INVESTIGATION REPORT
INVESTIGATION I94-074P
MINISTRY OF THE ATTORNEY GENERAL
January 3, 1995
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning the Ministry of the Attorney General (the Ministry).
The complainant was employed at a Regional Centre of the Ministry of Community and Social Services (MCSS). She had written a letter to the Administrator of the Regional Centre about a Ministry employee at a named courthouse. This letter was marked "Private/Confidential" at the top. The complainant had also sent copies of the letter by fax to the Ministry's Regional Director and to the Court Services Manager at the courthouse. According to the complainant, the employee, who was the subject of her letter, had obtained a copy of the letter, put her own name and telephone on it, and had distributed copies of it at the Regional Centre.
The complainant was concerned that the Ministry's employee had disclosed her personal information contrary to the Freedom of Information and Protection of Privacy Act (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,
(B) Was the Ministry's disclosure of the personal information in compliance with section 42 of the Act?
(C) Did the Ministry take reasonable measures to prevent unauthorized access to records?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?
Section 2(1) of the Act defines "personal information", in part, as:
recorded information about an identifiable individual, including
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; (emphasis added)
The information in question was the complainant's name and her telephone/fax number. It is our view that this information met the requirements of paragraphs (d) and (h) of the definition of personal information in section 2(1) of the Act.
Conclusion: The information in question was the complainant's personal information, as defined in section 2(1) of the Act.
Issue B: Was the Ministry's disclosure of the personal information in compliance with section 42 of the Act?
Section 42 of the Act sets out the conditions for the disclosure of personal information. This section provides that an institution shall not disclose personal information in its custody or under its control except in specific circumstances. (The full text of section 42 is given in Appendix A.)
In this case, there were two disclosures: the courthouse staff's disclosure of the complainant's letter to the named employee and her subsequent disclosure of the letter to staff at the MCSS Regional Centre.
With respect to the first disclosure, the Ministry informed us that an internal investigation had been conducted. The Ministry found in its investigation that it was "a fact that a letter marked "Confidential/Private" was faxed to the courthouse on a weekend." The Ministry also stated that "Because the letter that was faxed did not include a cover sheet, courthouse staff inadvertently released the letter to the individual who was the subject of the letter." The Ministry's position, however, was that "the privacy of the complainant was not invaded in this case".
It is our view that although there was no cover sheet, the faxed letter from the complainant clearly indicated that it was a copy intended for the named "Court House Supervisor" and, therefore, staff should have forwarded the letter to him rather than to the employee who was the subject of the letter.
The Ministry also submitted that since the information in the letter was the personal information about the employee, if she had made "a request under the FOI Act for access to this record, she would likely have been granted access to the document." It is our view that since the employee did not make an access request under the Act, whether she would have obtained the record in response to such a request is not relevant to the issue of disclosure.
We have examined the provisions of section 42 of the Act and it is our view that none were applicable to the Ministry's disclosure of the complainant's personal information to the employee in question.
With respect to the employee's subsequent disclosure of the complainant's personal information to staff at the MCSS Regional Centre, the Ministry informed us that the incident occurred during an election campaign for the position of president of a local union. The employee, a union steward, was one of the candidates.
The Ministry submitted that in this case, the employee was acting entirely "on her own initiative in her capacity as a Union Steward and a private citizen" but not as an employee of the Ministry when she distributed copies of the complainant's letter.
It is our view that not all acts of government employees may be attributed to the institution that employs them. In the circumstances of this particular case, we agree with the Ministry's position that the employee's action of distributing a letter (containing information about herself) to staff of the Regional Centre was not on behalf of the Ministry. Section 42 of the Act applies to the disclosures of personal information by institutions. Therefore, in this case, section 42 was not applicable to the employee's disclosure of the complainant's personal information.
Conclusion: The Ministry's disclosure of the personal information to the employee was not in compliance with section 42 of the Act.
Section 42 of the Act did not apply to the employee's subsequent disclosure to staff at the Regional Centre.
Issue C: Did the Ministry take reasonable measures to prevent unauthorized access to records?
Section 4(1) of Regulation 460 under the Act states:
Every head shall ensure that reasonable measures to prevent unauthorized access to records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected.
In its representations, the Ministry informed us that the fax machine at the court house, is located in a central, open area "which is accessible to all court house staff." We were also informed that there is only one fax machine and any one of the court house staff takes incoming correspondence from the fax machine.
Our office's "Guidelines on Facsimile Transmission Security", provides information on security measures for the transmission of faxes. It advises, for example that one person should be identified as responsible for all fax operations. The fax machine should be located such that it is not in a public area, its use can be monitored by the responsible person and only authorized staff can have access to the information transmitted on the fax.
The Ministry did not have these or any other measures to prevent unauthorized access to faxed documents. It is our view, therefore, that the Ministry did not ensure that reasonable measures were defined, documented and put in place to prevent unauthorized access to records, in compliance with section 4(1) of Regulation 460.
Conclusion: The Ministry did not take reasonable measures to prevent unauthorized access to records.
SUMMARY OF CONCLUSIONS
The information in question was the complainant's personal information, as defined in section 2(1) of the Act.
The Ministry's disclosure of the personal information to the employee was not in compliance with section 42 of the Act.
Section 42 of the Act did not apply to the employee's subsequent disclosure to staff at the Regional Centre.
- The Ministry did not take reasonable measures to prevent unauthorized access to records.
RECOMMENDATIONS
Although it is the Ministry's position that there was no improper disclosure of the complainant's personal information in this case, it has, nevertheless, reiterated its plans to implement the measures it described in investigation I94-67P to ensure that a similar disclosure does not occur in future. These are:
To conduct a training and awareness session at the courthouse to ensure that staff are aware of and understand the privacy provisions of the Act, in carrying out their responsibilities.
To develop internal privacy guidelines to reinforce the responsibilities of staff in terms of privacy.
To review the fax procedures at the courthouse and make necessary changes to deal with the receipt and distribution of incoming faxes which contain personal information.
We note, however, that the Ministry did not state that it would also review our office's "Guidelines on Facsimile Transmission Security" with courthouse staff. We, therefore, recommend that the Ministry implement all four measures with reference to the circumstances of this case to ensure that no similar improper disclosure occurs in future.
Within six months of receiving this report, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.
Susan Anthistle Date
Compliance Review Officer