PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT MC19-00104

Toronto Police Service

August 10, 2022

Summary: The Office of the Information and Privacy Commissioner received a privacy complaint about the Toronto Police Service (the police)’s disclosure of information relating to an individual’s arrest and drug-related charges to their employer, the Correctional Service of Canada. The complainant believed that the disclosure breached their privacy under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ).

This report finds that the information at issue is “personal information” within the meaning of section 2(1)  of the Act . It also finds that the police’s disclosure of this information was not in accordance with section 32  of the Act .

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M. 56 , as amended, sections 2(1)  and 32(e); Police Services Act , R.S.O. 1990, c. P.15 , as amended, section 41(1.1) ; and O. Reg. 265/98: Disclosure of Personal Information, as amended, sections 5(1) and (2).

BACKGROUND:

[1] In 2019, the Toronto Police Service (the police) executed a search warrant at the complainant’s residence. This led to the police charging the complainant with certain offences under the Controlled Drugs and Substances Act  (CDSA ) [1] and arresting them.

[2] Afterwards, the police called the Correctional Service of Canada (CSC), the complainant’s employer, and disclosed details about their arrest, which included information relating to their charges, bail hearing, date of birth, home address, as well as their first, middle and last names.

[3] In the complainant’s view, there was no need for the police to provide this information to CSC. The complainant also believed that the disclosure was not in accordance with the Municipal Freedom of Information and Protection of Privacy Act (the Act) and, therefore, breached their privacy.

[4] The matter moved from the Intake Stage to the Investigation Stage of the Information and Privacy Commissioner of Ontario (IPC)’s complaint process and was assigned to me as the Investigator. As part of my investigation, I requested and received representations about the complaint from the police which I discuss below.

ISSUES:

[5] I identified the following issues as arising from this investigation:

1. Is the information at issue “personal information” as defined by section 2(1) of the Act ?
2. Was the disclosure of the personal information in accordance with section 32 of the Act ?

DISCUSSION:

Issue 1: Is the information at issue “personal information” as defined by section 2(1) of the Act?

[6] Under section 2(1) of the Act , “personal information” is defined, in part, as follows:

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

…

(d) the address, telephone number, fingerprints or blood type of the individual,

…

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

[7] In this matter, information relating to the complainant’s charges under the CDSA , bail hearing, date of birth, home address and full name was disclosed to CSC. Information relating to criminal history and age, as well as address and name information are included in paragraphs (a), (b), (d) and (h), above, within the meaning of “personal information” under section 2(1) .

[8] Accordingly, I find that the information at issue is “personal information” within the meaning of section 2(1) of the Act . The police do not dispute this finding.

Issue 2: Was the disclosure of the personal information in accordance with section 32 of the Act?

[9] Section 32 of the Act  prohibits the disclosure of personal information unless one of the exceptions described in paragraphs (a) to (l) under this section applies. In this matter, the police submitted that section 32(e) of the Act  applied to allow the disclosure of the complainant’s information.

[10] In 2019 [2] , at the time of the disclosure, section 32 (e) read as follows:

An institution shall not disclose personal information in its custody or under its control except,

(e) for the purpose of complying with an Act  of the Legislature or an Act  of Parliament, an agreement or arrangement under such an Act  or a treaty; [3]

[11] Regarding section 32(e), the police submitted that the complainant’s information was disclosed for the purpose of complying with an Act  of the Legislature, more specifically, section 41(1.1)  of the Police Services Act  (PSA ) [4] .

[12] Section 41(1.1)  of the PSA  states:

Power to disclose personal information

(1.1) Despite any other Act , a chief of police, or a person designated by him or her for the purpose of this subsection, may disclose personal information about an individual in accordance with the regulations. [emphasis added]

[13] Under this section, the police had the discretion to decide whether to disclose the complainant’s information where the disclosure was done in accordance with the regulations made under the PSA . In this matter, the police advised that the disclosure was made pursuant to Ontario Regulation 265/98: Disclosure of Personal Information (O. Reg. 265/98).

[14] Sections 5(1) and (2) of O. Reg. 265/98 state:

1. A chief of police or his or her designate may disclose any personal information about an individual if the individual is under investigation of, is charged with or is convicted or found guilty of an offence under the Criminal Code  (Canada) , the Controlled Drugs and Substances Act  (Canada)  or any other federal or provincial Act  to,
1. any police force in Canada;
2. any correctional or parole authority in Canada; or
3. any person or agency engaged in the protection of the public, the administration of justice or the enforcement of or compliance with any federal or provincial Act , regulation or government program.
2. Subsection (1) applies if the individual is under investigation of, is charged with or is convicted or found guilty of an offence under the Criminal Code  (Canada) , the Controlled Drugs and Substances Act  (Canada)  or any other federal or provincial Act  and if the circumstances are such that disclosure is required for the protection of the public, the administration of justice or the enforcement of or compliance with any federal or provincial Act , regulation or government program.

[15] In support of this position, the police also provided a copy of its procedure “17-04 Community / Public Safety Notifications (Procedure 17-04)” which advises that O. Reg. 265/98 “permits the disclosure of personal information, subject to certain conditions.”

