PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT MC18-23

Municipality of Leamington

April 8,2021

Summary: The Office of the Information and Privacy Commissioner of Ontario received a privacy complaint involving the Municipality of Leamington (the municipality). The complaint was that the municipality had inappropriately disclosed an email containing personal information to third parties. The complainant was concerned that the disclosure breached his privacy under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ).

This report finds that the municipality’s disclosure of the complainant’s information was not in accordance with section 32  of the Act .

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act,  R.S.O. 1990, c. M. 56 , as amended, sections 2(1) and (2.1), 32 (b), (c), and (d), and 33.

Orders and Investigation Reports Considered: IPC Reconsideration Order R-980015; Orders 180 and PO 2225; IPC Privacy Complaint Reports MC-040019-1, MC08-49 and MC09-1, MC-060026-1, MC07-64, MC-050045-1 and MC-050047-1; Investigation Reports I94-001M and I96-016P.

BACKGROUND:

[1] Since 2016, the Municipality of Leamington (the municipality) has hosted Hogs for Hospice. The Hogs for Hospice website describes the event as follows:

Hogs for Hospice is a 3 Day Motorcycle Rally in Leamington, Ontario at beautiful Seacliff Park on Lake Erie. The weekend long party has something for everyone to enjoy. Epic concerts, the best organized registered ride in Ontario, Freestyle Motocross Show, Custom Bike Show, Bike Games, Vendors, Beer Garden, Axe Throwing and much more…

Hogs for Hospice was started by a dedicated group of local citizens who had a vision of creating a world class motorcycle event that would raise money to support a new Hospice campus and health care in Leamington and the surrounding communities…

The whole community has embraced this event from day one and with that strong local support we are able to grow bigger and better each year. [1]

[2] In February 2018, the complainant sent an email to the municipality’s Council [2] and to the municipality’s Chief Administrative Officer (CAO) [3] in which he raised concerns about Hogs for Hospice (the Email).

[3] The complainant advised that, in March 2018, he received a phone call about the Email from one of the Hogs of Hospice organizers. He also became aware that the Email had been posted on social media and discussed by the former Mayor of the municipality during a CTV news interview (the CTV Interview) [4] , and that the Email was being heavily discussed by residents in the municipality.

The Complaint

[4] After becoming aware of the Email’s disclosure, the complainant filed a privacy complaint with the Office of the Information and Privacy Commissioner of Ontario (the IPC or this office).

[5] The complainant explained that the Email contained his opinions or views about Hogs for Hospice and complained that the municipality’s disclosure of them to the Hogs for Hospice’s organizers and during the CTV Interview was not in accordance with the Municipal Freedom of Information and Protection of Privacy Act (the Act).

[6] For this reason, the complainant believed that the municipality had breached his privacy under the Act .

[7] The matter moved from the Intake Stage to the Investigation Stage of the IPC’s complaint process and assigned to me as the Investigator. As part of my investigation, I requested and received representations, discussed below, from the municipality and the complainant.

The Municipality’s Representations

[8] The municipality confirmed that the Email was disclosed as follows:

• the former Mayor sent it to one of the Hogs for Hospice organizers;
• a Council member sent it to an individual affiliated with the Hogs for Hospice organizers and whose business contributes financially to the rally; and
• the former Deputy Mayor sent it to a former municipal employee and a Hogs for Hospice volunteer.

Personal Information

[9] The municipality submitted that the Email does not contain the complainant’s opinions or views about Hogs for Hospice.

[10] The municipality explained that the email signature in the Email identifies the complainant in a business or professional capacity. The municipality also advised that it has received many emails and letters from the complainant containing opinions and advice about municipal matters that he sent on behalf of his business.

[11] Because of this correspondence and the email signature, the municipality believed that the opinions or views in the Email are in a business context and, therefore, do not belong to the complainant but to his business.

[12] Accordingly, the municipality takes the position that the Email does not contain the complainant’s personal information. In support of its view, the municipality relied on IPC Reconsideration Order R-980015 (Order R-980015).

