PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT MC17-35

County of Norfolk

September 21, 2020

Summary: The Office of the Information and Privacy Commissioner of Ontario received a privacy complaint from an individual in which he advised that the County of Norfolk (the County), without notice to him, disclosed his personal information in response to two access requests made under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ). This report finds that the County’s disclosure of the complainant’s information was not in accordance with section 32  of the Act .

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act,  R.S.O. 1990, c. M. 56 , as amended, sections 2(1), 14(1)(f),(2), (3) and (4), 21(1)(b) and (2), 32  (b), (c) and (e) and 33; Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. F. 31 , as amended, sections 28(1);and Planning Act , R.S.O. 1990, c. P-13 , as amended, sections 1.01 and 2.1(1).

Orders and Investigation Reports Considered: Orders 154, 180, P-867, P-1085, P-1635, PO-1657 and PO-4021-F; Investigation Reports I94-023P, I94-095P, I94-057M, I98-018P, MC-000019-1, I95-024M and I92-066P; and Privacy Complaint Reports I94-001M, MC-050045-1, MC-050047-1 and MC15-41.

BACKGROUND:

[1]  In September 2016, the complainant made an access request to the County of Norfolk (the County) under the Municipal Freedom of Information and Protection of Privacy Act (the Act) for the following emails:

Email correspondence to/from Norfolk County Staff and Councillors containing reference to Hastings Drive and/or Hastings […]

For the following periods of time: October 2012 – January 2013, May 2014 – August 2014, July 2015 – Present.

[2]  In response to the request, the County issued a decision granting the complainant partial access to the emails. The decision explained that the emails for 2012, 2013 and 2014 might not be provided because the County had encountered system problems searching and retrieving them.

[3]  In a supplementary decision, the County advised:

A reasonable search for the records, in response to your request, has been conducted and we cannot provide the records for the time period for 2012, 2013 and 2014.

[4]  This decision also explained the following:

There have been many formal Freedom of Information requests over the past 5 years for information related to Hastings Drive so [the County] retrieved documentation from a couple of these requests that may be of interest to you. Freedom of Information requests are retained for a two year period under the Norfolk County Records Retention Bylaw so [the County] was only able to go back to 2015 to review and retrieve any records that may be related.

[5]  With this decision, the County enclosed the additional records.

[6]  After receiving and reviewing these records, the complainant realized that the information provided by the County included his own emails to the County.

The Complaint

[7]  The complainant filed a privacy complaint with the Office of the Information and Privacy Commissioner of Ontario (the IPC or this office) alleging that the County disclosed his personal information without notice to him or his consent. Specifically, the complainant explained that, without authorization, the County disclosed his emails to individuals in response to their access requests (collectively, the FOI Requests).

[8]  The complainant was concerned that the disclosures included his email communications in 2015 with the County’s councillors showing his name, address and views and opinions about Hastings Drive (collectively, the Emails).

[9]  He complained that, before releasing the Emails in response to the FOI Requests, the County was required by the Act  to notify him. Therefore, the complainant believed that the County did not disclose the Emails in accordance with the Act and, as a result, breached his privacy.

[10]  The matter moved from the Intake Stage to the Investigation Stage of the IPC’s complaint process and, as part of my investigation, I requested and received written representations, discussed below, from the County.

The Emails

[11]  According to the County, in 2015, it received the FOI Requests which sought access to its councillors’ emails relating to Hastings Drive. [1] The County explained that, in response to the FOI Requests, it released the Emails because they relate to questions of development and by-law enforcement in Hastings Drive.

[12]  The County confirmed that it did not notify the complainant before disclosing the Emails and submitted that these disclosures were in accordance with the Act .

