ORDER 29
Appeal 880079
Ministry of Health
Appeal Number 880079
O R D E R
This appeal was received pursuant to subsection 50(1) of the Freedom of Information and Protection of Privacy Act, 1987 (the "Act"), which gives a person who has made a request for access to personal information under subsection 48(1) of the Act a right to appeal any decision of a head to the Commissioner.
The facts of this case and the procedures employed in making this Order are as follows:
- On February 10, 1988, a request was made to the Ministry of Health (the "institution") for the following:
"...je demande à recevoir par la poste copie entière, complète et lisible de tous les documents, de quelque nature que ce soit, qui concernent ma personne et qui sont en possession de votre ministère et de la Régie de l'assurance _ maladie de l'Ontario, dans quelque banque de renseignements personnels que ce soit.
Entre autres, je demande les renseignements personnels contenus dans les banques suivantes: dossier de référence des réclamations médicales; correspondance, personnes assurées et public; système administratif de l'immatriculation; comptes à recevoir; correspondance, médecins".
Translation
"...I would like to receive by mail a complete and legible copy of all personal information concerning me, regardless of its nature, contained in any personal information banks in the possession of your ministry and the Ontario Health Insurance Plan (OHIP).
As well, I request access to personal information contained in the following information banks: Medical Claims Reference File (CREF); Correspondence _ Insured Persons and General Public; Enrolment _ Subscriber Administration System (SAS), OHIP _ Accounts Receivable, Correspondence _ Physicians and Practitioners.
- By letter dated March 16, 1988, the institution notified the requester that access to the records requested would be granted.
This letter further advised that "it is our practice to disclose personal information to the individual in person in order to protect the individual's privacy and maintain confidentiality. Therefore, please phone our office collect in order to make arrangements for you to pick up your records from our office or another government office nearest your location. It is required that you obtain your records personally by providing a photo identification (ie. driver's license, passport) and signing a release form. Please contact this office for the necessary arrangements".
By letter dated March 22, 1988, the institution advised the requester that the records were at the Ministry of Health's Oshawa office, and that upon his attendance at that office, with photo identification and the letter, he would receive the records.
The institution has advised me that on March 25, 1988, the requester spoke to the manager of customer services at the institution's Oshawa District office, and objected to being asked to come to that office to pick up the requested records.
By letter to me dated April 6, 1988, the requester appealed the institution's decision that required him to travel to Oshawa in order to receive access to the requested records. The requester reiterated his request to receive the records by mail.
On April 19, 1988, I gave notice of the appeal to the institution.
Between April 12, 1988 and June 6, 1988, efforts were made by my office to settle this appeal. Arrangements were made by the institution for the records to be available for pick up by the appellant at the Port Hope office of another institution. The appellant still objected to having to show identification with a photo and stated that he had no such identification.
The institution agreed not to insist on photo identification but still required the personal attendance of the appellant with some other form of identification, such as a social insurance card or an OHIP card. This arrangement was not acceptable to the appellant who insisted on receiving the records by mail.
On June 23, 1988 and June 24, 1988, respectively, I sent notice to the institution and the appellant that I was conducting an inquiry to review the decision of the head. Accompanying these letters was an Appeals Officer's Report.
By letter dated July 18, 1988, the appellant and the institution were invited to submit written representations to me on the issues arising from the appeal.
I received written representations from the institution. To the date of this Order, no representations have been received from the appellant, although the appellant acknowledged receipt of my letter of July 18, 1988.
As I felt that the issue in this appeal was of general interest to all institutions, I invited the Management Board of Cabinet, Freedom of Information and Privacy Branch to make written representations in this appeal. The Branch chose not to do so.
At issue in this appeal is whether personal attendance and verification of the identity of the requester, prior to the release of personal information, are reasonable requirements imposed by the institution.
The right of the appellant to obtain access to personal information about himself, held by the institution, is not at issue in this appeal. The institution has agreed to provide the appellant with full access to the records he requested.
One of the purposes of the Act is "to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information" (subsection 1(b)). The right of an individual to obtain access to his or her personal information in the custody or under the control of an institution is provided for in subsection 47(1) of the Act.
The Act protects personal information by requiring government institutions to follow strict guidelines on the collection and use of such information and by prohibiting, subject to certain specified exceptions, its disclosure to anyone other than the individual to whom it relates.
By its very nature a request for access to personal information places a high level of responsibility on the institution. In order to protect the privacy of the individual to whom the information relates, the institution must take steps to ensure, as best it reasonably can, that the requester is indeed the person whom he or she purports to be. The institution must then provide access to the personal information in a manner that is not unnecessarily restrictive.
In view of the fact that requests for personal information under the Act occur frequently, and that the Act gives little guidance as to the manner in which access is to be afforded, I will include in this Order some general remarks which I hope will be of use to institutions dealing with such requests.
Verification of the Identity of the Requester
Upon receipt of a request for personal information under subsection 48(1) of the Act, the institution must take steps to satisfy itself that the requester is the person to whom the personal information relates. The institution must be ever mindful of its responsibilities with respect to privacy protection.
The responsibility for verifying the identity of the requester of personal information can be fulfilled using more than one technique. An institution is in the best position to determine, on a case_by_case basis, what it will take to satisfy itself as to a requester's identity. Each institution must give serious thought to the manner by which it verifies the identity of a requester.
