INVESTIGATION REPORT
INVESTIGATION I97-017P
MANAGEMENT BOARD SECRETARIAT
July 10, 1997
INTRODUCTION
Background of the Complaint
This investigation was initiated as a result of a complaint concerning Management Board Secretariat (MBS).
The complainant was concerned that MBS had disclosed her personal information to a private sector collection agency (CA) in order to collect funds owed by her to the Ministry of Community and Social Services as a result of an overpayment of benefits.
The complainant believed that the disclosure was not in compliance with the provisions of the Freedom of Information and Protection of Privacy Act (the Act).
Issues Arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Was the information in question "personal information", as defined in section 2(1) of the Act? If yes,
(B) Was the personal information disclosed in compliance with section 42 of the Act?
RESULTS OF THE INVESTIGATION
Issue A: Was the information in question "personal information" as defined in section 2 (1) of the Act?
Section 2(1) of the Act states, in part, "personal information" means recorded information about an identifiable individual, including,
(c) any identifying number, symbol or other particular assigned to the individual,
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
The institution advised us that the following information would have been provided to the CA in order for them to collect the outstanding debt: the debtor's name, last known address, amount owing to the government, the identification number which the government program area assigned to the individual, and the name of the program under which the individual would have received the benefit.
In our view, this information met the requirements of paragraphs (c), (d), and (h) of the definition of "personal information" in section 2(1) of the Act.
Conclusion: The information in question was personal information as defined in section 2(1) of the Act.
Issue B: Was the personal information disclosed in compliance with section 42 of the Act?
MBS advised us that the Central Collections Services (CCS) began in 1973. CCS was a branch in what was then the Ministry of Government Services, but which later merged with MBS in 1993. CCS' mandate was to collect accounts receivable, other than tax accounts, on behalf of ministries and government agencies. According to MBS, the government began using CAs in 1975/76 to support these in-house collection efforts.
MBS further advised us that in 1996, it was decided that the CAs would take over the entire task of debt collection. MBS' 1996/97 Business Plan (publicly available in May 1996), stated that "Management Board Secretariat will look at using more alternative methods for delivering services -- such as outsourcing, partnerships with the private sector, and more effective use of information technology -- where these approaches would reduce cost. For example, we will increase the private sector's involvement in the delivery of services such as debt collection ..."
On July 16, 1996, MBS issued a news release announcing a new initiative, the "Collection of Overdue Accounts Project," which indicated the government's intention to collect monies owing on overdue tax and non-tax accounts through the use of the "private sector collection industry."
Section 42 of the Act sets out the rules for disclosure of personal information other than to the individual to whom the information relates. This section provides that an institution shall not disclose personal information in its custody or under its control, except in the circumstances listed in sections 42(a) through (n) (See Appendix A for full text).
MBS submitted that the complainant's personal information had been disclosed in compliance with section 42(c) of the Act which states an institution shall not disclose personal information in its custody or under its control except,
(c) for the purpose for which it was obtained or compiled or for a consistent purpose; (emphasis added)
MBS further submitted that:
...the disclosure is directly "for the purpose for which it was obtained." In other words, MBS through CCS undertook the activities associated with obtaining monies owing in respect of certain programs on behalf of Ontario government ministries and agencies. The same activities were outsourced to the private sector so that private sector collection agencies could undertake those activities on behalf of CCS.
MBS stated that in its view, the CCS had obtained the personal information in question from its client ministries and agencies in order to effect payment of debts owing. That same personal information was then disclosed to the CAs for the same purpose, namely, to effect payment of the debt.
Under these circumstances, it is our view that the relevant purpose under section 42(c) is the purpose for which the personal information was obtained or compiled by the Ministry. The personal information in question was obtained or compiled by the Ministry for the purpose of administering social assistance benefits under the General Welfare Assistance Act and the Family Benefits Act. MBS, in its role as central government agency responsible for debt collection, disclosed the personal information, on behalf of the Ministry, to the CA. Collecting a debt in relation to an overpayment of social assistance benefits would be considered a part of the overall purpose of administering social assistance benefits. Therefore, we conclude that the disclosure of personal information in this case was for the same purpose for which the information was obtained or compiled, and thus, the disclosure was made in compliance with section 42(c) of the Act.
Conclusion: The disclosure of the complainant's personal information was in compliance with section 42 of the Act.
OTHER MATTERS
Safeguards for Personal Information
In order to determine whether adequate safeguards were in place to protect the personal information provided to the CAs, we reviewed copies of the four contractual agreements (the agreements) between MBS and the four CAs. The terms and conditions of the agreements with each CA were identical. MBS severed all commercial information before making it available for our review.
In our view, all agreements with third parties should clearly stipulate the privacy protection measures that must be in place. In its submissions to our Office, MBS directed us to the following terms and conditions contained in each agreement:
1.6 This contract and the performance of the Work shall be governed by the laws of the Province of Ontario and the applicable laws of Canada.
