INVESTIGATION REPORT
INVESTIGATION I94-031M
A PUBLIC BOARD OF EDUCATION
October 28, 1994
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning a Board of Education (the Board).
The complainant was an employee of the Board who had applied for the position of Office Manager/Secretary to the Superintendent of Business Affairs (the Superintendent). The complainant and two other internal applicants were granted interviews, which were conducted by the Superintendent and two other Board employees.
The complainant stated that her name had been disclosed by the Superintendent to another internal applicant during that applicant's interview. The complainant also believed that her name and the names of the other internal applicants had been disclosed by the Superintendent during a social gathering (a coffee break) which included the Superintendent and more than one other employee who would not ordinarily have had access to information about job applicants.
The complainant, who was concerned with the fairness and integrity of the job competition, subsequently made a Freedom of Information (FOI) request by letter for the records of the job competition. Her request, eventually filled out on an FOI request form, as required by the Board, was dated approximately three weeks after the interviews were conducted; however, she had met with the Board's Director of Education two days after the interviews to present him with a draft copy of her letter and discuss her concerns about the interviews.
The letter containing her formal FOI request was submitted four working days after the interviews were completed. She was advised by the Board that virtually all of the records had already been destroyed, in accordance with the Board's practices. The complainant questioned why the records of the job competition were allowed to be destroyed when she had already made her concerns and requests for information known.
The complainant believed that the disclosure of information about herself and the other internal applicants breached the Municipal Freedom of Information and Protection of Privacy Act (the Act), and questioned whether the Board had acted in compliance with the Act when it destroyed the records of the job competition.
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information", as defined in section 2(1) of the Act? If yes,
(B) Was the complainant's personal information disclosed to another internal applicant in compliance with section 32 of the Act?
(C) Was the complainant's personal information disclosed during the social gathering to other employees in compliance with section 32 of the Act?
(D) Did the Board provide proper notice of collection of personal information for the job competition, in compliance with section 29(2) of the Act?
(E) Did the Board retain the personal information contained in the records of the job competition in compliance with section 30(1) of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information", as defined in section 2(1) of the Act?
Section 2(1) of the Act defines "personal information" as recorded information about an identifiable individual, including,
(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
In this case, the information in question was the complainant's and two other Board employees' names, together with the fact that these individuals were applicants for the position of Manager/Secretary to the Superintendent of Business Affairs.
We asked the Board for copies of the records related to the competition and the Board indicated that it had destroyed all resumes, covering letters, and interview notes, with the exception of one record. This record was entitled, "Report of Interviews for Secretary to Superintendent of Business Affairs" (the report).
It is our view that since the report named the complainant and two other Board employees, indicating that they were internal applicants, the information in question was the complainant's and the other internal applicants' "personal information", as defined in paragraph (h) of the definition of personal information in section 2(1) of the Act. It is also our view that the other records of the job competition, such as resumes and covering letters, would also have contained information that met the requirements of paragraph (h) of the definition of personal information in section 2(1) of the Act.
Conclusion: The information in question was the complainant's and the other applicants' "personal information", as defined in section 2(1) of the Act.
Issue B: Was the complainant's personal information disclosed to another internal applicant in compliance with section 32 of the Act?
Section 32 of the Act prohibits disclosure of personal information in the custody and control of an institution, unless one of the exceptions listed in sections (a) through (l) apply. (The full text of section 32 is given in Appendix A.)
The Superintendent stated that he had not disclosed the complainant's name to the other internal applicant, and another panel member agreed that he had not. However, the third panel member could not recall if such a disclosure had taken place or not. The other internal applicant believed that the complainant's name had been disclosed to her during her interview, and stated she was 95% certain of this.
In response to our draft report, the complainant stated that on the day of the interviews, one of the other internal applicants had informed her that the Superintendent had disclosed the complainant's name during the other internal applicant's interview.
In the face of this conflicting information, we are unable to conclude whether the complainant's personal information had been disclosed to another applicant. However, it is our view that if such a disclosure had taken place, it would not have been in compliance with section 32 of the Act, since none of the exceptions listed in section 32 would have applied.
Conclusion: We are unable to conclude whether the complainant's personal information was disclosed to another internal applicant.
Issue C: Was the complainant's personal information disclosed during the social gathering to other employees in compliance with section 32 of the Act?
The Superintendent acknowledged that casual conversations on the subject of the job competition had taken place at the Board offices, for example during coffee breaks, and that the names of the internal applicants were common knowledge amongst the staff. However, he denied that he had disclosed the names of the internal applicants at such a gathering and indicated that the staff often discussed matters of a highly personal nature at their coffee breaks. Other than the complainant's statement, we received no information to show that a disclosure of the applicants' names by the Superintendent had actually taken place.
In response to our draft report, the complainant stated that she had not disclosed the fact that she had applied for the position to any of her co-workers, nor had she known who the other internal applicants were until the Superintendent told her. She questioned who could have disclosed this information, since the applications had been sent directly to the Superintendent. She also added that a co-worker was prepared to come forward to support her statement that the Superintendent had, in fact, disclosed her name at the coffee break.
After considering the above information, we are unable to conclude whether the complainant's personal information had actually been disclosed to other employees by the Superintendent. However, it is our view that had the Superintendent made such a disclosure, it would have breached section 32 of the Act, since none of the exceptions listed would have applied.
