PRIVACY COMPLAINT REPORT

PRIVACY COMPLAINT PI22-00007

Ministry of the Solicitor General

February 13, 2024

Summary: The Office of the Information and Privacy Commissioner of Ontario (the IPC) received a privacy complaint from a children’s aid society about the Ontario Provincial Police (OPP) disclosing personal information contrary to the Freedom of Information and Protection of Privacy Act (FIPPA or the Act). The children’s aid society stated that the OPP had implemented new reporting system software (Child Protection Agency Notification Plug-in) and since that time, had sent several occurrence reports in which a youth was listed a witness or victim of a serious crime, but where there was no indication of a child protection concern. The children’s aid society stated that the OPP should not send reports absent a child protection concern, and that to do so was a breach of the youth’s privacy. The IPC opened a Commissioner-initiated privacy complaint file against the Ministry of the Solicitor General (the ministry), the ministry responsible for the OPP, regarding the use of the reporting system noted above.

In this report, I find that the guidance the ministry provided for use of the Child Protection Agency Notification Plug-in is contrary to section 125 of the Child, Youth, and Family Services Act (CYFSA) and section 42 of FIPPA. Section 125 of the CYFSA sets out a number of harms or risks to children and imposes a duty to report in cases where an individual, including an OPP officer, has reasonable grounds to suspect one or more of those harms or risks. The guidance provided by the ministry requires officers to send a report to a children’s aid society in all cases where a youth is listed as a victim or witness to a serious crime. Mandating these disclosures, rather than having the officer use their judgment as to whether a duty to report exists under section 125 of the CYFSA, allows for the possibility that the OPP may disclose personal information to a children’s aid society when there is no duty to report, which would be contrary to the Act. I recommend that the ministry change its guidance to reflect that officers are to send reports to a children’s aid society when the officer judges they have a duty to report, and to remove guidance stating that such reports are mandatory when a youth is listed as a victim or a witness.

Statutes Considered: Freedom of Information and Protection of Privacy Act, sections 2(1), 21(1)(b), 21(4)(d), 42(1)(e), 42(1)(h), and 42(1)(i); Child, Youth, and Family Services Act, section 125; Police Services Act, sections 41(1.1) and 41(1.3); and Regulation 265/98 to the Police Services Act, sections 2 – 5.

OVERVIEW:

The Complaint

[1] A children’s aid society (the society) contacted the Office of the Information and Privacy Commissioner of Ontario (the IPC) to report that the Ontario Provincial Police (the OPP) had launched new reporting system software that the society believed was resulting in the disclosure of personal information contrary to the Freedom of Information and Protection of Privacy Act (FIPPA or the Act). The Ministry of the Solicitor General (the ministry) is the ministry responsible for the OPP.

[2] The society stated that the OPP recently implemented a system that automatically sends the society an occurrence report when the occurrence relates to a serious crime for which a child under the age of 18 is either a witness or victim. Since that time, the society received reports from three local OPP detachments where there was no indication that a child protection concern was present. The society stated that they should not be receiving criminal occurrences involving youth if there are no child protection concerns, and that receiving police information unrelated to a child protection concern is a breach of the youth’s privacy.

[3] The society also reported that they contacted the OPP with their concerns. The OPP’s response was that occurrence reports are sent automatically to the children’s aid societies and that it is up to that society to determine if there is a child protection concern or not.

[4] To address this matter, the IPC opened a Commissioner-initiated privacy complaint file regarding whether the OPP’s disclosures of personal information were authorized under the Act. The IPC received information from the ministry regarding the reporting system at both the Early Resolution and Investigation stage.

The Notification Tool

[5] The OPP launched the Child Protection Agency Notification Plug-in (the Notification Tool) on September 9, 2021. This tool was added to the OPP’s existing Niche Records Management System (Niche RMS) and was intended to streamline the process for notifying Child Protection Agencies in non-urgent situations. With the launch, the OPP posted the following guidance documents to its internal electronic information board (available to all OPP members): Memorandum re: Child Protection Agency (CPA) Plug-In in Niche RMS (the Memo) and a Child Protection Agency (CPA) Notification Plug-in User Guide (the User Guide). The ministry provided the IPC with copies of the Memo and the User Guide.