An obvious preliminary step involves comparing identifying information on the request form itself with information that is in the institution's possession. Spelling of names, address, telephone number, signature, handwriting, etc. should be reviewed and compared with the information that an institution may have on file. Any discrepancies should trigger further inquiry.
Even when a check of the identifying information on a written request form with that in the institution's possession reveals no discrepancies, I recommend that at least one additional step in verifying the identity of the requester is appropriate. The nature of this step will vary given the particular circumstances of the request and/or the institution involved. An example of the type of verification I am suggesting is questioning a requester on unique personal information contained in a record itself. For some institutions this may involve simply verifying identifying numbers used by the institution. For example, the Ministry of Health, in this appeal, verified the identity of the requester by asking for his OHIP number. Other techniques may be developed that will accommodate the needs of both the requester and the institution.
One of the most reliable ways to verify the identity of a requester is to require his or her personal attendance and the presentation of some document of identification. My concern with this method is that it may be an overly restrictive requirement that would place barriers on an individual's right to access. Further, there are many individuals who do not possess photo identification and/or identification with a signature. For these reasons, personal attendance should not be the standard form of verification used by an institution.
There may be cases where an institution is highly suspicious of the requester's identity or where discrepancies have arisen while verifying identity through other means. In these situations, I feel that an institution must take whatever reasonable steps it believes will satisfy itself as to the identity of the requester. This is especially true where the record in question contains particularly sensitive information.
In such a situation, a requirement of personal attendance may very well be the only reasonable way to verify identification.
Requesters should also be made aware of subsection 61(1)(c) of the Act which provides as follows:
No person shall,
make a request under this Act for access to or correction of personal information under false pretenses.
I suggest that reference to this offence provision be included and appear prominently on Form 2, the request for personal information form.
In the United States, various agencies require notarized signatures from requesters of personal information. I am of the view that if someone is prepared to use false pretenses in order to obtain information, not even the obtaining of a notarized signature will deter them. Actual contact by an institution and the asking of questions to satisfy the institution of the requester's identity may be a more effective deterrent to potential abuse of the Act.
Means by Which Access is Provided
Once the institution has verified the identity of the requester to a degree of certainty that is satisfactory given the nature of the record, the manner by which the personal information is actually provided to the requester should be at the requester's option.
The request form for access to personal information presently in use asks the requester whether he or she prefers to receive access by examining the record or by receiving a copy. I recommend that this form be amended to provide additional options to a requester who chooses to receive a copy of the record.
Clearly, personal attendance with verifying identification is the most onerous method by which a requester can obtain his or her personal information. It necessitates the requester being able to attend a government office during business hours and in person. This may be difficult, if not impossible, for people with physical limitations or those residing in rural areas which may be hundreds of miles from a government office. It is also the most secure method by which the personal privacy of the requester can be protected.
The least restrictive method of obtaining access is receiving the information by ordinary mail. This method raises concerns that the information may fall into the wrong hands and therefore poses the greatest risk to the requester's privacy.
There are other methods of access which fall between the extremes of the two methods set out above. In all cases, the inconvenience to the requester imports a corresponding benefit in terms of the security of the information and the consequent protection of the requester's privacy.
Requesters of personal information should be reminded that the record may reveal sensitive information and that their privacy rights in this information may be at risk, depending on the method of access chosen.
I recommend that the Box numbered 5 on the front page of the request for personal information form currently in use (Form 2) be amended using the type of language set out below:
- Preferred Method of Access
(Note: Please keep in mind that the information you are requesting may be highly sensitive and that the method of access you choose may place risks on your privacy.)
- Personal attendance: to examine
to receive copy
(greatest security associated with this option)
- Receive copy by delivery that requires
signature on receipt (courier, registered mail, priority post)
- Receive copy by ordinary mail
(least secure option)
- Other/to be arranged with Ministry
The explanatory note in the general information portion of the form should likewise be expanded to explain the choices given for access and the possible risks to privacy inherent in each choice.
The Circumstances of This Appeal
This appeal arises because, after considerable negotiation, the appellant refused to consider any method of delivery of his personal information other than by ordinary mail.
The institution has, in my view, demonstrated a caution which is entirely appropriate given the fact that the records in question are personal health records. The institution has also demonstrated a commendable flexibility in coming to a compromise as to type of identification required and in not insisting that the appellant attend at one of its own offices but rather at an office of another institution located in the area in which the appellant lives. This did not satisfy the appellant.
The institution has not raised the identity of the appellant as an issue and I believe that the institution is satisfied that the appellant is who he says he is. The appellant did provide his OHIP number to the institution on his original request form.
While I agree that personal information pertaining to health is, by its very nature, sensitive, I consider it appropriate, in this case, for the institution to send the information to the appellant in the manner requested by him. The appellant has put himself on public record as consenting to the transmission of his personal health information by ordinary mail and thereby assumes any potential risks to his privacy rights that may arise because of his choice.
Accordingly, I order that the institution send the personal information requested to the appellant by ordinary mail addressed to his post office box within 5 days of the date of this Order. The institution is further ordered to confirm to my office in writing, within 5 days of mailing the record to the appellant that it has complied with my Order.
Original signed by: December 15, 1988
Sidney B. Linden Date
Commissioner