The County’s Public Email Process

[13]  The County’s councillors receive emails from members of the public (a Public Email or Public Emails) through its website. [2]

[14]  In 2015, when the complainant submitted the Emails to the County, its webpage [3] listing its councillors’ email addresses [4] (the Webpage) provided instructions to the public about how to submit emails as follows:

Want to contact all Councillors at once? Use the “DL” Distribution List to e-mail Councillors: DL-MayorandCouncillors@norfolkcounty.ca

[15]  In 2016, the County explained that it added the following note (the Disclosure Note) to these instructions to ensure that the sender of a Public Email provides their clear consent to the (possible) disclosure of their email containing their personal information:

NOTE:

As required, all emails to Council Members are public records and may be subject to further release. If you desire your email to be considered by Council as a matter of public record, please identify so at the beginning of the email and send to the County Clerk Andy Grozelle andy.grozelle@norfolkcounty.ca

[16]  The County explained that “further release” means that a Public Email could be disclosed in response to an access request that it receives under the Act , as well as, in a public forum. It also advised that a Public Email would not be subject to further release if it contained information that is subject to any exemptions or exclusions under the Act , not responsive to any received access requests or not related to any public discussions.

[17]  Moreover, the County advised that it follows the Ontario Ministry of Government and Consumer Services’ Information, Privacy and Archives Division (IPA)’s procedures for responding to access requests for personal information made under the Act .

[18]  These procedures are set out in Chapter 8 of the IPA’s Freedom of Information and Protection of Privacy Manual [5] and contain steps for determining whether:

• the definition of “personal information” under the Act ;
• a record contains the personal information of an individual other than a requester; and
• the disclosure of the record would result in an unjustified invasion of privacy under the Act .

[19]  The County advised that, because of the Disclosure Note, the further release of a Public Email containing personal information would be in accordance with the Act .

ISSUES:

[20]  I identified the following issues as arising from this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act ?
2. Was the disclosure of the personal information in accordance with section 32 of the Act ?

DISCUSSION:

Issue 1: Is the information at issue “personal information” as defined by section 2(1) of the Act?

[21]  Under section 2(1) of the Act , “personal information”, in part, means:

“personal information” means recorded information about an identifiable individual, including,

…

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

…

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[22]  At issue in this matter are the Emails that the County released in response to the FOI Requests. I reviewed them and they show the complainant’s name, address and views and opinions about Hastings Drive.

[23]  In my view, the complainant’s name, address and views and opinions would meet the requirements of one or more of the above paragraphs under the definition of “personal information” in section 2(1) of the Act . The County does not dispute this.

[24]  Therefore, I find that the information at issue is “personal information” as defined by section 2(1) of the Act .

Issue 2: Was the disclosure of the personal information in accordance with section 32 of the Act?

[25]  There is no dispute that the County disclosed the Emails in response to the FOI Requests. Above, I found that the Emails contained the complainant’s “personal information” as defined by section 2(1) of the Act .

[26]  Section 32 of the Act , generally, prohibits the disclosure of personal information in the custody or under the control of the County unless one of the exceptions described in paragraphs (a) to (l) under this section applies.

[27]  The County submitted that, in 2015, when the FOI Requests were received, the circumstances set out in sections 32 (c) and (e) of the Act  applied to the disclosure of the complainant’s personal information and, therefore, permitted the County to release the Emails.

Section 32(c)

[28]  Section 32(c) of the Act  states:

An institution shall not disclose personal information in its custody or under its control except,

…

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

[29]  Further, section 33 of the Act  defines “consistent purpose” in section 32(c) as follows:

The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31 (b) and 32 (c) only if the individual might reasonably have expected such a use or disclosure.

[30]  With respect to section 32(c), the County submitted that the complainant’s personal information was disclosed for a consistent purpose. The County explained that, considering the highly publicized debate surrounding Hastings Drive, the complainant might reasonably have expected the disclosure of the Emails as part of the public discussion.

[31]  Moreover, the County also explained that, where an individual submits their name with the intention of it being included as part of the material intended to be distributed within public and open forums or meetings, it might be reasonable to expect that this information be disclosed.

[32]  In this matter, the County released the Emails in response to the FOI Requests. As such, in my view, at issue is whether, in 2015, the complainant might reasonably have expected the disclosure of his name, address and/or views and opinions about Hastings Drive in the Emails in response to the FOI Requests (or any access request).

[33]  In 2015, as indicated above, the instructions on the Webpage did not inform the public that their Public Emails containing their personal information could be disclosed. As a result, at that time when the complainant submitted the Emails, the County did not make him aware that his personal information in the Emails could be disclosed. Further, my review of the Emails did not find any intention by the complainant to have the Emails publicly disclosed.