[13] Regarding the CTV Interview, the municipality submitted that the comments made by the former Mayor did not reveal anything personal about the complainant and, therefore, do not contain his personal information.

Disclosure

[14] The municipality submitted that, even if the Email contains the complainant’s personal information, it was disclosed in accordance with the Act .

[15] The municipality explained that its website includes a Delegation Registration webpage (the DR Webpage) that provides the following notice:

If you wish to address an item(s) on the Council agenda, you may send an email to the Clerk at clerks@leamington.ca prior to the start of the Council meeting and such submission shall be provided to Council. Individuals who submit correspondence and any other information to Council should be aware that any personal information contained within their communications may become part of the public record and may be made available through the agenda process which includes publication on the Municipality's website.” [5]

[16] Based on this webpage, the municipality submitted that the complainant knew or ought to have known that the Email could be made public and, therefore, consented to its disclosure in accordance with the Act .

[17] Further, where criticism of an event that is held within the municipality is received, in order to respond to the concerns, the municipality advised that it would seek input from the event organizers.

[18] Moreover, given that the opinions or views in the Email are about Hogs for Hospice, the municipality submitted that the complainant might have reasonably expected its disclosure to people who are responsible for the rally.

[19] Accordingly, the municipality takes the position that it disclosed the Email for the purpose for which it was obtained or compiled, or for a consistent purpose in accordance with section 32(c) of the Act .

[20] In support of its view, the municipality relied on IPC Privacy Complaint Report MC- 040019-1 (Report MC-040019-1) and, IPC Privacy Complaint Report MC08-49 and MC09- 1 (Report MC08-49 and MC09-1).

[21] In addition, the municipality advised that, unlike previous emails that it has received from the complainant, the Email did not contain a confidentiality statement. Lastly, the municipality claimed that the complainant had disclosed the Email to one or more individuals who, in turn, posted it on social media, however no evidence to support this claim was provided.

[22] Therefore, the municipality submitted that the complainant did not intend for the Email to remain confidential.

The Complainant’s Representations

Personal Information

[23] The complainant submitted that the information in the Email reveals something personal about him.

[24] Specifically, he explained that it reveals his opinions or views about Hogs for Hospice, the types of people associated with, and activities promoted by this rally, and whether the municipality might support another more “family friendly” event.

[25] Accordingly, although he signed the Email using the email signature for his business, the complainant takes the position that this information has nothing to do with his business and, therefore, is his.

Disclosure

[26] The complainant advised that, by sending the Email, he was sharing his opinions or views with only the municipality. He explained that he sent it in order to have the municipality consider redirecting its efforts into hosting, in his view, more family-friendly events. The complainant further explained that, had he wanted to complain about Hogs for Hospice to its organizers, he would have sent an email directly to them.

[27] Accordingly, the complainant believed that there was no reason for the municipality to disclose the Email to the Hogs for Hospice organizers and, even if there was a reason, there was no need to identify him.

[28] With respect to the DR Webpage, the complainant advised that he did not send the Email in response to any matters to be discussed as part of the municipality’s Council agenda and, therefore, the Email was not a delegation registration.

[29] Regarding the absence of a confidentiality statement in the Email, the complainant submitted that that he was not required under the Act  to indicate that the Email was “confidential” or “private” and that by failing to do so, did not mean that he gave his implicit consent to its disclosure.

[30] Based on the aforementioned, the complainant takes the position that the municipality did not disclose the Email in accordance with the Act . In support of his view, he relied on IPC Privacy Complaint Report MC07-64 (Report MC07-64).

ISSUES:

[31] I identified the following issues as arising from this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act ?
2. Was the disclosure of the personal information in accordance with section 32 of the Act ?

DISCUSSION:

Issue 1: Is the information at issue “personal information” as defined by section 2(1) of the Act?

[32] At issue, is the information in the Email and the statements made by the former Mayor of the municipality during the CTV Interview.

[33] My review of the Email found that its email signature contains the complainant’s name, job title, business contact information and designations.