Conclusion: We are unable to conclude whether the complainant's personal information was disclosed to other employees during the social gathering.
Issue D: Did the Board provide proper notice of collection of personal information for the job competition, in compliance with section 29(2) of the Act?
We examined the Board's notice of collection as provided on the job posting. The notice states:
The Board is authorized to receive and maintain personal information contained in any application for this position under the authority of the Education Act. Such information will be used to determine eligibility for employment and if hired for the purposes consistent with and necessary for the proper administration of an employer-employee relationship. Applications received from persons not hired will be destroyed and the personal information will not be transferred to a personal information bank.
Section 29(2) of the Act states:
If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,
(a) the legal authority for the collection;
(b) the principal purpose or purposes for which the personal information is intended to be used; and
(c) the title, business address and business telephone number of an officer or employee of the institution who can answer the individual's questions about the collection.
The Board's legal authority for the collection was not stated in a specific manner (i.e. applicable section of the Education Act) and the title, business address and business telephone number of an officer or employee who can answer questions about the collection were not included in the notice. Therefore, it is our view that the Board's notice of collection did not comply with sections 29(2)(a) and (c) of the Act.
Conclusion: The Board did not provide proper notice of collection of personal information for the job competition in compliance with section 29(2) of the Act.
Issue E: Did the Board retain the personal information contained in the records of the job competition in compliance with section 30(1) of the Act?
Section 30(1) of the Act states:
Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information.
Section 5 of Ontario Regulation 823 states:
Personal information that has been used by an institution shall be retained by the institution for the shorter of one year after use or the period set out in a by-law or resolution made by the institution or made by another institution affecting the institution, unless the individual to whom the information relates consents to its earlier disposal.
In the circumstances of this case, the records of the job competition were apparently destroyed a short time after they were used for the job competition. It is our view that such a short time period would not have provided any of the applicants with a reasonable opportunity to obtain access to their personal information.
The Board provided no information to show that a by-law or resolution existed authorizing the destruction of the job competition records before the one-year minimum time period had expired. Accordingly, we are of the view that the records of the job competition were not retained in compliance with the Act.
Conclusion: The Board did not retain the personal information contained in the records of the job competition in compliance with section 30(1) of the Act.
Other Matters
During the course of this investigation, the following matter was identified which we wish to bring to the Board's attention:
Disclosure Relating to Other Job Applicants
The complainant stated, that prior to her interview, during a meeting with her, the Superintendent had disclosed the names of two other internal candidates to her, and had commented on the experience of one of the applicants and the reasons why the other applicant had applied. The complainant further alleged that during her interview, the names of these two internal applicants were again disclosed to her by the Superintendent.
The Superintendent acknowledged that he had spoken to the complainant about only one of the other applicants at a meeting prior to the interviews taking place. He stated that he had named one of the two other internal candidates and had commented on her experience.
Of the two other members of the interview panel, one member could not recall if there had been a disclosure of the names of the other internal applicants during the complainant's interview, but the other member stated that there had been a disclosure of the name of one of them.
The Superintendent stated that after the privacy complaint had been filed, he had approached the applicant (not the complainant), with a view to apologizing to her for invading her privacy. However, the applicant indicated to him that she had made no secret of her candidacy for the position, and that she did not feel that her privacy had been breached.
We have examined the provisions of section 32 of the Act and it is our view that none of the exceptions would have applied to the above disclosure. The disclosure, therefore, breached the Act.
SUMMARY OF CONCLUSIONS
The information in question was the complainant's and the other applicants' "personal information", as defined in section 2(1) of the Act.
We are unable to conclude whether the complainant's personal information was disclosed to another internal applicant.
We are unable to conclude whether the complainant's personal information was disclosed to other employees during the social gathering.
The Board did not provide proper notice of collection of personal information for the job competition in compliance with section 29(2) of the Act.
The Board did not retain the personal information contained in the records of the job competition in compliance with section 30(1) of the Act.
RECOMMENDATIONS
The Board should incorporate the following recommendations into its procedures:
the Board should provide proper notice to job applicants in compliance with section 29(2) of the Act when it collects personal information for job competitions;
the Board should retain records of personal information collected for job competitions in compliance with section 30(1) of the Act;
the Board should remind all staff that the names of job applicants should not be disclosed to other employees unless one of the exceptions in section 32 of the Act applies.
Within six months of receiving this report, the Board should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.
Original signed by: October 28, 1994
Susan Anthistle Date
Compliance Review Officer
Appendix A
- An institution shall not disclose personal information in its custody or under its control except,
(a) in accordance with Part I;
(b) if the person to whom the information relates has identified that information in particular and consented to its disclosure;
(c) for the purpose for which it was obtained or compiled or for a consistent purpose;
(d) if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution's functions;
(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act or treaty;
(f) if disclosure is by a law enforcement institution,
(i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or
(ii) to another law enforcement agency in Canada;
(g) if disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;
(h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification is mailed to the last known address of the individual to whom the information relates;
(i) in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;
(j) to the Minister
(k) to the Information and Privacy Commissioner;
(l) to the Government of Canada of the Government of Ontario in order to facilitate the auditing of shared cost programs.