number of enumerated circumstances.

[13]  In order for a given disclosure of personal information to be permissible under the Act, the institution in question must demonstrate that the disclosure was in accordance with at least one of the section 42(1) exceptions.

[14]  Section 42(1) states the following in part:

An institution shall not disclose personal information in its custody or under its control except,

…

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

…

[15]  In this instance, the ministry has taken the position that its disclosure of the complainant’s personal information to War Amps was in accordance with section 42(1)(c) of the Act.

[16]  To determine whether a given disclosure of personal information is in accordance with section 42(1)(c), it is first necessary to determine the original purpose of the collection. Next, it is necessary to assess whether the disclosure of this information can be properly characterized as being either for the original purpose of the collection, or for a purpose that is consistent with that original purpose.

What was the original purpose of the collection?

[17]  As previously indicated, the ministry’s position is that personal information is collected by the ministry under the authority of section 205 of the Highway Traffic Act and is used to create a record that is maintained as a public record and used for the administration of the ministry’s driver, vehicle and carrier programs.

[18]  Section 205 of the Highway Traffic Act sets out the duties of the Registrar of Motor Vehicles for the province of Ontario, which include, among other things, the maintenance of records relating to licences in the province.

[19]  Section 205(1) states, in part:

205. (1) The Registrar shall, …

(c) keep,

(iii) a record of all licences, permits and CVOR certificates issued, suspended, revoked, cancelled or revived under this Act … .

[20]  I have also reviewed the ministry’s Notice of Collection, which is posted on its website. It states:

Personal information is collected on behalf of [the ministry] under the authority of section 205 of the Highway Traffic Act. The information is used for the administration of the Ministry's driver, vehicle and carrier programs.

Residential address information collected is not available to the general public. Only "Authorized Requesters" who have been approved and have entered into a contractual agreement with the Ministry may obtain residential address information for the purposes set out below:

• Safety recalls by auto manufacturers

• Law enforcement

• For use by lawyers, process servers, bailiffs and private investigators for legal purposes related to the justice system including:

• Service of legal documents

• Investigations which may give rise to legal proceedings

• Locating persons in connection with claims/litigation/motor vehicle collisions

• Repossession of assets

• Verification of information by financial institutions

• Collection of debts resulting from failure to pay amounts owing to:

• Road toll authorities

• Financial institutions

• Government (including courts)

• Municipal and private parking authorities

• Toll collection (e.g. 407-ETR)

• Key tag service (War Amps)

• Automobile insurance purposes (e.g. claims and underwriting)

• Parking violations (private, municipal and government parking)

• Government use for program delivery where authorized by statute

[21]  In her representations the complainant does not dispute the ministry’s position that section 205 of the Highway Traffic Act, authorizes the ministry to collect personal information, and that the Registrar is obliged to keep records.

[22]  Based on the information provided by the ministry as well as the information contained in the above noted notice, I am satisfied that the purpose of the ministry’s collection of the personal information at issue is to administer the ministry’s driver, vehicle and carrier programs.

Was the disclosure for the original or a consistent purpose?

[23]  The next step in the section 42(1)(c) analysis is to determine whether the disclosure was for the original purpose of the collection or for a purpose consistent with that original purpose.

Ministry’s representations

[24]  The ministry has taken the position that the disclosure to the War Amps was for a consistent purpose and in support of this has stated the following:

As the immediate purpose of the list of driver information is to facilitate the War Amps’ safe return of keys program, the ministry believes that this purpose is consistent with [the] purpose of collecting driver information. It offers the driving public the opportunity to avail itself of the key return service at no charge.

Further, as provided under section 43 of the Freedom of Information and Protection of Privacy Act, a consistent purpose disclosure is one that an individual might reasonably have expected, and the ministry believes that this threshold is met in the case of the War Amps key tag program […]

Accordingly, in the Ministry’s view, the long term presence of the key tag program in Ontario, the widely established knowledge of the association between the Ministry and this program and the role played by the War Amps in promoting driver safety, a role that is clearly connected to its advocacy on behalf of amputees in Canada, establish that the disclosure of personal information to the War Amps is for a consistent purpose.

[25]  The IPC asked the ministry to explain why the disclosure of information to the War Amps included drivers’ licence numbers as well as name and address. The ministry stated that the driver’s licence number was required in order to:

• uniquely identify individuals who share the same name and address; and
• ensure that when an individual opts out of being on the War Amps mailing list, that the opt-out is correctly and consistently applied.