[34] I also found that it, generally, contains opinions or views about Hogs for Hospice, people who attend Hogs for Hospice, people within the municipality, tourist attractions in the municipality, the former Mayor, a specified motorcycle rally and the municipality’s consideration of the events that it holds.

[35] The CTV Interview was part of a news story about the complainant and the Email. Before the interview aired the reporters told viewers the complainant’s gender, name and identified him as the author of the Email and, during it, the former Mayor commented:

I had to read [the Email] about four times to really, I guess, get a grasp of what was being said...it’s one person’s opinion about one of the greatest events that this municipality has had in a very, very long time.

[36] As part of the news story, the reporters also showed a picture of the complainant, discussed his reasons for sending the Email, showed parts of the Email, and directly quoted some of the opinions or views about Hogs for Hospice and people who attend it from the Email. They also discussed the complainant’s allegation that he had received death threats from members of the public because of the Email going viral, as well as his apology and explanation for the Email that he posted on social media.

[37] Under section 2(1) of the Act , “personal information”, in part, means:

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved;

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

…

(h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[38] Section 2(2.1) of the Act  makes it clear that “personal information” does not include business identity information. This section states:

Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity.

[39] The determination of what is “personal information” is based on the information itself and the context in which it appears. [6]

[40] To qualify as personal information, the information must be about the individual in a personal capacity. As a general rule, information associated with an individual in a professional, official or business capacity will not be considered to be “about” the individual. [7]

[41] However, even if information relates to an individual in a professional, official or business capacity, it may still qualify as personal information if the information reveals something of a personal nature about the individual. [8] . Further, to qualify as personal information, it must be reasonable to expect that an individual may be identified if the information is disclosed. [9]

[42] In IPC Order PO-2225, former Assistant Commissioner Tom Mitchinson posed two questions that help to clarify the distinction between “personal information” under section 2(1) and information that relates to an individual in a “business capacity” as follows:

…the first question to ask in a case such as this is: “in what context do the names of the individuals appear”? Is it a context that is inherently personal, or is it one such as a business, professional or official government context that is removed from the personal sphere?

…

The analysis does not end here. I must go on to ask: “is there something about the particular information at issue that, if disclosed, would reveal something of a personal nature about the individual”? Even if the information appears in a business context, would its disclosure reveal something that is inherently personal in nature?

[43] I accept and adopt his approach.

The Email

[44] There is no dispute that the complainant’s name, job title, business contact information and designations in the email signature in the Email identify him in a business, professional or official capacity.

[45] For this reason, I find that this information is business identity information under section 2(2.1) of the Act and, therefore, not “personal information” as defined by section 2(1) of the Act .

[46] However, at issue, is whether the Email contains the opinions or views of the complainant or of his business.

[47] As described above, based on the email signature, certain correspondence received from the complainant and Order R-980015, the municipality believed that the Email contained the opinions or views of the complainant’s business.

[48] In Order R-980015, Adjudicator Donald Hale found that the individuals’ information at issue was not personal information because the information “relates to them only in their capacities as officials with the organizations which employ them.”

[49] He also found that the opinions and views expressed by these individuals “take place in the context of their employment responsibilities and are not, accordingly, their personal opinions within the definition of personal information contained in section 2(1)(e) of the Act .”

[50] In my view, the circumstances in Order R-980015 are different from this complaint.

[51] In Order R-980015, Adjudicator Donald Hale reconsidered his decision in Order P- 1538 that dealt with an appeal from a decision of the Ministry of the Attorney General (the ministry) under the Freedom of Information and Protection of Privacy (FIPPA).

[52] The records at issue in Order R-980015 consisted of correspondence received by the ministry from organizations requesting that the ministry take action against the activities of a certain organization represented by the appellant.

[53] The correspondence contained the names and titles of the individuals who wrote the letters on behalf of each organization, the dates of each letter, and the business address, telephone and facsimile numbers for each organization.

