INVESTIGATION REPORT
INVESTIGATION I95-031M
A REGIONAL MUNICIPALITY
October 23, 1995
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning a regional municipality (Municipality A). The complainant received a letter from another regional municipality (Municipality B), asking for repayment of a Family Benefit (FBA) overpayment. Since the complainant advised that she had never sought nor received any social assistance, she was disturbed by this letter asking for repayment. The complainant's spouse advised Municipality B of the error and was told the letter had originated from Municipality A. The complainant advised Municipality A that she was very concerned at being identified as an FBA recipient -- that as a result, she might experience negative financial consequences. The complainant requested that any files forwarded to other institutions referring to her as an FBA recipient be deleted. The complainant had prepared for the Municipality's signature an affidavit which included the Municipality taking full responsibility for any harm caused to her, and an apology. The Municipality did not sign the affidavit.
Municipality A wrote to the complainant assuring her that they had neither created a record with her name on it nor collected information on the occupants at her address. Municipality A advised the complainant that an FBA recipient on their files, with the same last name, had been incorrectly matched to her address. Municipality A further advised the complainant that based on address information obtained from the Ministry of Transportation (the MOT), the letter requesting repayment had been mailed in error by Municipality B. Municipality B had been notified of the error.
Several weeks later, however, two more letters arrived at the complainant's address, this time from Municipality A, again requesting return of the overpayment. As a result, the complainant was very concerned that her personal information was continuing to be used incorrectly, in contravention of the Municipal Freedom of Information and Protection of Privacy Act (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,
(B) Did the Municipality take reasonable steps to ensure that the complainant's personal information was accurate and up to date, in compliance with section 30(2) of the Act, before using it to recover an FBA overpayment?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?
Section 2(1) of the Act defines "personal information" as recorded information about an identifiable individual, including,
(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,
(c) any identifying number, symbol or other particular assigned to the individual,
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
We reviewed the three letters requesting repayment (the letters). The first letter received by the complainant was from Municipality B, while the other two were from Municipality A. All three were mailed to the complainant's address and included her last name. However, in each case the first name was slightly different than the complainant's. The letters also noted a case identification number, the amount owing and a request for repayment to the Minister of Finance. The first letter from Municipality B also stated that if it did not hear from the recipient within 30 days, the account would be transferred to the Ministry of Government Services, Central Collection Services, for further action.
In our draft report we found that the complainant's last name, together with her address, met the requirements of paragraphs (d) and (h) of the definition of "personal information" in section 2(1) of the Act. In addition, we found that the letters contained the personal information of the FBA recipient -- her full name, her FBA case identification number and the amount of the overpayment, under paragraphs (b) and (c) of the definition of "personal information" in section 2(1) of the Act. (Our concern with the disclosure of the FBA recipient's personal information is discussed under "Other Matters").
In response to our draft report, Municipality A submitted that the name contained in the letters was "exclusively the personal information of the third party recipient, who is not the complainant." However, we are of the view that the information in question is so closely connected to the complainant (i.e. her last name and address) that it is reasonable to consider this information to be "about" the complainant, as required by the preamble in the definition of "personal information" in section 2(1) of the Act.
Conclusion: The information in question was both the complainant's and the FBA recipient's "personal information", as that term is defined in section 2(1) of the Act.
Issue B: Did the Municipality take reasonable steps to ensure that the complainant's personal information was accurate and up-to-date, in compliance with section 30(2) of the Act, before using it to recover an FBA overpayment?
Section 30(2) of the Act states:
The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date.
The determination of whether reasonable steps have been taken hinges on the meaning of "reasonable" in section 30(2) of the Act. Black's Law Dictionary defines reasonable as:
"Fair, proper, just, moderate, suitable under the circumstances. Fit and appropriate to the end in view ... Not immoderate or excessive, being synonymous with rational, honest, equitable, fair, suitable, moderate, tolerable."
Thus, for reasonable steps to have been taken would not have required a standard so high as to necessitate that every possible step be pursued to ensure accuracy.
The Municipality's Representations
Municipality A advised us that the sequence of events in this case was as follows:
An FBA case was terminated in Municipality A, with an overpayment outstanding.
Municipality A requested MOT to search its driver licence database for addresses listed for individuals with the complainant's last name. MOT mailed back the requested information.
Normally, Municipality A would check a number of different indicators such as last name, first name, gender, address history, and date of birth, to ensure that the information received from MOT was matched correctly to the true FBA recipient.
In this instance, however, Municipality A acknowledged that while the last name, first initial and gender matched, the date of birth and address history did not. Municipality A advised that common sense and judgment had to be applied during the matching process, depending on various factors (i.e., how common the name in question is). However, in this case, Municipality A acknowledged that the Clerk should have noticed that the complainant had never resided in Municipality A. This error resulted in the FBA recipient being incorrectly matched to the complainant's address.
As the incorrectly matched address was outside of Municipality A's jurisdiction, the file was transferred to Municipality B, the municipality in which the complainant resided. Municipality B generated the first letter to the complainant, requesting the overpayment.