[34]  Accordingly, I find that the disclosure of the complainant’s personal information by the County was not for a “consistent purpose” as defined by section 33 of the Act . As a result, I find that this disclosure was not in accordance with section 32(c) of the Act .

Section 32(e)

[35]  Section 32(e) of the Act  states:

An institution shall not disclose personal information in its custody or under its control except,

…

(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act  or a treaty;

[36]  In Investigation Report I94-023P [6] , then Compliance Review Officer, Susan Anthistle found that this section imposes a duty as follows:

It is our view that the word "complying" in section 42 (e) [of the Freedom of Information and Protection of Privacy Act , which is the provincial access/privacy law equivalent indicates of section 32(e)] that the requirement in question must be mandatory in nature. In other words, in order for section 42 (e) to apply, the Order-In-Council must impose a duty on the Council to disclose the complainant's personal information.

[37]  Further, regarding the word “complying” in section 32(e), in Investigation Report I94-057M [7] , then Assistant Commissioner, Ann Cavoukian, stated:

It is our view that the word "complying" in section 32 (e) of the Act  means that there must be a specific requirement for the disclosure in question. [8]

[38]  I accept and adopt both of the views in these reports.

[39]  With respect to section 32(e), the County submitted that the Emails were disclosed for the purpose of complying with sections 1.0.1. and 2.1(1)(b) of the Planning Act  [9] .

[40]  Section 1.0.1  of the Planning Act  states:

Information and material that is required to be provided to a municipality or approval authority under this Act  shall be made available to the public.

[41]  Section 2.1(1)  of the Planning Act  states:

When an approval authority or the Tribunal makes a decision under this Act  that relates to a planning matter, it shall have regard to,

(a) any decision that is made under this Act  by a municipal council or by an approval authority and relates to the same planning matter; and

(b) any information and material that the municipal council or approval authority considered in making the decision described in clause (a).

[42]  Based on the information provided by the County, and my reading of these sections of the Planning Act , I am not satisfied that they specifically required the County to disclose the complainant’s personal information in response to the FOI Requests or impose a duty on the County to do so. Moreover, the County did not provide me with any additional information supporting its position that these sections permitted the disclosure under section 32(e).

[43]  Therefore, I find that the disclosure of the complainant’s personal information by the County was not in accordance with section 32(e) of the Act .

Section 32(a)

[44]  In previous decisions, this office has held the view that the exception described in section 32(a) of the Act  applies within the context of an access request by an individual made under Part I of the Act  for personal information relating to another individual. [10]

[45]  As such, because the County disclosed the complainant’s personal information in response to the FOI Requests, section 32(a) might apply to make the disclosure permissible.

[46]  Specifically, section 32(a) allows an institution to disclose personal information in its custody or under its control where it is done “in accordance with Part I” of the Act . Consequently, in responding to the FOI Requests, the County needed to comply with the relevant provisions in Part I in order for the disclosure to have been in accordance with this section.

[47]  In my view, the relevant provisions in Part I concern giving notice to an individual where an access request is made for a record that appears to include their personal information. These provisions are found in sections 14(1)(f) and 21(1)(b) and (2) of the Act .

[48]  Section 21(1)(b) of the Act  states:

A head shall give written notice in accordance with subsection (2) to the person to whom the information relates before granting a request for access to a record,

…

(b) that is personal information that the head has reason to believe might constitute an unjustified invasion of personal privacy for the purposes of clause 14(1)(f).

[49]  Section 21(2) of the Act  states:

(2) The notice shall contain,

(a) a statement that the head intends to disclose a record or part of a record that may affect the interests of the person;

(b) a description of the contents of the record or part that relate to the person; and

(c) a statement that the person may subject to subsection (5.1), within twenty days after the notice is given, make representations to the head as to why the record or part should not be disclosed.

[50]  Section 14(1)(f) states:

A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

…

(f) if the disclosure does not constitute an unjustified invasion of personal privacy.

[51]  Further, sections 14(2), (3) and (4) of the Act  provide guidance for determining whether a disclosure of personal information would constitute an unjustified invasion of personal privacy.

[52]  In this matter, the County explained that it did not give written notice to the complainant before disclosing the Emails containing his personal information because it did not have reason to believe that the disclosure might be an unjustified invasion of personal privacy for the purposes of section 14(1)(f).