[54] At issue for Adjudicator Hale was whether the information at issue in the records qualified as personal information under section 2(1) of FIPPA. More specifically, he had to consider “whether there are circumstances in which information that is written by, provided by or is associate with the name of an individual in his or her professional capacity would be considered to be that person’s ‘personal information’ within the meaning of section 2(1).”

[55] Adjudicator Hale reviewed how this office has treated information associated with an individual’s name in their employment, professional or official capacity. In doing so, he referenced the following summary by Adjudicator John Higgins of this treatment in Order P-1409:

To summarize the approach taken by this office in past decisions on this subject, information which identifies an individual in his or her employment, professional or official capacity, or provides a business address or telephone number, is usually not regarded as personal information. This also applies to opinions developed or expressed by an individual in his or her employment, professional or official capacity, and information about other normal activities undertaken in that context.

[56] With respect to section 2(1)(e) of FIPPA, Adjudicator Hale noted that decisions by this office “have also determined that when an individual expresses an opinion in a representative capacity on behalf of a non-governmental organization, the opinion cannot be considered to be that individual’s personal information because it is not ‘about’ the individual.”

[57] In Order R-980015, Adjudicator Hale found that the information at issue was not personal information for the following reasons:

I find that the information associated with the names of the affected persons which is contained in the records at issue relates to them only in their capacities as officials with the organizations which employ them. Their involvement in the issues addressed in the correspondence with the Ministry is not personal to them but, rather, relates to their employment or association with the organizations whose interests they are representing. This information is not personal in nature but may be more appropriately described as being related to the employment or professional responsibilities of each of the individuals who are identified therein. Essentially, the information is not about these individuals and, therefore, does not qualify as their “personal information” within the meaning of the opening words of the definition.

In order for an organization, public or private, to give voice to its views on a subject of interest to it, individuals must be given responsibility for speaking on its behalf. I find that the views which these individuals express take place in the context of their employment responsibilities and are not, accordingly, their personal opinions within the definition of personal information contained in section 2(1) (e) of the Act  . Nor is the information “about” the individual, for the reasons described above. In my view, the individuals expressing the position of an organization, in the context of a public or private organization, act simply as a conduit between the intended recipient of the communication and the organization which they represent. The voice is that of the organization, expressed through its spokesperson, rather than that of the individual delivering the message.

In the present situation, I find that the records do not contain the personal opinions of the affected persons. Rather, as evidenced by the contents of the records themselves, each of these individuals is giving voice to the views of the organization which he/she represents. In my view, it cannot be said that the affected persons are communicating their personal opinions on the subjects addressed in the records. Accordingly, I find that this information cannot properly be characterized as falling within the ambit of the term “personal opinions or views” within the meaning of section 2(1) (e).

[58] Unlike the circumstances in Order R-980015, in this matter, there is no indication that the opinions or views in the Email relate to the complainant’s capacity as an official within his business, his employment within his business or to his business. Further, there is no indication that the complainant made them in order to give a voice to his business or during the course of his professional duties [10]

[59] Moreover, although the municipality may have previously received correspondence from the complainant that he sent on behalf of his business, it does not necessarily mean that he sent the Email on behalf of his business.

[60] For these reasons, in my view, it cannot be said that the complainant was acting simply as a conduit between his business and the municipality when he sent the Email. Therefore, under the first step in the approach set out in Order PO-2225, with respect to the Email, I find that the complainant’s name appears with the opinions or views in a context that is inherently personal.

[61] Under the second step, I find that the information at issue, if disclosed, would reveal something of a personal nature about the complainant. That is, it would reveal his opinions or views about Hogs for Hospice, people who attend Hogs for Hospice, people within the municipality, tourist attractions in the municipality, a specified motorcycle rally and the municipality’s consideration of the events that it holds.

[62] Therefore, I find that these opinions or views in the Email are those of the complainant and not of his business and, therefore, qualifies as “personal information” as defined by section 2(1) of the Act .

The CTV Interview

[63] As described above, the CTV Interview was part of a news story about the complainant and the Email in which the reporters provided viewers with information that identified him.

