INVESTIGATION REPORT
INVESTIGATION I93-029M
THE CITY
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning a named city (the City).
The complainant had filed an insurance claim with the City, concerning damage to his compact disc player which he stated had been caused by vibrations from machinery used by the City to repair a watermain break. He had then submitted a claim to the City's insurance adjustors. His claim was denied.
The complainant then made freedom of information access requests under the Municipal Freedom of Information and Protection of Privacy Act (the Act).
He also appealed the denial of his insurance claim by the insurers to the City's Board of Control. In determining the appeal, the Board of Control had before it, a staff report from the City's Manager of Insurance/Risk Administration and the City Treasurer. Based on these individuals' recommendation, the Board of Control denied the appeal.
The complainant contended that the City used his access requests, to cause his insurance claim against the City to be denied by its Board of Control.
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,
(B) Did the City use the personal information, when considering the complainant's insurance claim, in accordance with section 31 of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?
Section 2(1) of the Act states in part:
"personal information" means recorded information about an identifiable individual, including,
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
The staff report contained the complainant's name and address together with the information that he had filed an access request under the Act.
The access request itself contained the complainant's name, address and telephone number together with other information about his request.
It is our view that the information contained in the staff report and the access request met the requirements of paragraphs (d) and (h) of the definition of "personal information" in section 2(1) of the Act.
Conclusion: The information contained in the staff report and the access request was personal information as defined in section 2(1) of the Act.
Issue B: Did the City use the personal information, when considering the complainant's insurance claim against the City, in accordance with section 31 of the Act?
Section 31 of the Act states:
An institution shall not use personal information in its custody or under its control except,
(a) if the person to whom the information relates has identified that information in particular and consented to its use;
(b) for the purpose for which it was obtained or compiled or for a consistent purpose; or
(c) for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act, 1987.
When the City's Board of Control considered the complainant's appeal, it had before it the staff report which included the following paragraph:
"To date, [the complainant] has filed a number of facsimiles concerning this claim to various departments of the City and [named individual], the City's insurance adjuster. Included in those facsimiles was a request for information under the Freedom of Information and Privacy Protection Act [sic]. That request has been denied by the City's Legal Department on the basis of solicitor client privilege and a letter informing [the complainant] of that denial was sent to him May 4, 1993." [emphasis added]
The City stated that it had relied upon section 31(b) of the Act for its use of the complainant's personal information. Section 31(b) permits the use of personal information for the purpose for which it has been obtained or compiled. The City stated that any personal information relating to the complainant was used only for the purpose for which it was obtained, namely, consideration by its Board of Control of the complainant's appeal from the denial of his claim by the City's insurance adjustors.
It is our view that while it does not appear that the complainant's personal information in the access request itself was used by the City, the personal information contained in the staff report i.e. that the complainant had made an access request and had been denied access, was used by the Board of Control in its consideration of the complainant's appeal in the insurance claim.
In our view, the City would have obtained or compiled the complainant's personal information relating to his access request for the purpose of administering the access request. However, the City used this personal information when it was included in the staff report to consider the complainant's appeal of the denial of his insurance claim. In our view, therefore, it cannot be said that the City used the complainant's personal information relating to his access request for the purpose for which this information had been obtained or compiled.
Section 32(c) of the Act also states that personal information may be used for a "consistent purpose". Section 33 further provides that:
The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31(b) and 32(c) only if the individual might reasonably have expected such a use or disclosure.
However, the personal information about the complainant's access request contained in the staff report was indirectly collected. In this case, a consistent purpose would be one that was "reasonably compatible" with the purpose for which the personal information had been obtained. In our view, the City's use of the complainant's personal information relating to his access request in its consideration of the appeal of the insurance claim was not reasonably compatible with the purpose for which the personal information had been collected.
In our view, the City did not use the complainant's personal information either for the purpose for which it had been obtained or compiled or for a consistent purpose. Therefore, the City's use of the complainant's personal information about his access request was not in accordance with section 31(b).
We also examined sections 31(a) and 31(c) of the Act but found that neither applied to the City's use of the complainant's personal information.
Conclusion: The City's use of the complainant's personal information about his access request, when it considered his appeal of the denial of the insurance claim, was not in accordance with section 31 of the Act.
SUMMARY OF CONCLUSIONS
The information contained in the staff report and in the access request was personal information as defined in section 2(1) of the Act.
The City's use of the complainant's personal information about his access request, when it considered his appeal of the denial of the insurance claim, was not in accordance with section 31 of the Act.
RECOMMENDATION
We recommend that the City take steps to ensure that personal information is used in accordance with the Act, for example, the City might wish to amend any existing guidelines or procedures on this matter and to inform all appropriate staff accordingly.
Within six months of receiving this report, the City should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.
Original signed by: February 1, 1994
Susan Anthistle Date
Compliance Review Officer