[53]  Under section 21(1)(b), an institution can disclose an individual’s personal information without notifying them where it does not have reason to believe that the disclosure might constitute an unjustified invasion of their privacy. However, as discussed below, the use of the word “might” in this section imposes a low threshold for triggering an institution’s obligation to notify the individual.

[54]  In Order PO-1657, then Senior Adjudicator, David Goodis reviewed the purpose of the notification obligation with respect to section 28(1)  of the Freedom of Information and Protection of Privacy Act , which is the equivalent of section 21(1) of the Act .

[55]  He stated:

In my view, the purpose of these provisions of section 28 is to ensure that procedural fairness is accorded to individuals whose privacy interests may be at stake. Adherence to these provisions permits the subject individual to make representations as to whether or not the information should be disclosed and, if the head decides to disclose information, to appeal the matter to the Commissioner before disclosure actually takes place.

[56]  He also referred to Investigation Report I98-018P in which then Commissioner, Ann Cavoukian made the following comments about the notice requirements relating to disclosure of personal information:

I should also note that institutions are not the only bodies with a statutory obligation to provide notice to affected persons. Section 50(3) of the Act  also imposes an obligation on the Commissioner to provide notice during the course of an appeal. In Ontario (Attorney General) v. Fineberg, [1996] O.J. No. 67, the Divisional Court interpreted this obligation. The Court quashed Order P-676 for breach of natural justice because this office had not provided an affected person with notice on the basis that the record at issue had not contained his personal information. The Court found that the affected person should have been given the opportunity to make submissions on the threshold question of whether the record contained his personal information and, if so, whether the disclosure would constitute an unjustified invasion of personal privacy.

The Court’s judgment suggests that notice is required under section 50(3) where the outcome of a threshold decision may result in disclosure of a record containing personal information. In my view, similar considerations of fairness should apply where information qualifies as personal information and a reasonable doubt exists as to whether disclosure would fall within one of the exceptions at sections 21(1)(a) through (e).

[57]  Further, in IPC Investigation Report MC-000019-1, then Assistant Commissioner, Tom Mitchinson reviewed the notice obligations with respect to disclosure of personal information by a police services board.

[58]  In this report, he referred to the following views of then Commissioner, Ann Cavoukian in Investigation Report I95-024M:

It is not our intention to suggest that the complainant’s personal information would or would not have been exempted under section 14(1) of the Act . Rather, it is our view that since the disclosure of the complainant’s personal information might have constituted an unjustified invasion of personal privacy, the complainant should have been notified and given an opportunity to make representations on the issue of disclosure, as well as the opportunity to appeal the Board [of Education’s] decision to our office. In our view, except in the clearest of cases, fairness requires that the person with the greatest interest in the information, the data subject, be given a chance to be heard.

[59]  I accept and adopt the views regarding notice in Order PO-1657 and these reports.

[60]  As indicated above, the County disclosed the complainant’s name, address and views and opinions about Hastings Drive without notifying him pursuant to section 21(1)(b). Given the nature of the complainant’s personal information at issue, in my view, the disclosure of at least some of this information might have constituted an unjustified invasion of his personal privacy.

[61]  In my view, the complainant should have been notified and given an opportunity to make representations as to why the Emails should not have been disclosed. As noted in Investigation Report MC-000019-1, except in the clearest of cases, fairness requires that the person with the greatest interest in the information, that is, the complainant, be given a chance to be heard. In this matter, he was not given that opportunity.

[62]  Accordingly, I am not satisfied that the County acted in accordance with procedural fairness as it did not satisfy the requirement for disclosure without notice under section 21(1)(b).

[63]  For the foregoing reasons, I find that the County was required to notify the complainant in accordance with sections 14(1)(f) and, and 21(1)(b) and 21(2) prior to disclosing the Emails in response to the FOI Requests. Because the complainant’s personal information was involved, a procedural fairness obligation arose with respect to him and the County did not appropriately discharge its obligation under this section to him.

[64]  Since no notice was given, I find that the County’s disclosure of the complainant’s personal information was not in accordance with the above provisions in Part I of the Act and, therefore, not in accordance with section 32(a) of the Act .

