INVESTIGATION REPORT
INVESTIGATION I94-067P
MINISTRY OF THE ATTORNEY GENERAL
January 4, 1995
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning the Ministry of the Attorney General (the Ministry).
The complainant was employed at a Regional Centre of the Ministry of Community and Social Services (MCSS). He was a "surplus" employee and was involved in the Ontario government's redeployment process. As a part of this process, Management Board Secretariat matched the complainant's employment "profile" with respect to a vacancy and sent it to the Ministry's Human Resources Branch. The Branch in turn faxed the complainant's profile and that of another individual to the Court Services Manager at a named Ministry courthouse for his consideration.
According to the complainant, an employee at the courthouse subsequently disclosed to staff at the Regional Centre that she had read the faxed materials, and that the complainant and the other individual had secured positions with the courthouse through the redeployment process.
When the complainant became aware of this disclosure, he contacted the appropriate staff in the Redeployment Unit at the Regional Centre. They did not know about the match. A few days later, however, it became apparent that the complainant was being considered for a position at the courthouse.
The complainant was concerned that the Ministry employee had disclosed his personal information contrary to the provisions of the Freedom of Information and Protection of Privacy Act, (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,
(B) Was the Ministry's disclosure of the personal information in compliance with section 42 of the Act?
(C) Did the Ministry take reasonable measures to prevent unauthorized access to records?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?
Section 2(1) of the Act defines "personal information", in part, as:
recorded information about an identifiable individual, including
(h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
The information in question included the complainant's profile containing his name together with other information about him, and the information that he was being considered for assignment with the Ministry. It is our view that this information met the requirements of paragraph (h) of the definition of "personal information" in section 2(1) of the Act.
Conclusion: The information was the complainant's personal information, as defined in section 2(1) of the Act.
Issue B: Was the Ministry's disclosure of the personal information in compliance with section 42 of the Act?
Section 42 of the Act sets out the conditions for the disclosure of personal information. This section provides that an institution shall not disclose personal information in its custody or under its control except in specific circumstances. (The full text of section 42 is given in Appendix A.)
The Ministry informed us that the appropriate Regional Director for courts administration had initiated an internal investigation to address the complainant's concerns about the disclosure of his personal information by a named Ministry employee.
The Ministry stated that the employee, who the complainant believed had disclosed his personal information to MCSS Regional Centre staff, was the local union steward. The Ministry found that she had become involved when she had been told by courthouse staff about the contents of the fax. She had then discussed with the Court Services Manager, the staff's concerns that their jobs might be "threatened" by the proposed assignments.
The Ministry concluded in its internal investigation that it was "likely that the disclosure of the information regarding the assignment of the surplus staff may have originated from the courthouse, however, the actual source is unidentifiable due to conflicting statements of those questioned" during its investigation. The Ministry also stated that it was also evident that "the disclosure of personal information by the courthouse staff resulted in an unjustified invasion of the personal privacy of the complainant."
Having considered the information provided by the complainant and the Ministry, it is our view that there was a disclosure of the complainant's personal information by courthouse staff to the Ministry employee named by the complainant. It is also our view that there was also a disclosure to staff at the MCSS Regional Centre but we are unable to say conclusively that it was the named employee who made this disclosure.
We have examined the provisions of section 42 of the Act, however, and it is our view that none were applicable to the Ministry's disclosures of the complainant's personal information.
Conclusion: The Ministry's disclosures of the complainant's personal information were not in compliance with section 42 of the Act.
Issue C: Did the Ministry take reasonable measures to prevent unauthorized access to records?
The Ministry found in its internal investigation that its Human Resources Branch had to fax the complainant's profile to the Court Services Manager because the Ministry had only 48 hours to review, accept or reject candidates for assignments. The Ministry concluded that the sender of the fax, however, did not call ahead to ensure that the addressee would be available or sever personal identifiers from the document before it was sent.