[6] The ministry states that the Notification Tool is not a new procedure, but rather automates an existing process for reporting to children’s aid societies. The OPP provided these societies with a choice of receiving these notifications via emails generated through the Notification Tool. If they opt out of this notice method, the OPP instead provides notice to the children’s aid society by telephone or fax. The ministry states that when the tool launched, the society that made the complaint to the IPC did not consent to receiving reports via email but has since agreed to do so.

[7] The first paragraph of the User Guide states that “[the] CPA Notification Plug-in is mandatory for all occurrences where a person under the age of 18 has been linked on the Involvements tab as ‘Witness’ or as a ‘Victim’” [emphasis in original]. In its communications to the IPC, the ministry describes the notification process as officer-generated, rather than automatic, stating that “it must be a conscious decision around their duty to report”.

[8] When filling out an occurrence report in Niche RMS, OPP officers can launch the Notification Tool by selecting it from a drop-down menu of plug-ins. Once launched, the first steps the officer takes are to select the Child Protection Agency and the Referring Officer from separate drop-down lists. If the occurrence report is intended for a children’s aid society that has opted out of the new system, the officer may check a box that reads “Notification made via telephone”. If that happens, the form can be marked as complete without having to complete any other tabs, and no email is sent to a children’s aid society.

[9] If the children’s aid society has opted out of the Notification Tool, the officer then proceeds with completing six tabs within that tool. These tabs provide information on caregivers, risk factors, summary of events, and charge details. Some of these tabs have information auto populated within them, while others require choosing from drop-down menus or manually entering relevant details into a free-text field. When all tabs are completed, the officer marks the form complete, and a message window will pop up to confirm that the referral was successfully emailed to the agency.

[10] The system will then send the children’s aid society two emails. The first attaches a password-protected and encrypted pdf containing the report and the second provides the password to the pdf. The children’s aid society’s email address must be selected from a list of previously verified email addresses available within the Notification Tool; it cannot be entered manually.

[11] The report sent via the Notification Tool includes the name, date of birth, age, gender, address, and phone number of the young person.

[12] During the course of this file the OPP stated that it would be providing additional training on proper use of the tool, describing this training as follows:

The OPP want to ensure staff are comfortable using and alerting CAS per the duty to report. The training will focus on education and awareness ensuring the OPP are versed on the legal authorities and their duty to report (in particular to [children’s aid societies]) under The Act. The OPP expect training to take place over the next year.

DISCUSSION:

[13] As a preliminary matter, the ministry has stated, and I agree, that the information communicated in the emails sent via the Notification Tool is “personal information” as defined in section 2(1) of the Act.

Issue:

[14] The sole issue in this investigation is whether the OPP’s process for disclosure of personal information to children’s aid societies via the Notification Tool is in accordance with section 42(1) of the Act.

Ministry’s Position on Disclosure

[15] The ministry states that the Notification Tool is used in non-urgent situations, and “is meant to provide information to [children’s aid societies] so they may make a full evaluation regarding the interaction with the minor and their overall welfare.” The ministry states that legal authority for the OPP’s disclosure of personal information via the Notification Tool falls within the OPP’s duty to report[1] under the Child, Youth, and Family Services Act (the CYFSA), the Police Services Act (the PSA), and Regulation 265/98 to the PSA.

[16] The ministry states that the duty to report is set out in section 125 of the CYFSA, and that this duty applies to police officers, as they are among those who perform professional or official duties with respect to children. The ministry outlined the threshold for reporting to children’s aid societies as follows:

It is not necessary to be certain that a child is or may be in need of protection to make a report to a children’s aid society. “Reasonable grounds” refers to the information that an average person, using normal and honest judgment, would need in order to decide to report. This standard has been recognized by courts in Ontario as establishing a low threshold for reporting. The role of the Children’s Aid Societies is to investigate calls made by the public using a professional and standardized process. The person making the report should bring forward their concerns and Children’s Aid will determine if there is a sufficient basis to warrant further assessment of the situation.

Per the Duty to Report, the OPP use the tool to alert CAS that there is a potential concern, and the CAS can determine if there is sufficient basis to warrant further assessment of the situation.

