PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT PC19-00003

Ministry of Transportation

January 18, 2022

Summary: The Office of the Information and Privacy Commissioner of Ontario received a complaint alleging that the Ministry of Transportation (the ministry) contravened the Freedom of Information and Protection of Privacy Act  (the Act ) when it disclosed the complainant’s personal information to a parking lot operator and a collection agency. This report finds that the information at issue is “personal information” as defined in section 2(1)  of the Act  and that the personal information was disclosed in accordance with sections 42(1) (c) and 43  of the Act .

Statutes Considered: Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F. 31, sections 2(1) , 42(1) , and 43 ; Highway Traffic Act, R.S.O. 1990, c. H. 8, sections 205  and 205.0.1 .

Orders and Investigation Reports Considered: Privacy Complaint Reports PC07-21; PC07-71; PC18-18; and MC18-23.

Cases Considered: United States of America v. Efevwerha, 2020 ONSC 7950.

BACKGROUND:

[1] On January 7, 2019, the Office of the Information and Privacy Commissioner of Ontario (the IPC) received a privacy complaint under the Freedom of Information and Protection of Privacy Act (the Act or FIPPA) against the Ministry of Transportation (the ministry or MTO). The complaint related to the disclosure of the complainant’s personal information to an operator of a parking facility (the operator), and to a collection agency (the collection agency).

[2] The complainant states that on September 25, 2018, he received a parking notice (the parking notice) for “failure to display a valid parking receipt” while parked at one of the operator’s parking lots in Ottawa. On January 11, 2019, he received correspondence from the collection agency in the form of a “Notice of Outstanding Debt”. It was addressed to the complainant at his home address, and listed the same penalty amount and date as the parking notice from the operator.

[3] The complainant made a complaint to the IPC regarding this correspondence, stating that he had not provided the operator or the collection agency with his name or contact information. The complainant states that he believes that the ministry disclosed his personal information to the operator, which in turn shared this information with the collection agency.

[4] During the intake stage of this complaint, the IPC contacted the ministry regarding these allegations. The ministry confirmed that it had provided the operator with the complainant’s personal information pursuant to its Authorized Requester Program, and stated that this disclosure was authorized under section 43 of the Act . The ministry provided the IPC with background information regarding that program and stated the following in part:

[A]ccess to residential address information is restricted to Authorized Requesters who enter into a contractual agreement with the Ministry of Transportation after the purpose of their request is reviewed and determined to meet the ministry’s criteria. Only those organizations with a legitimate need for this information may become Authorized Requesters. Examples of such needs include parking enforcement, investigation of claims and judicial services, debt collection and automobile insurance underwriting. In addition, Authorized Requesters must be properly licensed to conduct their business.

A public notice about this program is placed in all Driver and Vehicle Licence Issuing Offices, is on the ministry’s website at; http://www.mto.gov.on.ca/english/about/collection.shtml, and noted in the newsletter that is inserted with all Vehicle Licence Renewal Applications.

[5] Subsequent to receiving the above noted information, this matter was transferred to the investigation stage of the IPC’s complaint process and I was assigned as the investigator.

[6] As part of my investigation, I wrote to the ministry and asked them questions regarding the circumstances of this matter. I also wanted additional information about the Authorized Requester Program.

[7] Information received from the ministry and the complainant, as well as my own conclusions with respect to this matter, are set out in this Report.

ISSUES:

The following issues were identified in this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act ?
2. Was the disclosure of personal information by the ministry authorized by the Act ?

DISCUSSION:

Issue 1: Is the information at issue “personal information” as defined by section 2(1) of the Act?

[8] Section 2(1) of the Act  states in part:

“personal information” means recorded information about an identifiable individual, including,

…

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

…

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual

[9] The list of examples of personal information under section 2(1)  is not exhaustive. Therefore, information that does not fall within the subparagraphs may still qualify as personal information.

[10] To qualify as personal information, the information must be about the individual in a personal capacity and it must be reasonable to expect that an individual may be identified if the information is disclosed.

[11] The ministry states that pursuant to its Authorized Requester Agreement (the Agreement) in place with the operator, it provided the operator with a Plate by Date Abstract, a document that includes the plate registrant name and plate registrant address.

[12] The information at issue in this complaint is the complainant’s name and address, which appears on his plate registration.