The Ministry also found that the fax machine at the court house was accessible to all courthouse staff. In this case, although the fax was addressed to the Court Services Manager, employees in the courthouse apparently had access to and knew of the information contained in the fax before the Manager did. The Ministry informed us that "unofficial" word spread that the complainant and the other individual had received assignments to the courthouse.
The Ministry stated that it was evident that "personal information about an individual was faxed to the courthouse by the Human Resources Branch of the Ministry and necessary precautions were not taken before the information was faxed."
Section 4(1) of Regulation 460 under the Act states:
Every head shall ensure that reasonable measures to prevent unauthorized access to records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.
We were informed by the Ministry that there was only one fax machine at the courthouse, located in a central, open area accessible to all courthouse staff and that any one of the courthouse staff could take incoming correspondence from the fax machine.
Our office's "Guidelines on Facsimile Transmission Security" provides information on security measures for the transmission of faxes. It advises, for example, that one person should be identified as responsible for all fax operations. The fax machine should be located so that it is not in a public area, its use can be monitored by the responsible person, and only authorized staff can have access to the information transmitted on the fax.
The Ministry did not have these or any other measures to prevent unauthorized access to faxed documents. It is our view, therefore, that the Ministry did not ensure that reasonable measures were defined, documented and put in place to prevent unauthorized access to records, in compliance with section 4(1) of Regulation 460.
Conclusion: The Ministry did not take reasonable measures to prevent unauthorized access to records.
SUMMARY OF CONCLUSIONS
The information was the complainant's personal information, as defined in section 2(1) of the Act.
The Ministry's disclosures of the complainant's personal information were not in compliance with section 42 of the Act.
The Ministry did not take reasonable measures to prevent unauthorized access to records.
RECOMMENDATIONS
The Ministry informed us that it planned to implement the following measures to ensure that similar disclosures did not occur in future.
To conduct a training and awareness session at the courthouse to ensure that staff are aware of and understand the privacy provisions of the Act, in carrying out their responsibilities.
To develop internal privacy guidelines to reinforce the responsibilities of staff in terms of privacy.
To review the fax procedures at the courthouse and make necessary changes to deal with the receipt and distribution of incoming faxes which contain personal information.
To review our office's "Guidelines on Facsimile Transmission Security" with the courthouse staff.
In addition, the Ministry advised that the Human Resources Branch had already implemented a procedure to telephone and notify the intended recipient ahead of time, if personal information was being faxed. In conjunction with this procedure, the fax sheet had been amended to clearly note "PERSONAL AND CONFIDENTIAL".
We, therefore, recommend that the Ministry implement its planned measures to prevent similar improper disclosures of personal information in future.
Within six months of receiving this report, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.
Original signed by: January 4, 1995
Susan Anthistle Date
Compliance Review Officer
APPENDIX A
- An institution shall not disclose personal information in its custody or under its control except,
(a) in accordance with Part II;
(b) where the person to whom the information relates has identified that information in particular and consented to its disclosure;
(c) for the purpose for which it was obtained or compiled or for a consistent purpose;
(d) where disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and where disclosure is necessary and proper in the discharge of the institution's functions;
(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament or a treaty, agreement or arrangement thereunder;
(f) where disclosure is by a law enforcement institution,
(i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or
(ii) to another law enforcement agency in Canada;
(g) where disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;
(h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;
(i) in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;
(j) to a member of the Legislative Assembly who has been authorized by a constituent to whom the information relates to make an inquiry on the constituent's behalf or, where the constituent is incapacitated, has been authorized by the next of kin or legal representative of the constituent;
(k) to a member of the bargaining agent who has been authorized by an employee to whom the information relates to make an inquiry on the employee's behalf or, where the employee is incapacitated, has been authorized by the next-of-kin or legal representative of the employee;
(l) to the responsible minister;
(m) to the Information and Privacy Commissioner; and
(n) to the Government of Canada in order to facilitate the auditing of shared cost programs.