[26]  Upon request of the IPC, the ministry also provided additional information about how individuals can opt-out of having their information included on the War Amps’ mailing list. The ministry explained that an individual can make an opt-out request either to the ministry or to the War Amps. In either case, the individual is deleted from the War Amps’ current mailing list and also from subsequent disclosures of personal information from the ministry to the War Amps. It is my understanding from the ministry’s representations that this opt-out procedure requires the use of the driver’s licence number in order to ensure that an individual who opts-out remains opted-out even if, for example, they changed their address or name.

[27]  As noted above, in its representations the ministry also referenced its Notice of Collection which includes a notice about its disclosure of personal information pursuant to the Authorized Requester program, including to the War Amps.

Complainant’s Representations

Preliminary Issue

[28]  During my investigation, the complainant took the positon that section 205.0.1(5) of the Highway Traffic Act is applicable in the circumstances of this complaint as it speaks to the ministry’s authority to disclose information.

[29]  In support of this position, the complainant stated the following:

Section 205.0.1(2) states that the Ministry “may disclose information to any public body or related government, as he or she considers appropriate, if the Minister considers it necessary for a purpose set out in [section 205.0.1(5)]”

Under section 205.0.1(10) a public body means:

(a) any ministry, agency, board, commission, official or other body of the Government of Ontario,

(b) any municipality of Ontario,

(c) a local board, as defined in the Municipal Affairs Act, and any authority, board, commission, corporation, office or organization of persons some or all of whom members, directors or officers are appointed or chosen by or under the authority of the council of a municipality in Ontario, or

(d) a prescribed person or entity; (“organisme public”)

MTO approves Authorized Requesters and grants them access to specific information. We contend that as an Authorized Requester, War Amps is a prescribed entity under subsection 205.0.1(10)(d). [Emphasis in complainant’s representations; complainant’s footnotes omitted.]

[30]  The complainant’s representations go on to discuss section 205.0.1 (5) of the Highway Traffic Act, applying it to the disclosure of personal information to the War Amps by the ministry, on the basis that the War Amps is a prescribed entity.

[31]  As I was unable to identify any regulation or other enactment that designates the War Amps as a prescribed person or entity for the purpose of section 205.0.1 of the Highway Traffic Act, I asked the ministry to respond to the complainant’s assertion that War Amps is a prescribed entity. The ministry advised that the War Amps is not a prescribed person or entity for the purpose of section 205.0.1 of the Highway Traffic Act.

[32]  Based on my own review of these provisions and the representations of the ministry, I find that section 205.0.1 of the Highway Traffic Act, does not apply to the ministry’s disclosure of personal information to the War Amps and I will not consider the complainant’s representations on this point.

Complainant’s Position on Disclosure

[33]  The complainant takes the position that the primary purpose of the War Amps’ key tag program is to solicit funds.

[34]  The complainant stated the following with respect to the disclosure:

It is still our position that War Amps’ primary purpose for obtaining personal information from MTO is to solicit donations through their Key Tag Service program. While it is legal for a registered charity like War Amps to solicit donations, MTO’s disclosure of personal information to War Amps to solicit donations contravenes sections 41, 42(1) and 43 of [the Act].

[35]  In addition to the above, the complainant states that the ministry “attempt[s] to frame War Amps’ solicitation efforts as a by-product of its Key Tag Service.” The complainant also asserts that even if it were reasonable to expect that the ministry would disclose personal information to the War Amps for the key tag program, individual’s would not reasonably assume that such disclosure will simultaneously be used to solicit donations.

[36]  The complainant states that online and news sources indicate that Ontarians do not reasonably expect their personal information to be disclosed to the War Amps. The complainant goes on to cite online sources such as reddit threads and an article about an individual in Manitoba in 2008 who objected to her personal information being disclosed to the War Amps. The complainant argues that this demonstrates that individuals might not know or expect that their information would be disclosed.

[37]  The complainant relies on Privacy Complaint Report PC07-21 in her representations to support the position that the ministry cannot rely on their public Notice of Collection to establish a rational connection between its collection of personal information and the disclosure to the War Amps.

[38]  Specifically, the complainant states the following in part:

As in PC07-21, MTO is once more relying on its public notices to postulate that its disclosure to War Amps qualifies as a consistent purpose under section 42(1)(c) of [the Act] and that said disclosure should be reasonably expected from the individual from who [sic] the information was collected.

…

The Investigator [in PC07-21] disagreed that there was a rational connection.

[39]  The complainant goes on to explain the finding of the investigator in that case and states the following:

As in PC07-21, War Amps’ solicitation is outside of the scope of the MTO’s authority to disclose information. While MTO does provide notice that personal information will be disclosed to War Amps for its Key Tag program, the notice does not state that said information will concurrently be disclosed to War Amps to solicit donations from individuals.

