INVESTIGATION REPORT

INVESTIGATION I94-030M

A BOARD OF EDUCATION

August 25, 1994

INTRODUCTION

Background of the Complaint

This investigation was initiated as a result of a complaint concerning a board of education (the Board).

The complainant had made a request for access to information under the Municipal Freedom of Information and Protection of Privacy Act (the Act), with the Board's Freedom of Information and Privacy Co-ordinator (Co-ordinator). The access request form contained the complainant's name, address, unlisted telephone number and a description of the general records requested. The complainant maintained that this information was disclosed by facsimile to the principal of the high school where the requested information was held. The complainant was concerned that both the transmission of this information by facsimile and its disclosure to the principal were contrary to the Act.

Further, the principal of the high school had telephoned the complainant and had asked why he required the information and if he had a student in the school. The complainant made it clear that he did not wish to discuss the matter, and did not answer the questions. The complainant was concerned that if the principal had collected this information, the collection would have been contrary to the Act.

Issues Arising from the Investigation

The following issues were identified as arising from the investigation:

(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,

(B) Was the Board's disclosure of the personal information in accordance with section 32 of the Act?

RESULTS OF THE INVESTIGATION

Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?

Section 2(1) of the Act states, in part:

"personal information" means recorded information about an identifiable individual, including,

(d) the address, telephone number, fingerprints or blood type of the individual,

(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

The access request form completed by the complainant included the complainant's name, address, and unlisted telephone number.

It is our view that this information met the requirements of paragraphs (d) and (h) of the definition of personal information, in section 2(1) of the Act.

Conclusion: The information in question was personal information as defined in section 2(1) of the Act.

Issue B: Was the Board's disclosure of the personal information in accordance with section 32 of the Act?

The complainant had made his request for information under the provisions of the Act, and had submitted it directly to the Co-ordinator's office. The information requested by the complainant was the number of teachers teaching the Ontario Academic Credit (OAC) course in Finite Mathematics at a particular school and the names of those teachers. Also requested was a copy of the most recent final examinations administered in the OAC Finite Mathematics course at that school.

The Board established that the information requested by the complainant was classified as general information maintained in "general files". The Board advised that it had a set procedure that was to be followed when such files were requested.

The Board pointed out that this procedure was outlined in a pamphlet entitled "Freedom of Information and Protection of Individual Privacy - Information about the (named) Board of Education", and in the forward to its "Directory of General Files and Personal Information Banks" (the Directory). The Board maintained that if the complainant had "... followed the process as outlined in the pamphlet and the directory, there would have been no problem".

We examined the pamphlet. It described two procedures for obtaining information from the Board. One could obtain information under previously established practices of the Board, or under a formal request for information under the Act.

The first procedure was described under the heading "Directory of Board Records". In this section, the Board stated that it had published the Directory which described the organization and responsibilities of each department, as well as the records maintained. The Board further stated:

Persons seeking access to recorded information about the (named) Board of Education should consult the directory to determine the location (department/school) of the desired information and then contact the person listed in the directory.

The person listed in the directory would then attend to the information requested. The pamphlet went on to state that if the "requester" was denied "access to information" and wished to request it under the Act, he or she was to contact the Co-ordinator, in order to complete the "required application".

The second procedure was described under the heading "Handling Requests for Information". In this section, the Board was referring to requests for information made under the Act. The Board stated, in the pamphlet, that the Act was not meant to change the established practice of granting information except to further ensure that private information was protected. The Board further stated that: "Employees must not grant or deny access to a record that has been requested under the Act", and that any time a request was received anywhere within the Board, the request was to be forwarded to the Co-ordinator. The Co-ordinator would then process the request.

Thus, the Board made a distinction between obtaining information through its established procedure versus making a request for information under the Act. It is our view that an individual had the choice of obtaining general records from the Board by using either of the Board's procedures. The Board maintained, however, that the complainant should have followed its established procedure by contacting the school principal directly rather than the Co-ordinator.

It is our view that once an individual had elected to make a request for information under the Act, the second procedure outlined in the pamphlet should have been followed. Therefore, although the Directory established that the information he sought was located at a particular high school and that the designated contact person was the principal, the complainant appropriately made his request directly to the Co-ordinator.

Under the Act, an institution shall not disclose personal information except in the circumstances outlined in section 32.

