INVESTIGATION REPORT
INVESTIGATION I93-085P
MINISTRY OF THE SOLICITOR GENERAL AND CORRECTIONAL SERVICES
February 18, 1994
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning the Ministry of the Solicitor General and Correctional Services (the Ministry).
The complainant, an employee of the Ministry, was absent from work due to sickness for an extended period of time. The complainant provided the Ministry with a medical certificate shortly after his sick leave had commenced. After two and a half months, a Senior Assistant Superintendent (the Superintendent) from the Ministry, wrote a letter directly to the complainant's physician requesting an update to the medical certificate, without the complainant's consent.
The complainant was concerned about the collection of his personal information by the Superintendent from his physician, stating that it was contrary to the Freedom of Information and Protection of Privacy Act (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information", as defined in section 2(1) of the Act? If yes,
(B) Was the collection of the personal information in accordance with section 38(2) of the Act? If yes,
(C) Was the collection of the personal information in accordance with section 39(1) of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information", as defined in section 2(1) of the Act?
Section 2(1) of the Act states, in part:
"personal information" means recorded information about an identifiable individual, including,
(h) the individual's name where it appears with other personal information relating to the individual...
As previously mentioned, the Superintendent had written to the physician requesting an update to the complainant's medical certificate, an indication of the complainant's prognosis for a return to work, and any alternative duties that could be performed by the complainant pending his full recovery.
In our view, this information met the requirements in paragraph (h) of the definition of personal information in section 2(1) of the Act.
Conclusion: The information in question was personal information as defined in section 2(1) of the Act.
Issue B: Was the collection of the personal information in accordance with section 38(2) of the Act?
Section 38(2) of the Act states:
(2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. (emphasis added)
In our view, employee management and human resources planning are lawfully authorized activities of the Ministry.
Section 52.10 of the Collective Agreement between the Ontario Public Service Employees Union and the Crown in Right of Ontario allows the Ministry to collect from an employee, after five days absence caused by sickness, a medical certificate which certifies that the employee was unable to attend to his or her official duties. In our view, where the Ministry is permitted to collect such a medical certificate from an employee, it follows that the Ministry must also be permitted to request an update to that medical certificate from the employee, after an extended absence. Thus it is our view that the Ministry's collection of this personal information was necessary for employee management and human resources planning.
In this particular case, the Superintendent was seeking an update to the medical certificate that the complainant had provided two and a half months earlier. It is our view that this collection of the complainant's personal information was necessary to the proper administration of the lawfully authorized activities of employee management and human resources planning.
Therefore, in our view, the Ministry's collection of the information in question was in accordance with section 38(2) of the Act.
Conclusion: The collection of the personal information was in accordance with section 38(2) of the Act.
Issue C: Was the collection of the personal information in accordance with section 39(1) of the Act?
Under the Act, personal information shall only be collected by an institution directly from the individual to whom the information relates unless one of the exemptions in section 39(1) of the Act applies.
In this case, the Superintendent had written to the complainant's personal physician requesting an update on the complainant's medical status. The complainant had not consented to the Superintendent's collection of his personal information. In fact, he was not aware that the Superintendent had taken this action until he was informed of the matter by his physician. The Superintendent did not contact the complainant to collect the personal information in question. Therefore, the Superintendent's collection of the personal information in question was not made directly from the complainant.
We have examined the provisions of section 39(1) of the Act. It is our view that none of these provisions apply in the circumstances of this case. Therefore, the Ministry's indirect collection of the complainant's personal information was not in accordance with section 39(1) of the Act.
Conclusion: The indirect collection of the personal information was not in accordance with section 39(1) of the Act.
SUMMARY OF CONCLUSIONS
The information in question was personal information as defined in section 2(1) of the Act.
The collection of the personal information was in accordance with section 38(2) of the Act.
The indirect collection of the personal information was not in accordance with section 39(1) of the Act.
RECOMMENDATION
We recommend that the Ministry take steps to ensure that staff are made aware that personal information related to an employee's medical status may only be collected directly from the employee to whom the information relates, unless that employee has consented to the collection in accordance with section 39(1)(a) of the Act, or another provision of section 39(1) applies.
Within six months of receiving this report, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.
Original signed by: February 18, 1994 Ann Cavoukian, Ph.D. Date
Assistant Commissioner