[40]  Lastly, during the intake stage of this matter, the complainant also cited several other cases [1] in support of their submission that the ministry’s disclosure was contrary to the Act. While I have considered each of these cases, I will not elaborate on them further in this report as I have concluded that they do not provide additional insight into the issues that I am investigating in this matter.

Analysis

[41]  The second step in determining whether the disclosure complies with section 42(1)(c) of the Act is to consider whether the disclosure was for the original purpose of the collection or for a purpose consistent with that original purpose. The ministry takes the position that the disclosure of the complainant’s personal information to the War Amps was for a purpose that is consistent with the original purpose.

[42]  Section 43 of the Act provides clarification on whether a given disclosure of personal information constitutes a “consistent purpose” under the Act by imposing a “reasonable person test”.

[43]  Section 43 states:

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clause 41(1)(b) and 42(1)(c) only if the individual might reasonably have expected such a use or disclosure.

[44]  Previous investigations by the IPC dealing with these provisions have established that “‘[t]here must be a rational connection between the purpose of the collection and the purpose of the use in order to meet the ‘reasonable person’ test set out in section 33’ [section 33 is the section in the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) that is equivalent to section 43 of the Act]. A key element of reasonable expectation is foreseeability.” [2]

[45]  In MC16-4, the investigator considered whether personal information disclosed by a school board to a school photographer for marketing purposes was disclosed for a consistent purpose. The investigator found that there was a reasonable expectation that student photographs would be offered for sale by the vendor given that communications from the school indicated that school photo day was occurring and that the practice of taking individual and class photographs and of being able to purchase them has been a part of school and family life for decades. Since it was a historic and well-known practice, the investigator found that it was reasonably foreseeable that the school would disclose certain personal information to the school photographer for the specific limited purpose of marketing the photographs of students to their families.

[46]  Similarly, the War Amps has been operating the key tag program using personal information obtained from the ministry since 1946. This has been a historical practice in Ontario, and throughout Canada, for nearly 75 years. The War Amps is also well known as a charitable organization in Ontario and Canada and it is understood that in order to offer the key return service to Ontarians for free, War Amps solicits donations to support its programs. I find that the longstanding and historic nature of these practices are relevant to my determination as to whether the disclosure of personal information from the ministry to the War Amps is reasonably foreseeable.

[47]  As noted above, the complainant cited PC07-21 in her representations. In PC07-21, an individual complained that the ministry had improperly disclosed her personal information. In that case, an Authorized Requester who was a private investigator, had obtained the complainant’s personal information from the ministry and used it to follow the complainant in order to obtain information to discredit her as an independent witness in a child protection tribunal hearing. The IPC investigator reviewed the ministry’s Notice of Collection (which was similar, though not identical to the ministry’s current notice). The investigator noted that the Notice of Collection stated that address information may be disclosed to private investigators for the service of legal documents and for legal investigations which may give rise to legal proceedings. The investigator noted that the Notice of Collection would not reasonably have led the complainant to understand that her personal information could be used by a private investigator to follow her in order to discredit her as an independent witness in a tribunal hearing.

[48]  In addition, in PC07-21, the ministry acknowledged that the Authorized Requester disclosed the complainant’s personal information in contravention of its contractual agreement with the ministry and therefore the ministry suspended the private investigator’s Authorized Requester privileges.

[49]  I conclude that PC07-21 is distinguishable on its facts from the current investigation of the ministry’s disclosure of personal information to the War Amps. The complainant in PC07-21 could not have reasonably expected that the ministry would disclose her information to the private investigator for the purpose for which it was used, since it was used for a purpose that was not outlined in the ministry’s Notice of Collection and was, in fact, contrary to the Authorized Requester’s contractual agreement. Furthermore, the purpose for which it was used—to follow an independent witness—was not related, in any way, to the ministry’s administration of its driver, vehicle and carrier programs.

[50]  In contrast, in this case, War Amps has used the personal information disclosed by the ministry in a way that accords with the ministry’s Notice of Collection—i.e. to operate the key tag program. As set out below, I am recommending that the ministry be more transparent about specific details of its disclosure of personal information to the War Amps for the key tag program. However, I find that the ministry’s Notice of Collection does communicate that the ministry discloses personal information to the War Amps for the purpose of the key tag program and my investigation has concluded that War Amps has used the personal information for this purpose. I find that the ministry’s notice about disclosure of personal information to the War Amps pursuant to the Authorized Requester program and for the purpose of the key tag program is relevant to my determination as to whether the disclosure is reasonably foreseeable.