[13] The ministry has confirmed in its submissions that the plate registrant name and address are personal information pursuant to the Act .

[14] I agree and find that the plate registrant name and plate registrant address are personal information as defined under section 2(1) of the Act .

Issue 2: Was the disclosure of the information authorized by the Act?

[15] Under the Act , personal information in the custody or under the control of an institution cannot be disclosed except in the specific circumstances outlined in section 42(1) .

[16] Section 42(1)  states in part as follows:

An institution shall not disclose personal information in its custody or under its control except,

…

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

[17] Section 38(2) of the Act  limits the collection of personal information to the following:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

[18] Section 43 of the Act  addresses what a consistent purpose under section 42(1) (c) may include:

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41 (1) (b) and 42 (1)  (c) only if the individual might reasonably have expected such a use or disclosure.

The Parties’ Positions

[19] Central to the complainant’s submissions is that section 205.0.1 of the Highway Traffic Act (the HTA) governs the disclosures that the ministry may make. Though the ministry has not claimed section 205.0.1 of the HTA as authority for its disclosure of the information at issue, the complainant’s position is that this section prohibits all collections and disclosures of personal information by the ministry, unless they are included within the purposes listed in section 205.0.1 .

[20] The complainant addresses section 205.0.1  as a “self contained code” governing all of the ministry’s permissible grounds for collection, use, and disclosure of information.

[21] Sections 205.0.1 (1) and (2), when combined, provide that the Minister may request, collect, or disclose information from any public body or related government, as he or she considers appropriate, if the Minister considers it necessary for a purpose set out in subsection (5).

[22] Section 205.0.1(5) states that “the only purposes for which information may be collected or disclosed under this section are the following” and then lists six such purposes. None of the listed purposes appears to apply to the matter at hand, and neither the complainant nor the ministry have claimed that they do apply.

[23] Section 205.0.1(10) provides definitions for public bodies and related governments as follows:

“public body” means,

(a) any ministry, agency, board, commission, official or other body of the Government of Ontario,

(b) any municipality in Ontario,

(c) a local board, as defined in the Municipal Affairs Act, and any authority, board, commission, corporation, office or organization of persons some or all of whose members, directors or officers are appointed or chosen by or under the authority of the council of a municipality in Ontario, or

(d) a prescribed person or entity;

“related government” means,

(a) the Government of Canada and the Crown in right of Canada, and any ministry, agency, board, commission or official of either of them, or

(b) the government of any other province or territory of Canada and the Crown in right of any other province of Canada, and any ministry, agency, board, commission or official of any of them.

[24] The complainant states that the operator and the collection agency are private entities and that neither is a public body or related government within the meaning of section 205.0.1 .

[25] The complainant therefore takes the view that the ministry had no lawful authority under the complete code set out in section 205.0.1 of the HTA  to disclose his personal information to the operator or the collection agency.

[26] The complainant appears to go further by stating that section 205.0.1  governs all disclosures, arguing that this explicit limitation of disclosures to public bodies for specified purposes means that any disclosures to private entities for other purposes are verboten. As the complainant puts it:

Disclosure is to be made only to public bodies for the purposes outlined in subsection (5). It would be an incredible stretch of the imagination that one can read into this regime some type of disclosure "consistent" with the above purposes to private individuals (including privately held corporations) for private purposes (personal debt collection). When one looks at the scheme of the act, it is clear that information is to be guarded carefully and disclosed for purposes limited to those outlined above and not for private or other purposes except as specifically permitted by law.

[27] Moreover, the complainant seems to take the position that even when these sections in the HTA  do not directly apply, they should govern – or at least inform – any other alleged grounds of lawful authority the ministry may have to disclose personal information. As section 205.0.1 does not contemplate disclosures of information for the purpose of debt collection or disclosures to private entities, the complainant states that the ministry’s disclosure of his personal information was unauthorized under any other grounds.

The Ministry’s position

[28] The ministry states that the disclosure of the personal information was authorized under section 42(1)(c) of the Act , as it was for the purpose for which it was obtained or compiled or for a consistent purpose.

[29] The ministry further states that its collection of the personal information was necessary for the proper administration of the ministry's regulation of drivers and vehicles in Ontario. It notes that one of the duties of the HTA  registrar is record-keeping, as required under section 205 of the HTA .