[17] Regarding its authority to disclose personal information under FIPPA, the ministry also states that:

Under FIPPA and MFIPPA, personal information may be disclosed in various circumstances including:

• to comply with a law

• in compelling circumstances affecting the health or safety of an individual

• in compassionate circumstances to facilitate contact

[18] The ministry did not specify all of the sections of the Act that contain the authority to disclose information as described above. However, the first of these clearly describes section 42(1)(e) of the Act and will be addressed in detail below. I will briefly address the latter two, their places in the Act, and their inapplicability to the matter at hand.

[19] Sections 21(1)(b) and 42(1)(h) of the Act allow for disclosure “in compelling circumstances affecting the health or safety of an individual” if the disclosure is made to that individual’s last known address. Both sections 21(1) and 42(1) prohibit disclosure of personal information unless certain exceptions are present, such as those set out in ss. 21(1)(b) or 42(1)(h). In the case at hand, the OPP provides disclosures via the Notification Tool to children’s aid societies, and not to the individual’s last known address. Therefore, neither section 21(1)(b) nor section 42(1)(h) of the Act apply to the present circumstances.

[20] Sections 21(4)(d) and 42(1)(i) of the Act both speak to information being provided in compassionate circumstances. However, section 21(4)(d) only applies to personal information about a deceased individual, which is not the case for the information conveyed by the Notification Tool. Section 42(1)(i) allows for personal information to be provided to facilitate contact with a spouse or close friend or relative of an injured, ill, or deceased person. That section likewise does not apply to the disclosures at issue.

[21] In addition, sections 21(1)(b) and 21(4)(d) of the Act are exemptions that may be applied in response to an access request made under s. 24 of the Act; the situation at hand does not involve access requests.

[22] I find that the disclosures by the OPP via the Notification Tool are not authorized under sections 21(1)(b), 21(4)(d), 42(1)(h), or 42(1)(i) of the Act, and turn next to consider whether the disclosure is permitted pursuant to section 42(1)(e) of the Act.

[23] Section 42 of the Act sets out the circumstances in which institutions may disclose personal information. One of these circumstances is when the disclosure is permitted or required by another law, as set out in subsection 42(1)(e):

42 (1) An institution shall not disclose personal information in its custody or under its control except,…

(e) where permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada

[24] The ministry has cited both the PSA and the CYFSA as the authority to disclose the personal information in the reports sent to children’s aid societies via the Notification Tool. I will address both of these statutes in turn.

Police Services Act

[25] Section 41(1.1) of the PSA states that a chief of police or their delegate “may disclose personal information about an individual in accordance with the regulations.” Section 41(1.3) of the PSA states that “[any] disclosure made under subsection (1.1) shall be deemed to be in compliance with [clause] 42 (1) (e) of the Freedom of Information and Protection of Privacy Act.” As such, if a disclosure of personal information made by an OPP officer complies with the disclosures permitted under the relevant PSA regulation, it will be authorized under the Act.

[26] Reg. 265/98 to the PSA sets out the circumstances in which a chief of police or their designate may disclose personal information. Each section outlines circumstances in which disclosure of personal information is permitted, and the personal information that may be disclosed in those circumstances.

[27] The provisions of Reg. 265/98 allow for the following:

• Section 2 permits disclosure of personal information relating to an individual convicted of an offence under the Criminal Code  or other statutes, where there is a belief that disclosure would reduce the risk posed by the individual;
• Section 3 permits disclosure of information related to criminal proceedings for those charged with, or convicted of, an offence under the Criminal Code  or other statutes;
• Section 4 permits disclosure of specified information to a victim of a Criminal Code  offence;
• Section 5 permits disclosure of personal information belonging to an individual to police forces, correctional or parole authorities, or similar agencies involved in administration of justice, but only in circumstances in which the individual is under investigation of, charged with or convicted of an offence under the Criminal Code  or other statutes.