[51]  Further, I find that it is relevant that, unlike in PC07-21, the purpose for which the War Amps uses the disclosed personal information—i.e. to operate the key tag program—is related to the ministry’s administration of its driver, vehicle and carrier programs. Facilitating the safe return of lost keys contributes to drivers being able to secure and safely operate their vehicles. The War Amps’ advocacy in relation to driver and road safety also aligns with the ministry’s objectives in this area.

[52]  Therefore, I conclude that the ministry’s disclosure of personal information to the War Amps in order for the War Amps to operate the key tag program—and in the course of operating the program, to solicit charitable donations—is for a purpose that is consistent with the original purpose of the collection, given:

• the rational connection between the purposes of the ministry’s collection of personal information for the administration of driver, vehicle and carrier programs and the purposes of the War Amps key tag program, which facilitates the safe return of keys and secure operation of vehicles;
• the War Amps’ longstanding and historic role in Canada as the operator of the key tag program well as a charitable organization that solicits donations in connection with the program; and
• the ministry’s Notice of Collection which includes notice that the ministry discloses personal information to the War Amps for the purpose of the War Amps operating the key tag program.

[53]  Having reached this conclusion, I note the following with respect to specific arguments that the complainant made in her representations.

[54]  With respect to the complainant’s argument regarding Ontarians not having a “reasonable expectation” that their personal information would be disclosed to the War Amps, I have reviewed the online sources and the article referred to by the complainant and have determined that these few anecdotal examples fall short of establishing that the disclosure is contrary to the “reasonable expectations” of individuals in Ontario.

[55]  The complainant also noted that in Alberta, the key tag program functions on an opt-in basis and asserted that this should be the case in Ontario.

[56]  It is beyond the scope of this report and this office’s jurisdiction to evaluate the way in which the government of Alberta and the War Amps have structured the key tag program in that province or to evaluate or consider whether such a structure complies with the Alberta Freedom of Information and Protection of Privacy Act (Alberta FIPPA). I do however note that the Alberta FIPPA contains a substantively different test for whether a use or disclosure of personal information is consistent with the purpose for which the information was collected. This illustrates the reasons why reliance on another province’s approach to a particular matter cannot be determinative of whether a particular activity is contrary to or in compliance with Ontario’s Act.

[57]  I have nonetheless considered the complainant’s submissions that the ministry should adopt an opt-in consent model for the War Amps program. The disclosure of personal information by the ministry to the War Amps on the basis of the opt-in consent of the individual may well comply with section 42 of the Act, specifically clause 42(1)(b), which allows the ministry to disclose personal information with the consent of the individual to whom the information relates. However, this investigation is concerned, not with whether a different framework might be preferable, but with whether the current scheme complies with the Act, and I have concluded that it does.

Recommendations Regarding Ministry’s Notice

[58]  The ministry’s Notice of Collection includes a notice that the ministry discloses personal information to Authorized Requesters who have been approved and enter into a contractual agreement with the ministry. However, I note that the ministry’s notice only references the disclosure of address information to an Authorized Requester. It does not reference the fact that, to the War Amps, the ministry also discloses drivers’ licence numbers. Based on the explanation provided by the ministry, I accept that this information is reasonably necessary for the purpose of operating the key tag program.

[59]  I further note that the ministry stated that individuals may make a request to opt- out of being included on the War Amps mailing list by making an opt-out request to either the ministry or to the War Amps. However, the opt-out option is only communicated to individuals by the War Amps and it only includes information about how an individual can make an opt-out request to the War Amps and not that they can also make an opt-out request directly to the ministry.

[60]  I will therefore recommend that the ministry revise its notice to be more transparent about the information that it discloses to the War Amps pursuant to the authorized requester program, and with respect to how individuals can make an opt-out request.

CONCLUSION:

I have reached the following conclusions based on the results of my investigation:

• The information in question qualifies as “personal information” as defined in section 2(1) of the Act.
• The personal information was disclosed in accordance with section 42(1)(c) of the Act.

RECOMMENDATIONS:

1. I recommend that the ministry revise its Notice of Collection to be more transparent about the information that it discloses to the War Amps pursuant to the authorized requester program, and with respect to how individuals can make an opt-out request.
2. Within six months of receiving this Report, the ministry should provide this office with proof of compliance with the above recommendation.
3. The ministry has reviewed this Report and agreed to implement the above recommendations. Accordingly, within six months of receiving this Report, the ministry should provide this office with proof of compliance of these recommendations.

Original Signed By:		November 22, 2019
Lucy Costa
Manager of Investigations