When the complainant's spouse notified Municipality B of the error, the file was then transferred back to Municipality A.
Municipality A discussed the error with the employee in question. It was then assumed that steps had been taken to delete the complainant's address from the computer system (CIMS). CIMS is a computer data base containing information about all FBA recipients across the province. It automatically generates standard form letters concerning FBA administration, such as those received by the complainant.
However, the proper steps had not been taken and the complainant's address remained on CIMS. After the file had been returned to Municipality A, the computer generated two more letters to the complainant.
We notified Municipality A of the two additional letters sent to the complainant. We were assured that this time, proper steps would be taken to delete the complainant's address from all files, both computer and paper based.
We decided to visit Municipality A to discuss this complaint and conduct our own search of CIMS, as well as Municipality A's stand-alone computer system which only holds information on FBA recipients served by Municipality A's four FBA area offices. We also reviewed the FBA recipient's physical file. There were only two records in the physical file that contained the complainant's address: 1) a handwritten note from a supervisor at Municipality B, documenting the telephone call from the complainant's spouse concerning the first letter, and 2) a photocopy of the first letter sent to the complainant.
In reviewing the history of this case, it is our view that adequate procedures were not in place to ensure the accurate use of the complainant's personal information. In failing to properly verify the accuracy of the information obtained from the MOT, Municipality A did not take reasonable steps to ensure that the complainant's personal information was accurate and up to date before using it to recover an FBA overpayment.
In our draft report, we concluded that Municipality A did not take reasonable steps to ensure that the complainant's personal information was accurate and up to date, in compliance with section 30(2). However, in its response to our draft report, Municipality A submitted that section 30(3) of the Act applies such that section 30(2) cannot apply in the circumstances. Section 30(3) states:
Subsection (2) does not apply to personal information collected for law enforcement purposes.
Municipality A submitted that they collected the address information from MOT specifically for the purpose of an investigation of the FBA recipient that could have led to court proceedings being taken to recover the overpayment under section 17 of the Family Benefits Act.
Section 17 states:
Despite section 5 and subject to the regulations, the Director may recover from a recipient any sum paid to him or her by way of an allowance under this Act or any predecessor Act to which he or she was not entitled under this Act or such predecessor Act or in excess of any amount to which he or she was so entitled, whether by reason of non-disclosure of facts, misrepresentation or fraud, or for any other cause disentitling him or her to such an allowance, by reducing or suspending any allowance payable to the recipient or by proceedings to recover such sum as a debt due to the Crown in any court of competent jurisdiction.
Therefore, they were of the view that the overpayment investigation fell within clause (b) of the definition of “law enforcement” in section 2(1) of the Act. This section reads:
“Law enforcement” means,
(b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, (emphasis added)
In our view, an investigation conducted solely with a view to recovering an overpayment under section 17 of the Family Benefits Act does not qualify as “law enforcement” since, by definition, recovery of money to which a recipient is not entitled does not qualify as a “penalty or sanction” imposed by a “court or tribunal”, under paragraph (b) in section 2(1) of the Act.
Conclusion: Municipality A did not take reasonable steps to ensure the complainant’s personal information was accurate and up to date, in compliance with section 30(2) of the Act, before using it to recover an FBA overpayment.
Potential Misuse of Incorrect Information by Other Institutions
A fundamental principle underlying Fair Information Practices is that personal information in the custody and control of organizations be kept accurate and up to date. The importance of this "data quality" principle cannot be overstated; its absence can lead to serious consequences. The present complaint serves as a case in point. Not only may incorrect information be damaging to an individual and portray them in an inaccurate manner, but, if left uncorrected, its harmful effects can multiply as the information is communicated to other institutions.
We were thus concerned with the potential use or disclosure of the incorrect information about the complainant by other institutions, namely, Municipality B, the MOT, the Ministry of Finance, and the Ministry of Government Services, all of which were or could have had access to this information. We determined the following:
Municipality B
We interviewed Municipality B. They confirmed that they had received the FBA recipient's file, including the complainant's address, from Municipality A. However, upon being informed by the complainant's spouse that the address was incorrect, it promptly transferred the file back to Municipality A. Municipality B confirmed that it had no records containing the complainant's personal information on any computer or physical files, neither did it have cause to forward any such records to other institutions.
The Ministry of Transportation
Municipality A provided us with a copy of the standard request form sent to MOT. The MOT returned the request form, together with the address information derived from its drivers licence database search. Municipality A confirmed that no record was kept by MOT, and that the information MOT provided in this case had been shredded.
The Ministry of Finance
Municipality A advised that, since the complainant had obviously not sent a repayment to the Minister of Finance, the Ministry of Finance would not have a record of the complainant's address.
The Ministry of Government Services
Only Municipality B's letter mentioned the Ministry of Government Services. As the error was quickly discovered and the file promptly returned to Municipality A, no contact with the Ministry of Government Services had been necessary.
We advised Municipality A to shred the memo and the photocopy of the first letter sent to the complainant by Municipality B.