[64] The former Mayor’s comments made during this interview contain his opinions or views about the complainant’s opinions or views in the Email. Above, I found that the opinions or views in the Email are the complainant’s personal information.

[65] Because these comments relate to the complainant and appear with information that identifies him, I find that they contain his “personal information” as defined by section 2(1) of the Act .

Issue 2: Was the disclosure of the personal information in accordance with section 32 of the Act?

[66] Under section 32 of the Act , “an institution shall not disclose personal information in its custody or under its control except” if one of the exceptions described in paragraphs to (l) under this section applies. Therefore, this section, generally, prohibits the disclosure of the personal information in the Email by the municipality.

[67] There is no dispute that the municipality disclosed the Email to people responsible for Hogs for Hospice and to a former municipal employee, or that the former Mayor discussed the Email during the CTV Interview.

[68] Above, I found that the Email and the former Mayor’s comments contain the complainant’s personal information.

Marking Information Private or Confidential

[69] Because the Email was not marked “confidential” the municipality submitted that the complainant did not intend for it to be kept private. The complainant submitted that such marking is not required in order for personal information to be protected under the Act .

[70] I agree with the complainant. There is no requirement under the Act  for individuals who send their personal information to an institution to mark it “confidential” or “private” in order for this information to be protected by the Act ’s privacy provisions.

[71] Further, none of the paragraphs under section 32 of the Act  set out an exception allowing the disclosure of personal information that do not have this type of marking. Accordingly, the fact that the Email does not contain a confidentiality statement does not mean that the municipality disclosed it in accordance with this section.

Sections 32(b) and (c) of the Act

[72] As described above, the municipality submitted that, before the complainant sent the Email, the DR Webpage would have given him notice that it could be disclosed. Therefore, the municipality believed that he consented to the disclosure. Under section 32, the exception set out in paragraph (b) would permit this type of disclosure.

[73] Further, the municipality also submitted that the disclosure of the Email was in accordance with section 32(c) of the Act .

[74] Sections 32(b) and (c) of the Act  state:

An institution shall not disclose personal information in its custody or under its control except,

(b) f the person to whom the information relates has identified that information in particular and consented to its disclosure;

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

[75] Section 33 of the Act  defines “consistent purpose” in section 32(c) as follows:

The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31 (b) and 32 (c) only if the individual might reasonably have expected such a use or disclosure.

Section 32(b)

[76] In Privacy Complaint Reports MC-050045-1 and MC-050047-1, Investigator Mark Ratner considered the type of consent required by section 32(b). He found that this section “is implicitly contemplating that applicants provide their informed consent prior to the disclosure of their information to third parties.”

[77] Further, in Investigation Report I94-001M, former Assistant Commissioner Ann Cavoukian stated:

For consent to be truly meaningful, that consent must be given on an informed basis and must be given voluntarily. This is the hallmark of consent -- that it be voluntary in nature. If consent is not both informed and voluntary, its value is diminished so greatly that, in our view, it may be rendered meaningless.

[78] Moreover, in the context of an access request, this office has held that an individual’s consent should be explicit in order to demonstrate that they understood that their personal information would be disclosed. [11] Where it is not explicit, then an individual’s consent could be implied if they have a choice or voluntarily give it. [12]

[79] Regardless, without evidence that an individual has knowledge or understanding of what personal information of theirs may be disclosed, it is difficult to conclude that they consent to the disclosure of their information. [13]

[80] To determine whether an individual has consented to the disclosure of their personal information, the following questions set out in IPC Order 180, which considered consent under section 21(1) (a) of the Freedom of Information and Protection of Privacy Act, [14] are helpful:

1. Does the individual know what information about them is contained in the record?
2. Is it reasonable to assume that the individual had knowledge of all of the institution’s planned used of the record containing their personal information?
3. Does the individual have a choice regarding whether their personal information is included in the record? [15]

[81] I accept and adopt these aforementioned findings regarding consent.