[65]  As I have found that the County’s disclosure of the complainant’s personal information was not in accordance with sections 32(a),(c) and (e) of the Act , I find that the County’s disclosure of the complainant’s personal information was not in accordance with section 32 of the Act .

[66]  Therefore, I will recommend that the County take steps to ensure that future disclosures of personal information are made in accordance with the provisions of the Act .

Disclosure of Public Emails, After 2016

[67]  After 2016, the County added the Disclosure Note in order to obtain the sender of a Public Email’s consent to disclose their personal information. The County advised that, such disclosure would be in accordance with section 32(b) of the Act .

[68]  Section 32(b) of the Act  states:

An institution shall not disclose personal information in its custody or under its control except,

…

(b) if the person to whom the information relates has identified that information in particular and consented to its disclosure;

[69]  Regarding this section, the County submitted that the sender of a Public Email, who reads and understands the Disclosure Note, provides their (implicit) consent to the (possible) disclosure of their personal information.

[70]  In Privacy Complaint Reports MC-050045-1 and MC-050047-1 [11] , then Investigator, Mark Ratner considered the type of consent required by section 32(b). He found that this section, which uses similar language to section 31(a) of the Act , “is implicitly contemplating that applicants provide their informed consent prior to the disclosure of their information to third parties.”

[71]  Moreover, in Investigation Report I94-001M [12] , then Assistant Commissioner, Ann Cavoukian considered the requirements of consent as follows:

For consent to be truly meaningful, that consent must be given on an informed basis and must be given voluntarily. This is the hallmark of consent -- that it be voluntary in nature. If consent is not both informed and voluntary, its value is diminished so greatly that, in our view, it may be rendered meaningless.

[72]  Further, in the context of an access request, this office has held that an individual’s consent should be explicit in order to demonstrate that they understood that their personal information would be disclosed. [13] Where it is not explicit, then an individual’s consent could be implied if they have a choice or voluntarily give it. [14] Regardless, without evidence that an individual has knowledge or understanding of what personal information of theirs may be disclosed, it is difficult to conclude that they consent to the disclosure of their information. [15]

[73]  To determine whether an individual has consented to the disclosure of their personal information, the considerations set out in IPC Order 180 for the purposes of section 21(1) (a) of the Freedom of Information and Protection of Privacy Act , which is the provincial equivalent of section 14(1)(a) of the Act , are informative. These considerations are:

1. Does the individual know what information about them is contained in the record?
2. Is it reasonable to assume that the individual had knowledge of all of the institution’s planned used of the record containing their personal information?
3. Does the individual have a choice regarding whether their personal information is included in the record? [16]

[74]  I accept and adopt these findings regarding consent in both reports and in these decisions. Based on them, in my view, an individual who reads the Disclosure Note and then sends an email to a Council Member is not giving informed consent to disclosure of their personal information in the email, for the purposes of section 32(b) of the Act .

[75]  The Disclosure Note does not tell the public what is meant by “further release”. The County has explained that its understanding of “further release” means that a Public Email could be disclosed in response to an access request or in a public forum. However, a member of the public reading the Disclosure Note may not know this and, without this information, in my view, the sender of a Public Email who reads the Disclosure Note would not be in a position to make an informed decision about giving their consent to the disclosure of their personal information.

[76]  As a result, in my view, any consent the County obtains from a sender of a Public Email through the Disclosure Note would not be on an informed basis. Therefore, I will recommend that the County amend the Disclosure Note to set out what “further release” means.

CONCLUSIONS:

1. The information at issue is “personal information” as defined in section 2(1) of the Act .
2. The County’s disclosure of the personal information was not in accordance with section 32 of the Act .

RECOMMENDATIONS:

1. I recommend that the County take steps to ensure that future disclosures of personal information are made in accordance with the provisions of the Act . In particular, when responding to requests under Part I of the Act , I recommend that the County adhere to the notification requirements of section 21 of the Act , in accordance with the direction provided by this Report.
2. I recommend that the County amend the Disclosure Note to indicate what “further release” means.

The County have reviewed this Report and agreed to implement the above recommendations. Accordingly, within six months of receiving this Report, the County should provide this office with proof of compliance with these recommendations.

Original Signed by:		September 21, 2020
John Gayle
Investigator