5.2 All Services shall be performed in accordance with all applicable federal, provincial and municipal laws, regulations, by-laws, codes, standards, and practices.
2.4 The Supplier agrees that all of the information regarding the Work contained in the Contract will be kept secure and confidential by the Supplier.
20.2 The Supplier acknowledges that the Minister is bound by the provisions of the Freedom of Information and Protection of Privacy Act RSO 1990, C. F.31, as amended, and that the Supplier, in providing the Services pursuant to the Contract, agrees to strictly abide by the instructions of the MBS Representative regarding compliance with the Minister's obligations under such Act.
2.5 The Supplier covenants with the Minister that it will throughout the Term:
(c) use data, information, reports, material or other documents of any nature or extracts or summaries thereof which are disclosed, revealed or transmitted to it by the Minister, or to which it or any of its employees have access, solely for the purpose of attempting to collect an Account;
(d) retain all backup documentation requested by the Supplier or information received from the Minister until the relevant Account is collected and return the original documents or information to the Minister upon collection of the Account or termination of the Contract;
MBS reminded us that in addition to the terms and conditions of the agreement that cover the requirements of the Act. the CAs are also regulated under the Collection Agencies Act, and the agreements require that they be licensed.
MBS also advised that on March 26, 1997, "FOI Guidelines for Debt Collection Activities carried out by the Private Sector on Behalf of the Ontario Government," regarding the privacy provisions of the Act, had been provided to the CAs. These Guidelines were supplemented by verbal explanations. The CAs subsequently provided a signed statement to MBS confirming that "...we are bound by Ontario's Freedom of Information and Protection of Privacy Act in respect of the above contract regarding the collection of Crown Debts."
After reviewing all of the above, we are satisfied that adequate safeguards are in place to protect the personal information provided to the CAs.
Conclusion: Adequate safeguards are in place to protect the personal information provided to the CAs.
SUMMARY OF CONCLUSIONS
∙ The information in question was personal information as defined in section 2(1) of the Act.
∙ The disclosure of the complainant's personal information was in compliance with section 42 of the Act.
∙ Adequate safeguards are in place to protect the personal information provided to the CAs.
RECOMMENDATIONS
We are satisfied that the present contracts contain adequate provisions regarding disclosure and security of personal information provided to the CAs. However, since the contracts will be expiring in the near future, we recommend that the following changes be made regarding the application of the Act which, in our view, would improve the contractual agreements.
- Replace paragraph 20.2 (referenced on page 4) with the following wording:
The Supplier agrees to comply with the provisions of the Freedom of Information and Protection of Privacy Act in the course of providing Services pursuant to the Contract.
The Supplier and the Minister acknowledge and agree that all records created or maintained in the course of providing Services pursuant to this Contract become and remain the property of the Crown in right of Ontario and that such records are or will be under the Minister's "control" within the meaning of section 10(1) of the Freedom of Information and Protection of Privacy Act.
- Add the following paragraphs to future contracts:
If a request is made to the Supplier under the Freedom of Information and Protection of Privacy Act for access to records generated or maintained in the course of providing Services pursuant to this Contract, within seven days of receipt of the request, the request must be directed to the Ministry's Freedom of Information and Privacy Co-ordinator, together with copies of all responsive records in the custody or under the control of the Supplier.
If a request is made to the Ministry under the Freedom of Information and Protection of Privacy Act for access to records generated or maintained in the course of providing Services pursuant to this Contract, within seven days of being directed to do so by the Ministry, the Supplier must provide all responsive records in its custody or under its control to the Ministry's Freedom of Information and Privacy Co-ordinator.
The Supplier must designate a person to be responsible for records management, access to information and protection of privacy matters.
In response to our draft report, MBS directed us to section 7.1 of the contracts, which states in part:
The Minister shall have the option of extending the Term for two (2) further terms of three (3) months each, such extensions to be upon the same terms, conditions, and covenants contained in the Contract, including the Commission Rate.
Consequently, MBS submitted that it would not be possible to incorporate these recommendations if the contracts were renewed because "any renewals must be made on the same terms and conditions."
However, MBS added:
In most instances, when the contracts terminate, a new tender will occur. Under these circumstances, the new performance agreement could incorporate the changes suggested in paragraph one of the recommendations.
Assuming that the new contracts are entered into as a result of new tenders, we agree to include the recommended changes in paragraphs one and two in the new contracts that flow from those tenders and in future contracts where the government maintains control over the records at issue.
Based on MBS' submissions, we are satisfied that our recommendations will be implemented in the future. At such time, we ask that MBS provide our office with a copy of any new contracts, containing our recommendations.
Original Signed by: July 10, 1997
Ann Cavoukian, Ph.D. Date
Commissioner