[82] Regarding the DR Webpage, there is nothing in the Email or otherwise indicating that the complainant had a “wish to address an item(s) on the Council agenda”, or participate as a delegate at a Council meeting or Statutory Public meeting. [16]

[83] Further, when sending an email to the municipality’s Council or CAO, the public is not required to access the DR Webpage and, as a result, would not necessarily see the notice that it provides regarding the possible disclosure of their personal information. [17]

[84] In this matter, there is no indication that the complainant accessed the DR Webpage before he sent the Email. Moreover, there is no evidence showing that the complainant had knowledge or understanding of the possible disclosure of his personal information in the Email.

[85] For these reasons, I find that the complainant did not provide the municipality with the consent required by section 32(b) for the disclosure of his personal information to people responsible for Hogs for Hospice or to the former municipal employee.

Section 32(c)

[86] Under section 32(c) of the Act , the analysis is a two-step process. First, it is necessary to determine the original purpose of the collection. Second, it is necessary to assess whether the disclosure can be properly characterized as being either for the original purpose of the collection, or for a purpose that is consistent with that original purpose. [18]

[87] As described above, the municipality relied on Report MC08-49 and MC09-1 and Report MC-040019-1 to support its position that it disclosed the complainant’s personal information in accordance with section 32(c).

[88] In Report MC08-49 and MC09-1, Investigator Mark Ratner considered the disclosure of two letters both containing an individual’s personal information by a city. The individual was identified as the author of “Letter A” in the city’s publicized council meeting minutes documents and her “Letter B”, that she marked “strictly privileged and confidential”, was disclosed to an external auditor and posted on the city’s website attached to an audit report.

[89] Regarding Letter A in which the individual raised concerns about the expenses claimed by a member of the city’s council, he determined that “the purpose of the City’s collection of the complainant’s personal information was to allow City Council to deal with a matter of public interest raised by the complainant.”

[90] On the basis of the following, he found that the disclosure of this letter occurred to address a matter of public interest, which was for the same purpose of the original collection and, therefore, in accordance with section 32(c):

The IPC has consistently found that individuals raising matters before municipal councils should not expect anonymity with respect to those complaints. There is a public interest in the transparency and accountability of the workings of municipal government, and the precedents discussed above make clear that this principle applies to the identity of individuals who may raise matters of public interest and concern.

[91] Regarding Letter B in which the individual raised additional issues about the city council member’s claimed expenses, Investigator Ratner found that the disclosure of this letter to the external auditor was in accordance with section 32(d) of the Act .

[92] He came to this conclusion because section 32(d) allows the disclosure of personal information “to an officer employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions.” [19]

[93] He also found that the disclosure of Letter B on the city’s website was for the same purpose for which it was originally collected, that is, for the purpose of dealing with the council member’s expenses, which was a matter of public interest and, therefore, in accordance with section 32(c).

[94] In Report MC-040019-1, Investigator Brian Bisson considered the disclosure of a letter marked “confidential” and containing an individual’s personal information by a city during an open council meeting and in the meeting minutes placed on the city’s website.

[95] In the letter, the individual had asked the city for assistance with his suspension from a committee formed to co-ordinate sporting activities for neighbourhood sports associations. It was also formed to act as an official voice for matters requiring representation with outside organizations, including government organizations.

[96] Before his suspension, the individual was part of a subcommittee formed under the committee. The subcommittee had separated itself from the committee, legally incorporated and was engaged in a public dispute with the committee that also involved the city.

[97] Investigator Bisson found that the disclosure was in accordance with section 32(c) because it was for the same purpose that the complainant had intended, which was to help resolve the subject matter set out in the letter.

[98] In my view, the circumstances in both of these reports are different from this complaint.

[99] In those cases, the investigators found that the disclosure of personal information was for the same original purpose of the collection, which was to address the individual’s request(s) for assistance with the specified concerns that they had.

[100] In my view, the purpose for which the Email was originally obtained or compiled is set out in its first paragraph in which the complainant asks the municipality if it has “ever thought of holding a more family friendly fun summer festival than the current rough and tough ‘Hogs for Hospice’ event.”

