Ann Cavoukian

A parent complained that a grade nine school project requiring students to disclose personal information about their ancestry, race, and country of origin violated the Municipal Freedom of Information and Protection of Privacy Act.

The Board of Education argued that the project was part of the common curriculum designed to promote multiculturalism and that alternative assignments were offered.

The Assistant Commissioner found that while the requested information was 'personal information' under the Act, its collection was necessary to the proper administration of a lawfully authorized activity, specifically providing instruction in a prescribed course of study under the Education Act.

The collection of personal information was therefore in compliance with the Act.

The complainant, a police constable, alleged that the Police Services Board improperly disclosed his personal information to his wife and to the Police Complaints Commissioner (PCC) in the course of handling a public complaint.

The Assistant Commissioner found that the information was personal information under the Municipal Freedom of Information and Protection of Privacy Act.

The disclosure to the complainant's wife was not in compliance with section 32 of the Act, as it was not required by the Police Services Act.

However, the disclosure to the PCC was in compliance with section 32(f) of the Act, as it was a disclosure by a law enforcement institution to a law enforcement agency.

The complainants alleged that a separate school board collected their child's personal medical information without consent, contrary to the Municipal Freedom of Information and Protection of Privacy Act.

The school board's psychologist had contacted the child's clinician to ask if a status report was available for an upcoming Special Education Appeal Board hearing.

The Assistant Commissioner found that the information collected—that no report was available—constituted personal information.

However, the collection was in compliance with section 28(2) of the Act because it was necessary for the proper administration of a lawfully authorized activity, namely preparing for the appeal hearing.

A tenant complained that the Metropolitan Toronto Housing Authority (MTHA) improperly collected personal information by requiring proof of vehicle ownership to obtain a parking sticker.

The Assistant Commissioner found that the vehicle registration information was 'personal information' under the Freedom of Information and Protection of Privacy Act.

However, the collection was authorized under section 38(2) as it was necessary for the proper administration of the MTHA's parking management program, which required proof of both residency and personal ownership.

The Assistant Commissioner also found that the MTHA's form failed to provide the required notice of collection under section 39(2) and recommended that the form be amended.

The complainant, an employee of a Ministry facility, alleged that an Assistant Administrator improperly accessed his personnel file and disclosed his criminal conviction to Ministry counsel, who then disclosed it during a Grievance Settlement Board (GSB) hearing where the complainant was a witness.

The Information and Privacy Commissioner found that the information was personal information.

However, the Assistant Administrator's access and subsequent disclosure to Ministry counsel were in compliance with the Freedom of Information and Protection of Privacy Act, as they were necessary for the performance of duties and the discharge of the Ministry's functions in preparing for the GSB hearing.

Furthermore, the disclosure at the GSB hearing was not prohibited by the Act, as the Act does not affect a tribunal's power to compel a witness to testify.

The Commissioner recommended that the Ministry attach a record of disclosure to the complainant's personnel file.

The complainant alleged that a regional municipality improperly disclosed his HIV-positive status to a home care company providing services to his mother.

The Assistant Commissioner found that the information was personal information under the Municipal Freedom of Information and Protection of Privacy Act, that the municipality had disclosed it to the company, and that the disclosure was not authorized under section 32 of the Act.

The municipality failed to demonstrate that the disclosure was necessary for health and safety, as the company already used universal precautions.

The Commissioner recommended staff training on the Act's disclosure requirements.

Three part-time firefighters complained that a municipality collected, used, and retained their personal information in 'secret' files maintained by the Fire Chief, which were subsequently used to terminate their employment.

The Assistant Commissioner found that while the initial collection of the information was authorized, the indirect collection, lack of notice, and subsequent use of the information for termination purposes violated the Municipal Freedom of Information and Protection of Privacy Act.

The municipality was ordered to implement new policies and procedures regarding employee personal information and freedom of information requests.

A teacher filed a privacy complaint against a separate school board regarding the collection and disclosure of her medical information while on sick leave.

The Board required her to sign consent forms authorizing the collection of all her medical records and the disclosure of the Board physician's report to the Superintendent.

The Assistant Commissioner found that the proposed collection of all medical records was overly broad and not in compliance with the Municipal Freedom of Information and Protection of Privacy Act.

However, the collection of information specifically related to the incident precipitating the sick leave, and the disclosure of the physician's report to the Superintendent, were found to be in compliance.

The Assistant Commissioner recommended changes to the Board's policies to better protect employee privacy.

The complainant alleged that the Ministry of Northern Development and Mines improperly disclosed his personal information in a letter from the Minister to a Member of Provincial Parliament.

The Assistant Commissioner found that the information disclosed, which included details about the complainant's property, mining taxes paid, and his personal dealings with the Ministry, constituted personal information under section 2(1) of the Freedom of Information and Protection of Privacy Act.

The Assistant Commissioner concluded that the disclosure was not in compliance with section 42 of the Act, as the complainant had not consented to the disclosure and it was not for a consistent purpose.

The Ministry was recommended to remind staff of the Act's requirements.

A taxicab driver filed a privacy complaint against a municipal licensing commission regarding the collection of trip sheets and criminal record convictions, and the security of records in the training section.

The Assistant Commissioner found that the records contained personal information and were collected in accordance with the Municipal Freedom of Information and Protection of Privacy Act for law enforcement and administrative purposes.

However, the Commission failed to provide proper notice of collection for the trip sheets and failed to document its security measures for preventing unauthorized access to records.

The Commission was ordered to document its security measures and provide proper notice of collection.

