Ministry of Community and Social Services (Re), 1995 CanLII 6814

INVESTIGATION I94-068P

INTRODUCTION

Background of the Complaint

This investigation was initiated as a result of a complaint concerning the Ministry of Community and Social Services (the Ministry).

The complainant, who is with the Adult Protective Association of Ontario, was concerned about the Ministry's collection of personal information from the files of developmentally challenged clients (the clients) served by the Adult Protective Services Program (APSP). The APSP is sponsored by Network North, a community mental health group which receives majority funding from the Ministry of Health. However, the APSP is funded by the Ministry.

The complainant advised that on two separate occasions, a Program Supervisor with the Ministry collected personal information from clients' files. On the first occasion, Network North's Adult Protective Service Workers (APSWs) received an internal memo asking for the names of and the services offered to Network North's clients. Each client was sent a form to sign, granting consent to the disclosure, transmittal or examination of their clinical records. The complainant stated that approximately seven clients did not return the consent form. The APSWs then completed summaries of the information requested for all the clients, but did not include the names of the seven clients who had not returned a signed consent form. The information was then forwarded to the Program Supervisor.

However, subsequently, despite the objection of an APSW, file summaries of the seven clients who had not signed consent forms, together with their names, were also forwarded to the Program Supervisor at his request. In the complainant's view, the collection of the personal information belonging to the seven non-consenting clients was not in compliance with the Freedom of Information and Protection of Privacy Act (the Act).

The complainant stated that a second collection took place when the Program Supervisor visited two Network North rural health clinics providing services to the clients, and conducted a file review without obtaining the clients' consent. The complainant further stated that an APSW attempted to address confidentiality concerns with the Program Supervisor but was informed that the APSWs would not be permitted to participate in the file review. Notes were taken by the Program Supervisor on a lap-top computer. The complainant felt that the Program Supervisor's collection of the clients' personal information without their consent was also not in compliance with the Act.

Issues Arising from the Investigation

The following issues were identified as arising from the investigation:

(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,

(B) Was the personal information collected in compliance with Section 38(2) of the Act?

(C) Did the Ministry provide notice of collection of clients' personal information, in compliance with section 39(2) of the Act?

RESULTS OF THE INVESTIGATION

Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?

Section 2(1) of the Act defines "personal information", in part as:

recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(h) the individual's name where it appears with other personal information relating to the individual...

The Ministry provided us with a copy of the information collected from clients' files by the Program Supervisor. Although the copy sent to us had the client name and file number severed by the Program Supervisor, the original included client name, client file number, date of birth, gender, type of support services provided by the APSP, hours of service provided to the client, and client involvement with other agencies.

It is our view that this information met the requirements of paragraphs (a), (c), and (h) of the definition of "personal information" in section 2(1) of the Act.

Conclusion: The information was "personal information" as defined in section 2(1) of the Act.

Issue B: Was the personal information collected in compliance with Section 38(2) of the Act?

Under the Act, no person can collect personal information on behalf of an institution unless the collection meets one of the conditions given in section 38(2). The consent of the individual is not one of those conditions.

Specifically, section 38(2) of the Act states that:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. (emphasis added)

The Ministry contended that in both instances, the collection was necessary to the proper administration of a lawfully authorized activity in order for the Program Supervisor to conduct a review as outlined in sections 34(2) and (3) of the Development Services Act (the DSA) which state:

(2)Any such officer or person may at any time, and shall be permitted so to do by the authorities thereat, visit and inspect any facility and, in so doing, may interview residents, examine books, records and other documents relating to residents, examine the condition of the facility and its equipment, inquire into the adequacy of its staff, the range of services provided and any other matter considered relevant to the care of residents by such office or person.

(3)The books of accounts and any other records of every facility or class of facility shall be open at all reasonable times for inspection by an officer or person appointed under subsection (1).

In addition, the Ministry referred us to the Standard Program Agreement between the Ministry and Network North. Under "Ministry Inspection", the Program Provider must "permit Ministry Staff to enter at reasonable times, any premises used by the Program Provider in connection with the provision of services... (a) in order to observe and evaluate the services; and (b) inspect all records relating to the services provided pursuant to this agreement."

The Ministry also provided us with documentation indicating that the Ministry and Network North had had "ongoing discussion regarding future direction of the adult protective service worker program and its relationship to other community developmental services", and would "continue to resolve issues related to clientele, duplication of service, service mandate and scope, linkages, and sponsorship."

The Ministry stated that the purpose of the Program Supervisor's review was to analyze the support services offered to developmentally handicapped adults in the rural areas. The Ministry hoped to minimize the duplication of services, and to redevelop supports as necessary. The Ministry also wished to ensure that clients were not at risk in the event that the APSP at the two rural health clinics was eliminated due to limited client count.

The Ministry submitted that with respect to the collection of clients' personal information from the two rural health clinics, it was necessary for the Program Supervisor to take notes from clients' files at four organizations and eight programs in order for him to complete his review. The only way for him to identify service duplication and inefficiencies was to compare the data from the various programs, by matching clients' names with the services provided to them by each program.

The Ministry stated that only the Program Supervisor was authorized under sections 34(2) and (3) of the DSA to complete the review, given the personal information that was involved, so that the confidential information would not be shared with the entire service network. The Ministry further stated that client names were not recorded in its files, since the Program Supervisor severed these names prior to the completion of the review. The Program Supervisor's report, therefore, quoted only file numbers, not client names.

It is our view that the Ministry's conduct of a review to analyze the support services offered to clients and to resolve issues related to clientele such as duplication of services, under programs funded by the Ministry, as intended by sections 34(2) and (3) of the DSA was a lawfully authorized activity.

It is also our view that on both occasions, in order to properly conduct its review, it was necessary for the Ministry to collect clients' personal information such as client name, type of services provided, hours of service etc. Therefore, the Ministry's collection of clients' personal information was necessary to the proper administration of a lawfully authorized activity, in accordance with section 38(2) of the Act.

Conclusion: The personal information was collected in compliance with section 38(2) of the Act.

Issue C: Did the Ministry provide notice of collection of the clients' personal information, in compliance with section 39(2) of the Act?

Section 39(2) of the Act states that:

where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of,

(a) the legal authority for the collection;

(b) the principal purpose or purposes for which the personal information is intended to be used; and

(c) the title, business address and business telephone number of a public official who can answer the individual's questions about the collection.

The Ministry advised that it did not provide a notice of collection to Network North's clients under section 39(2) of the Act, as it had relied upon the consent to disclosure forms returned by them. However, the Act requires notice be given whenever personal information is collected on behalf of an institution, unless notice is waived by the responsible minister. It is, therefore, our view that the Ministry did not comply with section 39(2) of the Act.

Conclusion: The Ministry did not provide a notice of collection in compliance with section 39(2) of the Act.

SUMMARY OF CONCLUSIONS

The information was "personal information" as defined in section 2(1) of the Act.
The personal information was collected in compliance with section 38(2) of the Act.
The Ministry did not provide a notice of collection in compliance with section 39(2) of the Act.

RECOMMENDATION

We recommend that the Ministry takes steps to ensure that in future, when personal information is collected from the files of clients serviced by Ministry-funded programs, proper notice of the collection is given in compliance with section 39(2) of the Act.

Within six months of receiving this report, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

Original signed by: May 9, 1995

Susan Anthistle Date

Compliance Review Officer