Susan Anthistle

A nursing student filed a privacy complaint against a College of Applied Arts and Technology, alleging that her professor's anecdotal notes were prematurely destroyed and improperly secured.

The Information and Privacy Commissioner investigated and found that the anecdotal notes constituted personal information under the custody and control of the College.

The investigation concluded that the College failed to retain the notes for the mandatory one-year period required by Regulation 460, and failed to define and document reasonable measures to prevent unauthorized access.

The College was directed to amend its retention policies and implement documented security measures.

An individual complained that a Township disclosed his personal information contrary to the Municipal Freedom of Information and Protection of Privacy Act by selling copies of a police General Occurrence Report containing his statements.

The Compliance Review Officer found that the information was personal information and that its disclosure was not in accordance with section 32 of the Act, as the Township failed to consider the Act before disclosing the record under the Municipal Act.

The Township was recommended to establish written procedures for disclosing records containing personal information.

The complainant alleged that the Ministry of the Attorney General, Family Support Plan breached the Freedom of Information and Protection of Privacy Act by disclosing details of his support payments to his ex-wife.

The Information and Privacy Commissioner investigated and found that while the general ledger record contained the complainant's personal information, the disclosure was made for a consistent purpose under section 42(c) of the Act.

The purpose of disclosing the information to the ex-wife was reasonably compatible with the purpose for which the Family Support Plan obtained the information, which was to enforce the court order on her behalf.

The complainant, an employee of the Municipality, filed a complaint with the Information and Privacy Commissioner alleging that the Municipality improperly disclosed his Workers' Compensation Board (WCB) records to an insurance company.

The disclosure occurred during the insurance company's investigation of a civil suit filed by the complainant against the Municipality for a motor vehicle accident.

The Compliance Review Officer found that the WCB records and a 'Skills Inventory' record contained personal information under section 2(1) of the Municipal Freedom of Information and Protection of Privacy Act.

The Officer concluded that the disclosure to the insurance company was not for the purpose for which the information was obtained, nor for a consistent purpose, and therefore violated section 32 of the Act.

The Officer recommended that the Municipality ensure future disclosures comply with the Act and remind employees of facsimile transmission guidelines.

The complainant alleged that the Health Disciplines Board breached her privacy by disclosing her personal information, including medical records and correspondence, to the doctors she had complained about and their agent during a review hearing.

The Information and Privacy Commissioner investigated and found that while the file contained the complainant's personal information, the disclosure was made in accordance with section 42(c) of the Freedom of Information and Protection of Privacy Act.

The disclosure was for the purpose for which the information was obtained, namely to conduct a review and afford all parties a fair opportunity to present their case.

An employee of a Ministry of Health psychiatric hospital filed a privacy complaint after her medical certificate was disclosed to the Assistant Administrator, HR Administrator, and Legal Counsel.

The Compliance Review Officer found that the information was personal information under the Freedom of Information and Protection of Privacy Act.

The disclosure of the employee's name, date, and reason for absence to the administrators was authorized under section 42(d) as they needed it to verify her absence.

However, the disclosure of this information to Legal Counsel, and the disclosure of the physician's name and address to all three individuals, was not authorized as it was not needed in the performance of their duties.

The complainant alleged that a board of education improperly investigated her to determine her first name and sex, and subsequently disclosed this personal information to its law firm when responding to her access requests.

The Information and Privacy Commissioner investigated and found that the complainant had provided her first name in her own correspondence.

The disclosure to the law firm was found to be in accordance with section 32(c) of the Municipal Freedom of Information and Protection of Privacy Act, as the lawyer was acting as the interim Freedom of Information Co-ordinator and the disclosure was for the consistent purpose of responding to the access requests.

A hospital employee complained that the Ministry of Health was improperly storing and disclosing employee personal information, including injured worker records, pay stubs, and time sheets containing Social Insurance Numbers (SINs).

The Information and Privacy Commissioner investigated and found that the information constituted 'personal information' under the Freedom of Information and Protection of Privacy Act.

The disclosure of SINs to payroll staff was permitted, but disclosure to other departments and supervisors was not in accordance with the Act.

The Commissioner found that reasonable security measures were otherwise in place and recommended changes to the collection of time-worked information.

The complainant alleged that the Workers' Compensation Board improperly collected and disclosed personal information regarding her sexual life to her employer and former representative.

The Information and Privacy Commissioner investigated and found that the information was 'personal information' under the Freedom of Information and Protection of Privacy Act.

The Board had the authority to collect the information as it was necessary for a Non-Economic Loss assessment.

The disclosure to the employer was authorized by the Workers' Compensation Act, but the disclosure to the former representative was not authorized and breached the Act.

The Commissioner recommended procedural changes for updating representative information and mailing medical information.

An employee of a psychiatric hospital complained that her medical diagnosis was improperly disclosed to hospital staff during the process of arranging employment accommodation.