The Board stated that it had relied specifically on section 32(d) of the Act for the disclosure of the complainant's personal information. Section 32(d) states:

An institution shall not disclose personal information in its custody or under its control except,

(d) if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution's functions;

When the Co-ordinator received the complainant's access request under the Act, she forwarded the complainant's completed access request form to the principal of the school where the requested information was held. This form contained the complainant's personal information i.e., his name, address and unlisted telephone number.

One of the duties of the principal was to assist in the processing of the access request by compiling the records responsive to the request. However, it is our view that it was not necessary for the principal to have the complainant's personal information in order for him to perform this duty. It is, therefore, our view that the Board's disclosure of the complainant's personal information to the principal was not in accordance with section 32(d) of the Act.

We examined the remaining provisions of section 32 and found that none applied.

Conclusion: The Board's disclosure of the complainant's personal information was not in accordance with section 32 of the Act.

Other Matters

We wish to draw attention to the following:

Attempted Collection of Personal Information

As previously mentioned, when the principal received the access request from the Co-ordinator, he telephoned the complainant and asked why he required the requested information and if he had a student in the school. Since the complainant did not wish to discuss the matter, he did not answer the questions. The complainant was concerned that had he answered the questions, the Board's collection of this personal information would have contravened the Act.

Section 28(2) of the Act states:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. (emphasis added)

In our view, the processing of a request for access to information under the Act is a lawfully authorized activity. However, it is also our view that the principal would not have required the additional information in assisting in the processing of the request and therefore, the collection of this personal information would not have been in accordance with section 28(2) of the Act, as it would not have been "necessary" to the proper administration of a lawfully authorized activity.

Facsimile Transmission of the Access Request

Since this complaint concerned the disclosure of personal information through the facsimile transmission of the access request form, we wished to remind the Board of our facsimile transmission guidelines. Accordingly, we enclosed with our draft report, a copy of the following documents: "Guidelines on Facsimile Transmission Security, June 1989" and an "Update on 1989 Guidelines on Facsimile Transmission Security, June 1990".

"Freedom of Information and Protection of Individual Privacy" Pamphlet

In Issue B, we reviewed the two procedures that the Board had described in its pamphlet for obtaining information under its custody and control. We found that the Board made a distinction between obtaining information through its established procedure versus making a request for information under the Act. However, the distinction was not very clear due to the language the Board used in describing its established procedure. For example, the Board used the terms "requester" and "access to information"; terms which are normally used when referring to the access procedure under the Act. And, when the Board did in fact refer to the access procedure under the Act, it did so by using the term "required application", which is not normally associated with the Act.

It is also our view that some of the confusion regarding the two procedures might have stemmed directly from the title of the pamphlet itself, since one might assume from its title that all of the pamphlet's contents dealt with procedures under the Act.

Further, in its description of the sections of the Act that concern collection, use, disclosure, and retention of personal information, the pamphlet listed as a general rule, three exceptions relating to the use and disclosure of personal information. Under the Act, there are more than three exceptions allowing for the disclosure of personal information and different exceptions apply to use and to disclosure.

SUMMARY OF CONCLUSIONS

• The information in question was personal information as defined in section 2(1) of the Act.

• The Board's disclosure of the complainant's personal information was not in accordance with section 32 of the Act.

RECOMMENDATIONS

1. The Board should take steps to ensure that when it receives an access request under the Act for general records maintained in another location, the written request is not sent to the other location by facsimile or other means, unless all personal identifiers have been removed (e.g., name and address). We would like to refer the Board to the enclosed copy of "IPC Practices", entitled "Maintaining the Confidentiality of Requesters and Privacy Complainants".

2. The Board should consider updating its pamphlet to ensure that its procedures for obtaining information in its custody and control are more clearly defined. Specifically, the Board should ensure that the language which is normally associated with making an access request under the Act is not used to describe the Board's alternative procedure for obtaining general records. Reference should also be made to the Act rather than Bill 49, when discussing the procedure for an access request under the Act.

The Board should consider other changes to the pamphlet such as a clarification of the use and disclosure exceptions.

3. The Board should remind staff involved in the processing of requests for general records (either under the Act or through the Board's "established practices") to collect only personal information which is necessary to process the request.

Original Signed by: August 25, 1994

Susan Anthistle Date

Compliance Review Officer