[101] This question, in my view, indicates that the original purpose of the collection of the Email was to ask the municipality’s Council and CAO to consider hosting another summer event instead of Hogs for Hospice. Unlike the circumstances in Report MC08-49 and MC09-1 and Report MC-040019-1, the complainant did not ask the municipality to resolve a specific concern.

[102] For this reason, the municipality’s submission that it disclosed the Email to people responsible for Hogs for Hospice and the former municipal employee for the purpose of seeking their input about the concerns raised by the complainant, would not be for the purpose for which it was obtained or compiled under section 32(c).

[103] As described above, the municipality also submitted that the complainant might reasonably have expected the disclosure of the Email. Such disclosure would be for a “consistent purpose” permitted under section 32(c) and within the meaning of section 33 of the Act .

[104] In this matter, the municipality disclosed the complainant’s name and his opinions or views. As such, at issue is whether he might reasonably have expected the disclosure of this information. In other words, at issue is whether he had a reasonable expectation of privacy when he sent the Email to the municipality.

[105] As previously stated, there is no indication that the complainant received notice or was otherwise aware that the Email could be disclosed. Further, there is no indication that he wanted the municipality to share it with people responsible for Hogs for Hospice or the former municipal employee.

[106] In my view, it is significant that, in Report MC08-49 and MC09-1, in reaching his finding, Investigator Ratner was “also guided by the fact that the complainant had associated herself in the media as the catalyst behind the Report and a critic of the Council Member’s expenses.”

[107] Further, in my view, it is also important that, in Report MC-040019-1, in reaching his conclusion, Investigator Bisson stated:

In my view, it is not reasonable for a complainant to write to the Mayor, members of the council and employees for assistance in resolving his/her issue and expect the matter to be dealt with behind closed doors. This is even more so in the present case where the subject matter was very much in the public arena as evidenced by Letters #1 and #2. [emphasis added]

[108] Unlike the circumstances in these reports, here, there is no indication that before or after the complainant sent the Email to the municipality that he associated himself publically with or as the author of the Email. Further, there is no indication that the issues raised in the Email by the complainant “was very much in the public arena.”

[109] Although there is a “public interest in the transparency and accountability of the workings of municipal government” principle that “applies to the identity of individuals who may raise matters of public interest and concern”, in my view, this does not necessarily mean that these individuals should always expect not to have a reasonable expectation of privacy when they do so.

[110] Therefore, although this office “has consistently found that individuals raising matters before municipal councils should not expect anonymity with respect to those complaints”, in this matter, in my view, the complainant had a reasonable expectation of privacy. He had no notice from the municipality that the Email conveying his personal opinions or views about an event could be disclosed. Further, his complaint was of a general nature and did not require that the municipality address his concerns by disclosing it.

[111] For these reasons, I find that the disclosure of the complainant’s information by the municipality was not for a “consistent purpose” under sections 32(c) and 33.

[112] Therefore, for the aforementioned reasons, I find that the municipality’s disclosure of the Email to people responsible for Hogs for Hospice and to the former municipal employee was not in accordance with section 32(c).

[113] With respect to the complainant’s position, he submitted that the findings in Report MC07-64 apply to this complaint. In that report, Investigator Cathy Hamilton considered the disclosure of an individual’s personal information by a city to a credit card company. The information at issue included the individual’s concerns about the city’s disclosure of her information to the company.

[114] In finding that the city did not disclose the personal information in accordance with section 32(c), Investigator Hamilton adopted Compliance Review Officer (CRO) Susan Anthistle’s findings in IPC Investigation I96-016P.

[115] In that investigation, CRO Anthistle considered the disclosure of a letter containing concerns raised by individuals working for an agency, as well as their names and signatures, by a ministry. She found that disclosure was not in accordance with section 42(c) of the Freedom of Information and Protection of Privacy Act [20] as follows:

…in our view, the concerns outlined in the letter were about the operations of the Agency, of a general and systemic nature, and therefore, the signatories’ concerns could have been brought to the attention of the Board without the disclosure of any names. If the Ministry wanted to include the letter as part of its review, the names of the signatories could have been severed before its release since severing the names would not have prevented the Ministry and the Board from dealing with the issues that had been raised. [emphasis added]

[116] I also accept and adopt the findings in this investigation.