[28] I have reviewed the entirety of this Regulation and found that none of the sections apply to the circumstances at hand, in which a police service is disclosing personal information of a youth to child protection agencies. As such, I find that the disclosure is not permitted under Reg. 265/98 to the PSA. Accordingly, these disclosures are not made pursuant to section 41(1.1) of the PSA, which permits disclosure of personal information “in accordance with the regulations” and are therefore not deemed to be in compliance with section 42(1)(e) of the Act.

Child, Youth, and Family Services Act

[29] The ministry cited section 125 of the CYFSA as authority for disclosure of personal information under its officers’ duty to report. The preamble to section 125(1) states:

Despite the provisions of any other Act, if a person, including a person who performs professional or official duties with respect to children, has reasonable grounds to suspect one of the following, the person shall immediately report the suspicion and the information on which it is based to a society…

[30] Section 125(1) then goes on to list thirteen circumstances for which the duty to report a suspicion and the information on which it is based applies. These include various harms that the child may suffer or has suffered, or risks of harm to the child or others. The provisions do not include a duty to report because a youth has been either a victim of, or witness to, a crime.

[31] It is clear that section 125 of the CYFSA imposes a duty to report in cases where an individual has reasonable grounds to suspect one of the enumerated circumstances. It does not provide a general right to report information to a children’s aid society if reasonable grounds are not present.

[32] The ministry has stated that certainty of one of the enumerated risks or harms is not necessary to make a report to a children’s aid society. I agree with the ministry that the standard of “reasonable grounds” is not certainty, and do not take issue with their position that “reasonable grounds” has been previously interpreted as “the information that an average person, using normal and honest judgement, would need in order to decide to report.”

[33] The issue at hand is not that officers are using the wrong threshold for determining whether there have reasonable grounds to report personal information to a children’s aid society, based on a suspicion of a possible harm or risk. The issue is that the User Guide may be taking that judgment out of officers’ hands entirely, and mandating that reports be sent to a children’s aid society through the Notification Tool any time a youth is listed as a victim of or witness to a serious crime in an occurrence report.

[34] The ministry has provided conflicting information on this point. In its early communications with the IPC, the ministry described the submission of reports via the Notification Tool as “a conscious decision around their duty to report.” They also stated that “the OPP use the tool to alert CAS that there is a potential concern, and the CAS can determine if there is sufficient basis to warrant further assessment of the situation.”

[35] However, the ministry’s own guidance document for the use of the Notification Tool does not advise officers that the tool is to be used only when the OPP have identified reasonable grounds to suspect harm or risk to a youth. Instead, the User Guide states that “[the] CPA Notification Plug-in is mandatory for all occurrences where a person under the age of 18 has been linked on the Involvements tab as ‘Witness’ or as a ‘Victim’” [emphasis in original].

[36] In my questions to the ministry, I noted that “the central issue in this case is whether it is the OPP’s apparent practice to report any OPP interaction with a minor to a children’s aid society, regardless of whether the OPP identifies a child protection concern from that encounter.” The ministry volunteered the following in response:

In the case of the tool, it is for non-urgent situations only. It is meant to provide information to CAS so they may make a full evaluation regarding the interaction with the minor and their overall welfare.

[37] Notably, the above does not state that the information will only be provided when the OPP has the reasonable grounds to suspect the harms or risks listed in section 125 of the CYFSA. While that provision allows disclosure in cases where an individual has such reasonable grounds, it does not permit disclosure of personal information for informational purposes when the individual has not identified that such reasonable grounds exist.

[38] Section 125 sets out a number of different harms or risks that that must be reported if there are reasonable grounds to suspect one of those is occurring or could occur. Police services do not need certainty before making a report under that section but do need to make some assessment of a situation, to see if reasonable grounds for reporting do exist. However, the guidance provided by the OPP in its User Guide does not instruct officers to use their judgment in determining whether there is a duty to report to a children’s aid society. Instead, it instructs officers to create the relevant form to send to a children’s aid society in all cases where a youth is listed as a witness or a victim to a crime. This creates the potential for a situation where an officer may disclose a youth’s personal information to a children’s aid society not because they believe there to be reasonable grounds on which to base their duty to report, but because the User Guide instructed them to.

