INVESTIGATION REPORT
INVESTIGATION I95-040P
A COLLEGE OF APPLIED ARTS AND TECHNOLOGY
September 27, 1995
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning a college of applied arts and technology (the College). The complainant, a student at the College, was concerned that some time in late October 1994, the College's Head of Security had disclosed his class schedule and his photograph to an employee of a department store (the employee) without his consent.
The complainant stated that the employee had gone to the College's Head of Security indicating that she was being followed by him. The complainant further stated that a short time later, the Head of Security provided the employee with his class schedule and his photograph. The complainant believed that as a result of the College's disclosure, he was later arrested and charged by the police. The complainant felt that the disclosure had compromised his privacy and was a breach of the Freedom of Information and Protection of Privacy Act (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information" as defined in section 2(1) of the Act? If yes,
(B) Was the personal information disclosed in compliance with section 42 of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information" as defined in section 2(1) of the Act?
Section 2(1) of the Act defines "personal information" as recorded information about an identifiable individual, including,
(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
It is our view the complainant's class schedule containing his name, together with his photograph was information that met the requirements of paragraph (h) of the definition of "personal information" in section 2(1) of the Act.
Conclusion: The information in question was "personal information", as defined in section 2(1) of the Act.
Issue B: Was the personal information disclosed in compliance with section 42 of the Act?
The complainant said that he had learned of the College's disclosure after he had been arrested and charged by the police, upon reading a copy of the police statement at his lawyer's office.
The complainant submitted that the employee’s "report" to the police and the police constable's report supported his contention that his schedule and photograph had been given directly to the employee. According to the complainant, the employee had stated that a few days after she had spoken to the College's Head of Security, he had faxed her a copy of the complainant's schedule and within ten days, he had brought her the photograph, a copy of which she had given to the store's Security Service. The complainant also stated that the police constable’s report had indicated that the employee had turned over the complainant's photograph at the police station.
The College submitted that the employee had been concerned for her safety and had approached the College's Head of Security to see if the College could help her. The College further advised that prior to the employee's contact with the Head of Security, the complainant and his wife had been interviewed by the police and that the complainant had been told by the police to "cease and desist" from following the employee. According to the College, the police had reported to the employee that the complainant was a student of the college and that she should obtain a student ID photograph to enable the store's security staff to identify him should he return to her workplace.
The College stated that only after the College's Associate Director of Physical Services had been informed that a police investigation was being carried out, had the complainant's class schedule and photograph been given to the store's Security Service, in a sealed envelope. The College submitted that these documents were not handed over to the employee but to the store's Security Service, pursuant to section 42(g) of the Act. Section 42(g) of the Act states:
An institution shall not disclose personal information in its custody or under its control except,
(g) where disclosure is to an institution or law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement is likely to result. (emphasis added)
The store was not an "institution" under the Act. It is also our view that while the store's Security Service was involved in providing security, it was not a “law enforcement agency” as this term is defined in the Act. In our view, a “law enforcement agency” is one which has a primary law enforcement role, and would include such traditional law enforcement bodies as police services boards.
We are unable to determine conclusively if the College's disclosure was directly to the employee or to the store's Security Services. In either case, the disclosure would not have been in compliance with section 42(g) of the Act, since it would not have been to an institution (under the Act) or to a law enforcement agency. However, had the College's disclosure been made to the police to aid in their investigation, it would have been in compliance with section 42(g).
We have also examined the other provisions of section 42 of the Act and have found that none would have been applicable in the circumstances of this case.
Conclusion: The College’s disclosure of the complainant's personal information was not in compliance with section 42 of the Act.
SUMMARY OF CONCLUSIONS
The information in question was "personal information", as defined in section 2(1) of the Act.
The College’s disclosure of the complainant's personal information was not in compliance with section 42 of the Act.
RECOMMENDATION
In our draft report, we recommended that the College take steps to ensure that staff are reminded of the limited circumstances under the Act which permit the disclosure of personal information.
In its representations, the College indicated that it will be "updating its Security Manual and raising awareness throughout the college community by means of our internal publications."
Within six months of receiving this report, the College should provide the Office of the Information and Privacy Commissioner with proof of compliance with our recommendation.
Original signed by: September 27, 1995
Susan Anthistle Date
Compliance Review Officer