[117] Based on these findings, in this matter, I agree with the complainant’s position that the municipality could have severed the complainant’s name from the Email before disclosing it to the people responsible for Hogs for Hospice and the former municipal employee. In my view, the concerns raised in the Email are of a general nature in the sense that they do not appear to, specifically, relate to the complainant and, therefore, would require the disclosure of his name in order to address them.

Section 32(d)

[118] Unlike the city’s disclosure of Letter B to the external auditor in Report MC08-49 and MC09-1, in this complaint, the municipality disclosed the Email to a former municipal employee.

[119] As described above, Investigator Ratner found that the disclosure of Letter B to the external auditor was allowed by section 32(d) of the Act  because the auditor “qualifies as a ‘consultant or agent of the institution’” under this section and required the letter in order to conduct an audit.

[120] Decisions by this office have identified the following three conditions that must be met in order for section 32(d) to apply to the disclosure of personal information:

1. The disclosure must be made to an officer, employee, consultant or agent; [21]
2. Who needs the information in the performance of their duties; [22] and
3. The disclosure must be necessary and proper in the performance of the institution's functions which includes the administration of statutory programs and activities necessary to the overall operation of the institution. [23]

[121] Section 32(d) makes it clear that a disclosure of personal information even within an institution must be justified and will be subject to scrutiny on a “need to know basis.” The sharing of information pursuant to this section must be based on more than “mere interest or concern.” [24]

[122] Because the municipality’s former employee was not an officer, employee, consultant or agent of the municipality when the former Deputy Mayor sent the Email to them, the first condition required for section 32(d) to apply is not satisfied. As a result, this section cannot apply to allow the municipality’s disclosure of the Email to its former employee.

The CTV Interview

[123] As described above, the Email was available to the public before the news story about it and the complainant aired.

[124] Although, this office has found that there is a reduced expectation of privacy relating to publically available information, [25] based on the evidence before me in this matter, in my view, the Email would not have been available to the public but for the disclosure of it by the municipality.

[125] Above, I found that the comments made by the former Mayor during the CTV Interview about the Email contain the complainant’s personal information. As there does not appear to be any exceptions described in the paragraphs under section 32 that would allow this disclosure, I find that the former Mayor’s comments were not in accordance with this section and, therefore, further breached the complainant’s privacy.

[126] Because I have found that the municipality’s disclosure of the Email to the people responsible for Hogs for Hospice, the former municipal employee and the public during the CTV interview was not allowed under section 32 the Act , I find, therefore, that the disclosure of the personal information was not in accordance with this section.

Disclosure to Social Media

[127] The municipality claimed that the complainant disclosed the Email to one or more individuals who posted it on social media. However, I was not provided with any evidence to support this claim and there is no indication otherwise that the complainant did this.

[128] Therefore, based on the information available to me, I am not in a position to determine whether this disclosure(s) occurred.

CONCLUSIONS:

[129] Based on the results of my investigation, I have reached the following conclusions:

1. The information at issue is “personal information” as defined by section 2(1) of the Act .
2. The municipality’s disclosure of the personal information was not in accordance with section 32 of the Act .

RECOMMENDATIONS:

Based on the above conclusions, I make the following recommendation:

1. The municipality review and revise its policies and procedures relating to receiving emails and correspondence from individuals to ensure that disclosure of personal information to third parties is in accordance with the Act .
2. Within six months of receiving this report, the municipality should provide this office with proof of compliance with the above recommendation.

The municipality has agreed to implement the above recommendations. Accordingly, within six months of receiving this report, the municipality should provide this office with proof of compliance with these recommendations.

Original Signed by:		April 8, 2021
John Gayle
Investigator