[30] Therefore, the ministry argues, the disclosure of the personal information to the operator and the collection agency is authorized under section 42(c) of the Act  as it was done for the purpose for which the information was obtained or compiled or for a consistent purpose, namely the regulation of drivers and motor in Ontario.

[31] The ministry further notes that the Authorized Requester Program in place allows third parties to obtain plate registrant information. The ministry described this program on its website [1] as follows:

The MTO records often include residential information of drivers or vehicle owners. This residential information is not considered part of a public record, and is Personal Information.

Only “authorized” requesters who have been approved and have entered into a contractual agreement with the MTO may obtain residence address information for the purposes set out below (subject to the authorized use as set out in the AR agreement):

Debt collection

…

Parking violations

[32] As previously noted, the ministry has an Authorized Requester Agreement with the operator, which grants the operator a license to access the Plate by Date Abstract with Address for authorized uses. The ministry provided me with a copy of the Agreement that states that locating vehicle owners who failed to display proof of payment in an operator parking lot is an authorized use.

[33] The ministry also provided me with a Supplementary Agreement, which states that the ministry grants the operator permission to provide the collection agency with information it obtained through the Agreement, solely for the purpose of facilitating debt collections services on behalf of the operator.

The complainant’s reply arguments

[34] The complainant disputes that the disclosure to the operator as part of the Authorized Requester program is an authorized disclosure under sections 42(1)(c) and 43 of the Act .

[35] First, as previously mentioned, the complainant states that the legislature chose to put in place a disclosure regime in section 205.0.1 of the HTA , and that for a disclosure to be authorized pursuant to sections 42(1)(c) and 43 of the Act , it must be among the list of explicit disclosures permitted under section 205.0.1.

[36] Second, the complainant takes the position that the disclosure to the operator did not involve parking violations, but was for the purpose of debt collection. The complainant states that debt collection has no rational connection to the purpose of the collection, making the disclosure unauthorized under section 43 of the Act . The complainant further states that the ministry cannot create this rational connection merely by including debt collection as one of the purposes listed in the ministry’s Authorized Requester Program notice.

[37] Third, the complainant cites Privacy Complaint Reports PC07-71 and PC07-21 as previous instances in which this office has agreed with his position that disclosures to private parking lot operators or collection agencies under the Authorized Requester Program have no rational connection to the ministry’s collection of driver information.

Analysis and Findings

Authority to disclose under section 205.0.1 of the HTA

[38] On the issue of the application of section 205.0.1 of the HTA , I agree with the complainant that it does not authorize the ministry’s disclosure of the complainant’s personal information to the parking lot operator or the debt collection agency, as these are private entities, and not public bodies or related governments within the meaning of that section.

[39] In Privacy Complaint Report PC18-18, Investigator Lucy Costa found that section 205.0.1 of the HTA  did not apply to disclosures to the War Amps made pursuant to the Authorized Requester Program. It did not apply because the War Amps is not a public body, as defined in section 205.0.1(10).

[40] I agree with this reasoning. The HTA sets out what disclosures section 205.0.1  applies to, and the disclosure at issue does not fall into that category. I find that, as the disclosure at issue was made to private bodies, section 205.0.1  does not apply in the case at hand.

[41] I note that the above finding does not speak to the complainant’s second argument involving this section; namely, that regardless of direct application, inconsistency with the provisions in section 205.0.1  renders the purpose of the disclosure inconsistent with the purpose of the collection. I will address this second argument below.

Authority to disclose under section 42(1)(c) of the Act

[42] The Ministry does not cite section 205.0.1  as its lawful authority. The Ministry’s position is that it was lawfully authorized to disclose the complainant’s name and address to the parking lot operator under section 42(1)(c) of the Act .

[43] In determining whether a given disclosure of personal information is in accordance with section 42(1)  (c), it is first necessary to determine the original purpose of the collection. Next, it is necessary to assess whether the disclosure of this information can be properly characterized as being either for the original purpose of the collection, or for a purpose that is consistent with that original purpose.

[44] Section 43 of the Act  addresses consistent purpose as follows:

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41 (1) (b) and 42 (1)  (c) only if the individual might reasonably have expected such a use or disclosure.

