INVESTIGATION REPORT
INVESTIGATION I96-015P
A COLLEGE OF APPLIED ARTS AND TECHNOLOGY
August 12, 1996
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning a college of applied arts and technology (the College).
The complainant, a student at the College, stated that his personal information, including his name, address, date of birth and student number had been disclosed without his consent by the College via its Students’ Association (the Association) to a named insurance company (the insurer). The complainant stated that students should have been made aware of this release of personal information beforehand so that they would have had the “opportunity to challenge it”. The complainant believed that the College had contravened the Freedom of Information and Protection of Privacy Act (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question “personal information” as defined in section 2(1) of the Act? If yes,
(B) Was the personal information disclosed in compliance with section 42 of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the Information in question “personal information” as defined in section 2(1) of the Act?
Section 2(1) of the Act defines “personal information” as recorded information about an identifiable individual, including,
(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,
(c) any identifying number, symbol or other particular assigned to the individual,
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
From a document provided to us by the College, we have determined that the information in question included the student’s name, address, date of birth, student number, social insurance number, gender, marital status, language preference, and where applicable, information about the student’s dependent(s). It is our view this information met the requirements of paragraphs (a), (c), (d) and (h) of the definition of “personal information” in section 2(1) of the Act.
Conclusion: The information in question was “personal information” as defined in section 2(1) of the Act.
Issue B: Was the personal information disclosed in compliance with section 42 of the Act?
The College stated that, like many other such colleges, it offered its students an accident and sickness insurance plan (the Plan). Every student enrolled in its post-secondary programs was required to pay a compulsory Student Activity Fee (the Fee) each semester, which entitled them to certain benefits “through the activities mounted by the Association, a corporation separate from the College.” One such benefit was the Plan.
The College advised that it collected the Fee through the registration process on behalf of the Association and provided the Association with a listing of all fee-paying students for audit and control purposes. In turn, the Association made “elements involving personal information” available to the insurer so that it could administer the Plan for eligible students.
The College also advised that enhancements had recently been made to the Plan to eliminate delays in the reimbursement of prescription costs. Previously, an individual claimed benefits from the Plan after having incurred the expenses by filing a claim after making full payment. Under the revised procedures, the Association issued drug cards to the students, which had been developed by the insurer. The drug card, when presented to a pharmacist, enabled students to pay only 20% of the cost of prescription drugs at the time of purchase. The pharmacist billed the insurer directly for the remainder.
Section 42 of the Act sets out the rules for disclosure of personal information other than to the individual to whom the information relates. This section provides that an institution shall not disclose personal information in its custody or under its control, except in the circumstances listed in sections 42(a) through (n).
The College submitted that with respect to its disclosure to the Association, it had acted “in a manner consistent” with the provisions of sections 42(c) and (d) of the Act. We first considered the College’s submission with reference to section 42(d) of the Act which states:
An institution shall not disclose personal information in its custody or under its control except,
(d) where disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and where disclosure is necessary and proper in the discharge of the institution's functions; (emphasis added).
As the College stated, the Association is a separate corporation from the College. In an Order issued by our office relating to the College, it was determined that the Association is not an “institution” under the Act. Therefore, in our view, section 42(d) did not apply in the circumstances of this complaint since the College’s disclosure was not to an officer or an employee of the institution.
Section 42(c) of the Act states:
An institution shall not disclose personal information in its custody or under its control except,
(c) for the purpose for which it was obtained or compiled or for a consistent purpose; (emphasis added)
Section 43 of the Act further provides that:
Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might reasonably have expected such a use or disclosure.
In our view, the College would have obtained or compiled the complainant’s personal information for educational, administrative and statistical purposes relating to the programs of the College. The College stated that it had provided the Association with “a listing of all fee-paying students” for audit and control purposes but did not specify what information was released. However, as we stated under issue A, based on a document provided, it would appear that the personal information in question included the student’s name, address, date of birth, student number, social insurance number, gender, marital status, language preference, and where applicable, information about the student’s dependents.