Action Taken
Originally, Municipality A told us how seriously they viewed this complaint. A letter of discipline was issued concerning the clerk who had made the error. After finding out that the complainant had received two more letters, Municipality A took specific steps to delete the complainant's address from their computer and physical files. In addition, to ensure that a similar mismatching of information does not occur again in the future, the following proactive measures have been implemented:
Revised Procedures
Municipality A's Director of Social Assistance sent a memo to all managers stating that they had experienced "two (2) incidents where address information obtained through a Ministry of Transportation licence search was incorrectly attached to a client file. This error resulted in people who are not recipients of Social Assistance in Peel receiving payments and confidential client information." The Director asked the managers to ensure that staff were properly trained to match information provided by MOT with social assistance cases, and that supervisors review this issue with all staff at team meetings. The following revised MOT search procedures are now in place:
A control clerk completes the drivers license search form
The control clerk forwards the drivers license search form to MOT
MOT information is received back by the support clerk
The support clerk matches the MOT information with the request for the search
The support clerk highlights on both forms the areas of match, i.e. last name, first name, address history, date of birth. A minimum of two matches are now required. (previously, the minimum number of matches was not stipulated)
If a match is determined, the support clerk writes a request on the file for the control clerk to change the address in CIMS
The control clerk receives the request and is responsible for ensuring that the information matches on at least two items (a second control measure)
The control clerk creates a computer input sheet with the address change and inputs it into CIMS
If any doubt exists about the matching process, a supervisor is consulted.
Training
The two staff members responsible for matching the information have received further training. In addition, a memo was sent to supervisors in Municipality A's four FBA area offices concerning the revised procedures. Supervisors were requested to report back when all appropriate staff have been instructed in changing their procedures.
Audit
Based on this complaint, Municipality A made the decision that the Social Assistance Income Security Division would conduct a retroactive audit of the information it had received from the MOT (search histories) since January 1, 1995. Municipality A informed us that they found 2 further errors, which were immediately corrected.
The above steps taken by Municipality A will serve to ensure that further mismatching of personal information does not re-occur in the future.
Letter of Assurance to the Complainant
Municipality A has agreed to write a further letter to the complainant, giving her the necessary assurance that her name and address have been deleted from all of Municipality A's FBA files (including their computer records) and apologizing for this error.
Other Matters
Disclosure of Third Party Personal Information
Third party personal information was inadvertently disclosed when Municipality A and Municipality B generated letters to the complainant's address containing the FBA recipient's full name, FBA case identification number, and amount of the overpayment.
In our draft report we found that none of the exceptions to the section 32 prohibition against disclosure of personal information applied in this case. Therefore, by not properly verifying the accuracy of the information obtained from the MOT, we concluded that Municipality A improperly disclosed the FBA recipient's personal information to the complainant.
In response to the draft report, Municipality A asserted that they did not disclose the FBA recipient's personal information to the complainant. It submitted that:
"...the complainant opened mail clearly addressed to the name of the third party recipient. The complainant's spouse, when calling the [Municipality B] to complain about the letter, disclosed that the individual to whom the letter was addressed resides in Toronto. In his statement, the complainant's spouse clearly implied knowledge of the third party recipient. Therefore, the complainant's opening of the incorrectly addressed mail was in contravention of section 48 of the Canada Post Corporation Act."
Municipality A further submitted that:
"The IPC's ruling that the Region is at fault - rather than the complainant - on the question of opening another person's mail would offend the Canada Post Corporation Act. The onus under that Act is clearly on the person who opens the other person's mail - not the person who addresses the mail. The IPC's finding seeks to reverse that onus. The IPC does not have jurisdiction to rule on postal matters, which fall under the exclusive constitutional jurisdiction of the Parliament of Canada, in section 91 of the Constitution Act, 1867."
In our view, the Canada Post Corporation Act bears no relevance in the circumstances of this case and thus we have not made a finding under that statute. It is our view that the complainant acted reasonably in opening an envelope which contained her correct address, her correct surname, and a first name which deviated only slightly from her own. In our view, any reasonable person would assume that this envelope was intended for him or her, and would proceed to open it. Accordingly, we maintain that in disclosing the FBA recipient's personal information to the complainant, Municipality A did not comply with the provisions of section 32 of the Act.
SUMMARY OF CONCLUSIONS
The information in question was both the complainant's and the FBA recipient's "personal information", as defined in section 2(1) of the Act.
Municipality A did not take reasonable steps to ensure the complainant’s personal information was accurate and up to date, in compliance with section 30(2) of the Act, before using it to recover an FBA overpayment.
RECOMMENDATION
In response to this complaint, Municipality A has taken proactive steps to correct the error made and has implemented a number of preventative measures. We recommend that these measures be shared with other municipalities so that they may implement similar measures, thereby enhancing the likelihood that the personal information in their custody will be accurate and up to date.
Within six months of receiving this report, the Municipality should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.
Original signed by: October 23, 1995
Ann Cavoukian, Ph.D. Date
Assistant Commissioner