The complainants objected to a public school board collecting their daughter's name, address, and telephone number from another student to contact them about grade nine registration.

The Information and Privacy Commissioner investigated whether this collection violated the Municipal Freedom of Information and Protection of Privacy Act.

The Assistant Commissioner found that the information was personal information and that its collection was not necessary for the board's lawfully authorized activity of notifying prospective students about its programs, as alternative methods of notification existed.

The board was ordered to revise its policies to comply with the Act.

The complainant alleged that the Management Board Secretariat (MBS) breached the Freedom of Information and Protection of Privacy Act during the course of workplace harassment investigations.

The Information and Privacy Commissioner investigated whether MBS improperly disclosed the complainant's personal information, failed to retain records, or failed to ensure the accuracy of the information used in the investigation reports.

The Assistant Commissioner concluded that the disclosures made to various MBS officials were necessary and proper in the discharge of the institution's functions under section 42(d) of the Act.

The Assistant Commissioner also found that MBS had retained the records in accordance with section 40(1) and had taken reasonable steps to ensure the accuracy of the information under section 40(2).

However, the investigation revealed that MBS had breached certain terms of its indirect collection authorization, and recommendations were made to address these procedural issues.

The complainant, an employee of the Municipality's licensing commission, alleged that her sensitive medical information contained in a Workers' Compensation Board report was improperly disclosed by the Municipality to a licensing commission, an insurance company, and at an arbitration hearing, contrary to the Municipal Freedom of Information and Protection of Privacy Act.

The Assistant Commissioner found that the information was personal information under the Act.

However, the disclosures to the licensing commission and the insurance company were permitted as they were for a consistent purpose related to claims management and benefits adjudication.

The disclosure at the arbitration hearing was also permitted as the complainant's counsel did not object, constituting implied consent.

The investigation concluded that all disclosures were in accordance with section 32 of the Act.

The complainant, a student, alleged that the school board breached the Municipal Freedom of Information and Protection of Privacy Act by disclosing her address and telephone number to her mother without consent.

The Assistant Commissioner found that the address and telephone number constituted personal information.

However, because the Education Act entitles parents of a minor to examine the Ontario Student Record, the disclosure of the address was authorized under section 32(e) of the Act.

The Assistant Commissioner noted that the disclosure of the telephone number, despite an agreement not to do so, was not in keeping with the spirit of the Act, and made recommendations regarding confidentiality procedures.

The complainant alleged that the Ministry of Consumer and Commercial Relations breached the Freedom of Information and Protection of Privacy Act during an internal investigation into a sexual harassment complaint against the complainant.

The Assistant Commissioner found that the harassment complaint and related correspondence contained the complainant's personal information.

While disclosures to the Deputy Minister, the investigator, and the aggrieved employee's supervisor were authorized under section 42(d), disclosures to the Acting Director and Human Resources Director were not.

The disclosure of the complainant's address to the aggrieved employee was also unauthorized.

However, the Ministry was found to have taken reasonable steps to ensure the accuracy of the information before using it in the investigation report.

An employee of the Ministry of the Solicitor General and Correctional Services complained that a Senior Assistant Superintendent contacted his physician to request an update on his medical certificate without his consent.

The Information and Privacy Commissioner investigated whether this collection of personal information violated the Freedom of Information and Protection of Privacy Act.

The Assistant Commissioner found that while the collection of the medical information was necessary for the lawfully authorized activities of employee management and human resources planning under section 38(2), the indirect collection directly from the physician without the employee's consent violated section 39(1) of the Act.

The Ministry was recommended to ensure staff are aware that medical information must be collected directly from the employee unless consent or an exemption applies.

The complainant alleged that the Ministry of Environment and Energy improperly disclosed his personal information in a publication and press release regarding his conviction for environmental offences.

The Assistant Commissioner found that the information was personal information and that section 37 of the Act did not apply.

However, the disclosure was found to be in accordance with section 42(c) of the Act, as it was for a consistent purpose reasonably compatible with the purpose for which the information was originally compiled by the court.

A self-employed individual complained that the Ministry of Finance's collection of their Social Insurance Number (SIN) on a registration form for the Employer Health Tax violated the Freedom of Information and Protection of Privacy Act.

The Assistant Commissioner found that the SIN was personal information, but its collection was necessary for the proper administration of a lawfully authorized activity, specifically auditing and ensuring taxpayer confidentiality.

The Assistant Commissioner also concluded that the Ministry provided proper notice of the collection.

The Ministry was found to be in compliance with the Act.

An employee of a municipal ambulance service filed a privacy complaint alleging that their supervisor and a staff psychologist improperly collected and disclosed their personal medical information to the Workers' Compensation Board (WCB) and to each other.

The Assistant Commissioner found that while the collection of information and the psychologist's disclosure to the WCB were authorized, the supervisor's direct disclosure to the WCB and the psychologist's disclosure to the supervisor violated the Municipal Freedom of Information and Protection of Privacy Act.

The municipality was ordered to implement policies ensuring staff awareness of disclosure limits and proper documentation of security measures for supervisor logs.

The complainant alleged that a municipal Board of Education improperly disclosed his personal information by identifying him in a newspaper article as a frequent freedom of information requester.

The Assistant Commissioner found that the complainant's name, in the context of his access requests, constituted personal information under section 2(1) of the Municipal Freedom of Information and Protection of Privacy Act.

The Assistant Commissioner rejected the Board's argument that section 50(1) permitted the disclosure, concluding that the disclosure was not in accordance with the Act and recommending the Board update its policies.