The complainant stated that at the time he registered, he expected that any personal information provided to the College by him would not be released without his authorization. He indicated that he was unaware that his personal information had been given to the Association to forward to the insurer until he read about the drug card issued by the Association in the College’s newspaper about three months after he had registered. He also stated that the Association’s handbook about the insurance plan had not been available at the time classes began. Further, the complainant stated that he could not see how an “insurance program would automatically be consistent with [the College’s] function which is that of providing education.”
The College gave us copies of a number of documents relevant to this complaint. We noted from this material that although information provided by the College to students mentioned the student activity fee, there was no specific indication that personal information would be disclosed to the Association and forwarded to the insurer. A College brochure The Next Step informed the student that employees of the College “are not allowed to release information regarding any student to anyone other than the student themselves.”
Having considered the representations from both the College and the complainant, it is our view that when the complainant registered with the College, he could not have reasonably expected that the College would provide his personal information to the Association for forwarding to the insurer. Therefore, in the circumstances of this case, it is our view that the College’s disclosure to the Association was not in compliance with section 42(c) of the Act.
We have examined the other provisions of section 42 of the Act and it is our view that none applied in this case.
Conclusion: The personal information was not disclosed in compliance with section 42 of the Act.
This finding, however, does not mean that we are of the view that no student personal information should ever be disclosed to the Association. In our view, where a student association exists, it would be reasonable for students to expect that at some time, some personal information would be provided to the association but that this would likely be information such as their name and student number.
We acknowledge that the College may be in a better position to know what personal information is needed by the Association to perform its functions but in the absence of any representations on the specific information given to the Association, we are unable to determine if the Association needed all the personal information that was disclosed to it by the College.
Similarly, we do not know exactly what “elements of personal information” was subsequently disclosed to the insurer by the Association or how the disclosures were made. As we stated earlier, the Association is not an institution under the Act and is, therefore, not in our jurisdiction. However, it is our view that in the circumstances of this complaint, the College had some control and say in the matter and that it could be said that the Association was acting on behalf of the College with respect to the Plan. We note that the College has obtained an undertaking from the insurer to use the student information provided to it strictly for the production of the drug card and for processing, adjudicating and payment of the student drug claim. We commend the College for taking this action and suggest that it may wish to obtain a similar undertaking from the Association.
Other Matters
Notice:
As we noted above, the complainant was not informed beforehand that his personal information would be disclosed to the Association to be forwarded to the insurer. The complainant stated therefore, he was unable to protest the disclosure of his personal information.
Section 39(2) of the Act states:
Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of,
(a) the legal authority for the collection;
(b) the principal purpose or purposes for which the personal information is intended to be used; and
(c) the title, business address and business telephone number of a public official who can answer the individual's questions about the collection.
Included among the documents provided to us by the College were forms which contain declarations about the protection and use of student information collected by the College. However, these “notices” did not state that information collected by the College would be shared with the Association for various purposes such as the Plan and therefore, did not comply with the provisions of section 39(2) of the Act. We are pleased to note that the College has since developed a revised notice that meets the requirements of this section and which will be used on all relevant documents in future.
SUMMARY OF CONCLUSIONS
∙ The information in question was “personal information” as defined in section 2(1) of the Act.
∙ The personal information was not disclosed in compliance with section 42 of the Act.
RECOMMENDATIONS
We recommend that the College take steps to:
Provide the revised notice to students at the earliest opportunity for its collection of their personal information.
Ensure that only personal information that is necessary is disclosed to the Association for activities such as the Plan. (The College might wish to allow students who want to initiate the contact with the insurer themselves to do so.)
Ensure that students are aware of what personal information is provided to the Association and forwarded to the insurer. For example, the Association’s handbook about the Plan might include this information.
Within six months of receiving this report, the College should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendations.
Original Signed By: August 12, 1996
Susan Anthistle Date
Compliance Review Officer