[16] In addition, Procedure 17-04 “sets out the best practices of the [police] with regard to disclosure of personal information about an individual where a Chief of Police or designate reasonably believes that the individual poses significant risk of harm to a person, including children, a particular group of people or to the public at large.”

[17] Further, Procedure 17-04 advises that “[d]isclosure may be provided to a person and/or agency engaged in the protection of the public, to an individual at risk, or in the form of a public warning/notification.”

[18] Moreover, this procedure states:

Any disclosure shall be for one or more of the following purposes:

• protection of the public

• protection of victims of crime

• keeping victims of crime informed of the law enforcement, judicial or correctional processes relevant to the crime that affected them

• law enforcement

• correctional purposes

• enforcement of and compliance with any federal or provincial Act , regulation or government program

• keeping the public informed of the law enforcement, judicial or correctional processes respecting any individual

The following shall be considered when deciding whether or not to disclose personal information:

• immediate risk

• protection of the public

• public’s right or need to know

• individual’s right to privacy

• need to maintain the integrity of an investigation or court proceeding

• the availability of resources and information

• what is reasonable in the circumstances of the case

• what is consistent with the law and the public interest

• what is necessary to ensure that the resolution of the criminal proceeding is not delayed

[19] In this matter, the complainant was charged with offences under the CDSA . Their employer, CSC, “is the federal government agency responsible for administering sentences of a term of two years or more, as imposed by the court... [and]… for managing institutions of various security levels and supervising offenders under conditional release in the community.” [5]

[20] Based on the above, I am satisfied that the conditions set out in section 5(1)(c) of O. Reg. 265/98 were met.

[21] However, before this section could have applied to give the police the discretion to decide whether to disclose the complainant’s information, the two conditions set out in section 5(2) of O. Reg. 265/98 also had to be met.

[22] I am satisfied that the first condition under section 5(2) was met because the complainant was charged with offences under the CDSA .

[23] The second condition under this section requires that “the circumstances [were] such that disclosure [was] required for the protection of the public, the administration of justice or the enforcement of or compliance with any federal or provincial Act , regulation or government program.”

[24] In this matter, the police advised that it decided to disclose the complainant’s information to the CSC because of their employment position with the CSC and the severity of their charges. [6] The police explained that the complainant’s position is one of authority and that individuals in it must uphold the law to ensure the public’s trust in the police, the courts and correctional authorities. For these reasons, the police submitted that the disclosure of the complainant’s information to the CSC was imperative and reasonable.

[25] In my view, the reasons provided by the police do not appear to be in accordance with Procedure 17-04. Based on my review of this procedure, there is no indication that an individual’s employment position is a purpose for which the police may disclose their personal information or a consideration that the police must think about when deciding whether or not to disclose personal information.

[26] Further, Procedure 17-04 makes it clear that the police follow their best practices regarding the disclosure of personal information where there is a reasonable belief “that the individual poses significant risk of harm to a person, including children, a particular group of people or to the public at large.” In this matter, there is no evidence before me to demonstrate or suggest that the complainant posed such harm, that there was an immediate risk, that the public needed to know about the complainant’s personal information or that, based on the complainant’s employment position and the severity of their charges, the disclosure of the personal information was reasonable in the circumstances of the case or consistent with the law and the public interest.

[27] Moreover, with respect to section 5(2), again there is no evidence before me to demonstrate or suggest that the “circumstances are such that disclosure is required for the protection of the public, the administration of justice or the enforcement of or compliance with any federal or provincial Act , regulation or government program.”

[28] Based on the above, and in light of the fact the police did not follow their own best practices regarding the disclosure of personal information, I am not satisfied that the reasons provided by the police demonstrate that the circumstances were such that the disclosure of the complainant’s information was ”required for the protection of the public, the administration of justice or the enforcement of or compliance with any federal or provincial Act , regulation or government program” in accordance with section 5(2).

[29] Accordingly, I find that the second condition in section 5(2) was not met and, therefore, section 5(1) could not have applied to give the police the discretion to decide whether to disclose the complainant’s personal information to the CSC. As a result, I find that the police did not disclose this information in accordance with the regulations under the PSA , as required by section 41(1.1) .

[30] For these reasons, I find that the complainant’s personal information was not disclosed for the purpose of complying with section 41(1.1)  of the PSA  in accordance with section 32(e). Therefore, I find that the disclosure of the personal information was not in accordance with section 32 of the Act .

[31] To address this privacy breach and avoid a similar incident in the future, I recommend that the police take steps to ensure that they follow their own procedures, such as Procedure 17-04, when considering whether or not to disclose personal information.

CONCLUSION:

Based on the results of my investigation, I have reached the following conclusions:

1. The information at issue is “personal information” as defined by section 2(1) of the Act .
2. The police’s disclosure of the personal information was not in accordance with section 32 of the Act .

RECOMMENDATIONS:

1. I recommend that the police take steps to prevent a similar breach from occurring by taking steps to ensure that the police follow their own procedures, such as Procedure 17-04, when considering whether or not to disclose personal information.

Accordingly, within three months of receiving this Report, the police should provide this office with proof of compliance with these recommendations.

Original Signed by:		August 10, 2022
John Gayle
Investigator