The Information and Privacy Commissioner investigated and found that the information was 'personal information' under the Freedom of Information and Protection of Privacy Act.

The Commissioner concluded that while disclosure to the Assistant Administrator was necessary and proper under section 42(d), disclosures to the Personnel department and the Director of Materials Management were not in accordance with the Act.

The Ministry was recommended to educate staff and establish guidelines for processing accommodation requests.

The complainant alleged that the Workers' Compensation Board improperly collected and disclosed personal information concerning her sexual life to her employer.

The information was contained in a psychiatrist's Non Economic Loss (NEL) Assessment.

The Information and Privacy Commissioner found that the information was personal information, but that the Board had the authority to collect it as it was necessary to assess the complainant's permanent impairment.

The Commissioner also found that the disclosure to the employer was authorized by the Workers' Compensation Act.

The Commissioner recommended that the Board use confidential envelopes when mailing medical information to employers.

An employer filed a privacy complaint against the Ontario Labour Relations Board after the Board disclosed lists of employees to a union during certification proceedings.

The Compliance Review Officer found that the employee lists constituted personal information under the Freedom of Information and Protection of Privacy Act.

However, the disclosure was permitted under section 42(c) of the Act because the Board obtained the lists for the purpose of reviewing the certification application, and disclosing them to the parties was consistent with that purpose.

An investigation was initiated following a complaint that the Ministry of the Solicitor General and Correctional Services collected and disclosed personal information regarding employee attendance and sick time without proper notice or authority.

The Compliance Review Officer found that the attendance review letters and summary list contained personal information.

The Officer concluded that the Ministry failed to provide adequate notice of collection to employees hired before the implementation of the Freedom of Information and Protection of Privacy Act, as relying on the Directory of Records was insufficient.

Furthermore, the disclosure of the summary list on a public notice board violated the disclosure provisions of the Act.

The Ministry was ordered to provide proper notice and update its policies.

An investigation was initiated into a complaint that a municipal city failed to provide proper notice for collecting personal information on its taxicab License Renewal Application, and lacked authority to collect financial and criminal record information.

The Compliance Review Officer found that the requested information was 'personal information' under the Municipal Freedom of Information and Protection of Privacy Act.

The collection of criminal record information and financial information from owners and lessee drivers was authorized as necessary for licensing administration.

However, collecting financial information from non-lessee drivers was not authorized.

The City also failed to provide proper notice of collection, though it subsequently corrected this omission.

The complainant, an employee of a mental health centre operated by the Ministry of Health, alleged that the Ministry improperly disclosed his personal information during a Workplace Discrimination and Harassment Prevention (WDHP) investigation in which he was the respondent.

The Information and Privacy Commissioner investigated four separate disclosures, including the sharing of the investigation summary report with management, the phrasing of interview questions, discussions with various individuals, and updates provided to the WDHP complainant.

The Compliance Review Officer concluded that while the records and discussions contained the complainant's personal information, all disclosures were made in accordance with sections 42(c) and 42(d) of the Freedom of Information and Protection of Privacy Act, as they were necessary for the performance of duties or for the purpose for which the information was obtained.

The complainant alleged that the Police Complaints Commissioner (PCC) breached her privacy by forwarding her complaint letter, which contained allegations against both police officers and doctors, to the College of Physicians and Surgeons of Ontario.

The Information and Privacy Commissioner investigated and found that the letter contained the complainant's personal information.

The disclosure of information relating to the doctors and the complainant's identity was found to be for a consistent purpose under section 42(c) of the Freedom of Information and Protection of Privacy Act.

However, the disclosure of information relating to the police and other unrelated matters was not for a consistent purpose and therefore breached the Act.

The Commissioner recommended that the PCC sever unrelated personal information when forwarding complaints to other bodies.

The complainant, a municipal fire fighter, alleged that the City disclosed an internal investigation report containing their personal information to the press, contrary to section 32 of the Municipal Freedom of Information and Protection of Privacy Act.

The Compliance Review Officer found that the report contained personal information.

However, because multiple individuals had access to the report and all denied leaking it, the Officer was unable to determine who disclosed the information to the press.

The Officer noted that if the City had disclosed it, such disclosure would have violated section 32.

The City agreed to implement new confidentiality guidelines for future internal investigation reports.

The complainant alleged that a Regional Police Service improperly disclosed her personal information, specifically the fact that she had made an access request and its details, during an internal investigation of a public complaint.

The Information and Privacy Commissioner investigated and found that the information constituted personal information.

The Commissioner concluded that the investigating officers learned of the access request from the complainant's own materials, not through an improper disclosure by the Police.

A disclosure to the officers' supervisor was found to be authorized under section 32(d) of the Municipal Freedom of Information and Protection of Privacy Act.

However, the Commissioner found that one superintendent improperly disclosed the access request to an inspector contrary to section 32.

No further recommendations were made as the Police had already changed their procedures.