[45] Recent privacy complaint reports have considered foreseeability as a factor in determining whether there is a rational connection between the purposes of the collection and the disclosure. The IPC described this approach as follows in MC16-4:

[There] must be a rational connection between the purpose of the collection and the purpose of the use in order to meet the ‘reasonable person’ test set out in [the MFIPPA equivalent of section 43 ]. A key element of reasonable expectation is foreseeability.” [2]

[46] I agree that the ministry’s collection of the complainant’s name, address, and driver license number is authorized under section 38(2) of the Act , as it was necessary to the proper administration of a lawfully authorized activity, namely, the ministry's regulation of drivers and vehicles in Ontario.

[47] However, there is a fundamental disagreement between the ministry and the complainant regarding the purpose of the disclosure of personal information to the operator and the collection agency. The ministry characterizes the disclosure as connected to its overall mandate, stating as follows:

Parking a vehicle is regulated both on public and private property. The IPC has, in Privacy Investigation Report PC07-21, recognized that parking matters are rationally connected to the ministry’s driver and vehicle regulation mandate, and so is collection of amounts owed in respect of parking on private property, whether those amounts are owed pursuant to a by-law or a contract.

[48] The ministry provides notice of disclosures under the Authorized Requester Program on its website, where it states that personal information may be provided for parking violations and debt collection, among other purposes.

[49] The complainant, on the other hand, states that the purpose that his information was used for was debt collection, rather than a parking violation. He argues that “parking violation”, as set out in the notice, should be interpreted as providing notice only for “legally prescribed parking violations” for which information may be disclosed for law enforcement purposes. The complainant appears to take the position that disclosures for parking violations could only be to governments or other bodies within the public sector involved in law enforcement.

[50] I do not believe that a reasonable person viewing the notice would interpret “parking violations” as strictly and technically as the complainant does. The ministry has a mandate that encompasses roads and vehicles, and I agree with the ministry that parking matters are rationally connected to their mandate, whether they occur on public or private property. While the operator may be collecting a debt, that debt was incurred due to an alleged failure to display a parking ticket, a matter that falls within the ministry’s mandate.

[51] Moreover, the wording of the ministry’s notice does not support the complainant’s restrictive interpretation. The notice is clear that disclosures may be made to private entities under the Authorized Requester Program, as it names private agencies in the notice itself. Private entities such as the War Amps and the 407-ETR are listed as examples of bodies to whom disclosures may be made, for key tag service and road toll collection, respectively. The notice also states that personal information may be provided to private actors for service of documents and to financial institutions for verification of information. I do not agree that a reasonable person would read the notice of collection, including the reference to disclosures for parking violations, and think that it did not contemplate disclosures to private operators of parking lots.

[52] The circumstances of this case indicate that the disclosure was reasonably foreseeable. An individual parked in a private parking lot and received a parking notice for failure to display a valid parking ticket. A follow up invoice was sent after the period of payment for the ticket had expired. This was done in accordance with an Authorized Requester Agreement with the ministry, a program that has been in place for some time and has long included both disclosures to parking lot operators [3] and notice of such disclosures.

[53] Taking all these factors together, it appears reasonably foreseeable that a person who receives a parking ticket on a private lot could expect the ministry to disclose their personal information to the operator of the parking lot under the Authorized Requester Program.

[54] Regarding the complainant’s second argument that the ministry’s authority to collect, and therefore, disclose, personal information for purposes related to its mandate must necessarily be limited by the terms of section 205.0.1 , I disagree. Had the legislature intended for the principles in section 205.0.1  to apply beyond the scope of that section, they could have put in place legislation that mandates a broader application. This section clearly delineates its applicability, and I see no reason to interpret this application more broadly, so as to limit any other disclosures not directly addressed by this section. This is consistent not only with Privacy Complaint Report PC18-18, but also with the interpretation of this section by the Ontario Superior Court of Justice in a recent decision, in which the court stated:

[The] limitations contained within subsection [205.0.1(5)] constrain the Minister’s ability to collect or disclose information from another public body or government. For example, another Ministry or agency within the Ontario government, or the government of another province. The section does not speak to the collection or disclosure of information by the Ministry of Transportation itself, like information contained within its database of licensed drivers in Ontario. [4]

[55] I find that disclosures made pursuant to section 42(1)(c) of the Act  are not confined to those made for the purposes set out in section 205.0.1(5) of the HTA . To determine whether a disclosure is made for a purpose consistent with the purpose of its collection requires an analysis the rational connection between them and consideration of the reasonable foreseeability of the disclosure, rather than a survey of the purposes listed in section 205.0.1(5).