[39] A youth being a witness or victim to a crime does not necessarily mean that there are reasonable grounds to suspect they fall into any of the risks or harms listed in section 125 of the CYFSA. If a report is made to a children’s aid society in such a case where there are no reasonable grounds for the duty to report, that disclosure falls outside of the OPP’s authority to disclose personal information under section 125 of the CYFSA, and is contrary to section 42 of FIPPA.

[40] The ministry states that the implementation of the Notification Tool was not a new policy, just a streamlining of its existing process. This does not correspond with the direction in the User Guide that mandates reporting to children’s aid society in all cases where a youth is a victim or witness. Furthermore, it was a children’s aid society who identified that the increase in the OPP sending reports lacking any indicators of child protection concerns coincided with the implementation of the Notification Tool.

[41] The ministry disputes the society’s assessment that the disclosures they identified were not authorized under the Act. The local OPP detachment commander reviewed the information provided to the society and concluded that sharing this information was not improper:

The OPP Detachment Commander reviewed the content of the alert against their duty to report and as stated above the OPP have a responsibility to share the information available; including any background information gathered that will enhance the ability of the CAS to evaluate the situation and make a determination if the child is in need of protection.

[42] I was not provided with, and did not request, the reports containing the personal information that the OPP disclosed that prompted the society to approach the IPC with its concerns. I make no evaluation on whether those reports fell within the duty to report as set out section 125 of the CYFSA and I note that it is possible for knowledgeable parties to disagree on what constitutes reasonable grounds to suspect harm or risks to a youth.

[43] However, it is not disputed that when the OPP changed its process for reporting to children’s aid societies, it provided a User Guide that stated reporting was mandatory in all cases when a youth was a witness to or victim of a crime, and that following this, at least one children’s aid society noticed an uptick in reports which did not indicate that a child protection report needed to be sent. The society did not express that it had these concerns prior to the implementation of the Notification Tool. This indicates to me that the implementation of the Notification Tool, and the associated guidance for its use, has affected when the OPP discloses personal information to children’s aid societies, despite the ministry’s stated intention that this was only meant to streamline an existing process. The new process carries with it a risk that the OPP may disclose personal information to a children’s aid society in cases where an officer has not determined they have a duty to report concerns to a society under section 125 of the CYFSA.

[44] In light of the above, I find that the guidance provided by the ministry for use of the Notification Tool permits disclosure of personal information contrary to section 125 of the CYFSA and section 42 of FIPPA, as it does not require officers to first determine whether there are reasonable grounds to suspect the harms or risks listed in section 125 of the CYFSA.

[45] I recommend that the ministry revise the User Guide by removing the following sentence:

The CPA Notification Plug-in is mandatory for all occurrences where a person under the age of 18 has been linked on the Involvements tab as “Witness” or as a “Victim.”

[46] I recommend that the ministry further revise the User Guide and all relevant guidance to stipulate that the CPA Notification Plug-in is to be used for occurrences where the officer has determined that they have a duty to report concerns to a children’s aid society under section 125 of the CYFSA.

[47] I recommend that the ministry inform users of the Notification Tool of the changes to the User Guide and provide training to users on these changes.

CONCLUSION:

Based on the results of the investigation, I have reached the conclusion that the guidance provided by the ministry for use of the Notification Tool permits disclosure of personal information contrary to section 125 of the CYFSA and section 42 of FIPPA, as it does not require officers to first determine whether there are reasonable grounds to suspect the harms or risks listed in section 125 of the CYFSA.

RECOMMENDATIONS:

1. I recommend that the ministry revise the User Guide by removing the following sentence:

The CPA Notification Plug-in is mandatory for all occurrences where a person under the age of 18 has been linked on the Involvements tab as “Witness” or as a “Victim.”

2. I recommend that the ministry further revise the User Guide and all relevant guidance to stipulate that the CPA Notification Plug-in is to be used for occurrences where the officer has determined that they have a duty to report concerns to a children’s aid society under section 125 of the CYFSA.
3. I recommend that the ministry inform users of the Notification Tool of the changes to the User Guide and provide training to users on these changes.

Within three months of receiving this report, the ministry should provide this office with proof of compliance with the above recommendations.

Original Signed By:		February 13, 2024
Jennifer Olijnyk
Investigator