[56] The complainant has raised two previous privacy complaint reports of this office as standing for the opposite conclusion, stating as follows:

Your office has previously held that disclosures for debt collection or for investigations by private investigators are neither rationally connected to the core business functions of the MTO (e.g. safety recalls by auto manufacturers, road toll collection, parking violations) or to the administration of MTO's programs.

[57] The facts in these two reports differ significantly from the case at hand. The first case, PC07-71, involved a complaint against McMaster University (not the ministry) for having disclosed the complainant’s personal information to a third party debt collection agency. In that case, the IPC found the disclosure to be contrary to the terms of the ministry’s Authorized Requester Program, and therefore not authorized under section 42(1)(c) of FIPPA .

[58] The second case, PC07-21, involved a complaint against the Ministry of Transportation for having disclosed personal information about the complainant to a third party private investigator. In this case, the private investigator had been hired by a client to investigate the complainant who was a worker with a child protection agency after she made a recommendation respecting the custody of a child in the client’s care. The IPC found that this purpose was not consistent with the purpose for which the ministry collected this personal information in the first place, which was to administer the ministry’s driver, vehicle and carrier programs.

[59] It appears from the complainant’s arguments that he is referring to obiter dicta within those cases, rather than their actual findings. The investigators in PC07-71 and PC07-21 both observed that the IPC had previously advocated for the ministry to limit the scope of organizations having access to the ministry’s database via the Authorized Requester Program. This obiter commentary is not relevant to the legal question before me in this case and does not bind me in any way.

Conclusion

[60] The disclosure of the personal information in this case was for a purpose consistent with the proper administration of the regulation of drivers and vehicles in Ontario. I therefore find that the disclosure of personal information to the operator and the collection agency was made pursuant to sections 42(1)(c) and 43 of the Act .

FINDINGS:

I have made the following findings based on the results of my investigation:

1. The information in question qualifies as “personal information” as defined in section 2(1) of the Act .
2. The personal information was disclosed in accordance with section 42(1)(c) of the Act .

Original Signed by:		January 18, 2022
Jennifer Olijnyk
Investigator

POSTSCRIPT:

[61] Since the time when the complaint was filed, the legislature has revised the Highway Traffic Act  to include the Authorized Requester Program within it. They did so by adding section 4.2 of the HTA , which reads in part as follows:

(1) The authority to disclose information under this section is in addition to any other authority for the Registrar to disclose information under this Act , under the Freedom of Information and Protection of Privacy Act  or under any other Act , and this section does not prohibit any disclosure of information that is not otherwise prohibited.

(2) The Registrar may disclose prescribed personal information obtained under this Act  if,

(a) the disclosure is for a purpose listed in Column 1 of the Table to this subsection;

(b) the disclosure is to,

(i) the authorized requester listed in Column 2 of the same item,

(ii) a re-seller engaged by the authorized requester to obtain the information on behalf of the authorized requester, or

(iii) a service provider engaged by the authorized requester to perform services that are consistent with the purpose and that are specified by the authorized requester; and

(c) the authorized requester and the Registrar have entered into an agreement with the Registrar for the Registrar to disclose information to the recipient.

[62] The table cited in section 4.2(2)(a) lists “enforcement respecting the unlawful parking, standing or stopping of a vehicle” as a purpose of disclosure in cases where the authorized requester is an “[operator] of public or private parking facilities.”

[63] In addition, the notice on the ministry’s website [5] now includes the following purposes for which information may be disclosed to Authorized Requesters:

• collection of debts resulting from failure to pay amounts owing to:
• road toll authorities
• financial institutions
• government (including courts)
• municipal and private parking authorities

…

• parking violations (private, municipal and government parking)

[64] In his submissions, the complainant expressed concerns that disclosure pursuant to the Authorized Requester Program did not fall within the ministry’s authority as it was not reflected in the HTA  and that the ministry’s notice did not cover disclosures to private parking lot operators. Moving forward, the addition of section 4.2 to the HTA  appears to address these concerns.