Investigation I98-014P (Ministry of Labour), 1998 CanLII 14474

INVESTIGATION REPORT

INVESTIGATION I98-014P

Ministry of Labour

August 7, 1998

INTRODUCTION

Background of the Complaint

This investigation was initiated as a result of a complaint concerning the Ministry of Labour (the Ministry).

The Information and Privacy Commissioner of Ontario received an anonymous complaint, in which the complainant stated that the Ministry had violated the privacy of certain individuals in the manner in which it had conducted a client service survey.

The complainant explained that the Ministry had hired a private company to conduct a telephone survey of individuals "who have had complaints with the Ministry." The complainant said that he/she understood that the Ministry had given the names and telephone numbers of these "complainants," including those who had asked to remain confidential, to the private company. The complainant said that the telephone interviewers were, apparently, only given the complainants' telephone numbers and not their names. The complainant said:

Not only does this not protect individual privacy, since complainants can be identified by their telephone numbers, but by not knowing who to ask for when they make their telephone calls, these surveyers [sic] could inadvertently disclose to an employer that an employee has made a confidential complaint against them, particularly in a small workplace.

The Ministry acknowledged that, to improve its services to the public, it hired a private company to conduct a survey, on its behalf, among "clients" of five of its program areas, specifically, the Ontario Labour Relations Board, the Occupational Health and Safety Program, Labour Management Services, the Employment Standards Program, and the Pay Equity Commission. The Ministry stated that the survey concerned the level of service provided to all clients, including, for example, employers, unions, lawyers and individuals, and added that it was not a survey of individuals who had complained to the Ministry about their employers.

The Ministry stated that because of privacy concerns it decided to provide the private company with only the client telephone numbers, and not the client names. The Ministry further stated that, where the client had requested confidentiality, the program samples did not contain telephone numbers.

The Ministry explained, however, that when the program areas provided the population data to the private company, they mistakenly included the names. The Ministry added that although the names were provided, the private company assured the Ministry that it did not use the names in conducting the survey, with the exception of those clients who had dealt with the Ontario Labour Relations Board, namely, members of the labour law community.

The Ministry further explained that "individuals who were contacted were called at the number that they would have left with the Ministry, which, in most cases, would be a number other than the employer's."

We examined the survey, and note that the script to be followed by the interviewer included options of what to say if the interviewer was contacting a "household" versus an employer. Therefore, clients were contacted at both their households and their employers.

Issues Arising from the Investigation

The following issues were identified as arising from the investigation:

(A) Was the information in question “personal information,” as defined in section 2(1) of the Act? If yes,

(B) Was the personal information disclosed by the private company on behalf of the Ministry, in compliance with section 42 of the Act?

RESULTS OF THE INVESTIGATION

Issue A: Was the information in question “personal information” as defined in section 2(1) of the Act?

Section 2(1) of the Act defines “personal information” as recorded information about an identifiable individual (see Appendix A for full text).

The information in question is whether an individual was identified (to their employer or household) as having had dealings with the Ministry concerning, for example, employment standards or pay equity.

Although client names were not used in conducting the survey, it is our view that an individual's identity might, nonetheless, have become evident as the interviewer attempted to contact the relevant client at a particular workplace or household. If this happened, the information in question (i.e., that an identifiable individual had had dealings with the Ministry) would meet the requirements of the definition of "personal information" in section 2(1) of the Act.

Conclusion: The information in question would have been personal information as defined in section 2(1) of the Act.

Issue B: Was the personal information disclosed by the private company on behalf of the Ministry, in compliance with section 42 of the Act?

The Ministry submitted that, given the nature of the survey, it was "highly unlikely" that the survey would have resulted in the identity of a complainant being disclosed. The Ministry reiterated that the survey concerned the level of service provided to all clients, and added that it was not a survey of individuals who had complained to the Ministry, "even though a very small number of individuals would be caught in the cross-section of clients that was used."

In response to our draft investigation report, the Ministry emphasized how small a number of individuals this would be. The Ministry noted, for example, that initially there would have to be an attempt to contact a client in an "individual" capacity, and added that only 24% of the 1,326 clients surveyed were "individuals". The Ministry also noted that an employer could only speculate about an individual's identity in any meaningful sense, if the situation involved a small workplace. In this regard, the Ministry explained that a large number of workplaces covered by the survey were of a significant size, i.e., over 50 employees.

The Ministry further noted that the survey only mentioned "dealings" clients had had with the Ministry, and that none of the survey questions referred to a "complaint."

The Ministry's position was that the survey "would not result in the identification of confidential complainants." The Ministry stated that while there was nothing to prevent an employer from speculating about whether a certain individual had made a complaint to the Ministry, this is very different from saying that the Ministry had inadvertently disclosed this information. The Ministry added that the survey was no more likely to result in such a disclosure than when the Ministry follows up directly with an employer on an issue raised by an anonymous complainant, which it does all the time.

In response to our draft investigation report, the Ministry emphasized that "... there has been absolutely no evidence that any such disclosure actually occurred ...".

We concur with the Ministry that in certain circumstances an employer would only be able to speculate about whether a certain individual had had dealings with or had made a complaint to the Ministry. However, we are also of the view that in other circumstances, such as in a very small workplace, an employer would be able to do more than just speculate, the employer could reasonably determine the identity of the individual. For example, if the owner of a small company received a telephone call from one of the survey interviewers, the owner might be able to determine which of his or her employees had had dealings with or had made a complaint to the Ministry, given the owner's familiarity with the employees' employment background and history, including whether the employee had any grievances or complaints.

It is also our view that the circumstances of this complaint are not analogous to a situation where the Ministry follows up directly with an employer on an issue raised by an anonymous complainant. In the latter situation, the anonymous complainant, in having made his or her complaint, would have an expectation that the Ministry would be following up with the employer. In the former, the complainant might not have the same expectation.

Notwithstanding the above, the Ministry also stated that, in most cases, individuals would have left a telephone number other than their employer's. Thus, it appears that if a complainant's personal information had been improperly disclosed, it would more likely have been disclosed within their "household," than within their place of employment. Although a disclosure within a household may be perceived to be less intrusive than within a workplace, it nonetheless remains a disclosure.

Section 42 of the Act sets out the rules for disclosure of personal information other than to the individual to whom the information relates. This section provides that an institution shall not disclose personal information in its custody or under its control, except in the circumstances listed in sections 42(a) through (n) (See Appendix B for full text).

As the Ministry pointed out, the complainant in this matter only speculated about a possible disclosure; the complainant stated: "... these surveyers [sic] could inadvertently disclose ..." (emphasis mine). Thus, we had no evidence before us that an individual's personal information was, in fact, disclosed.

However, in response to the draft report, the Ministry submitted that where there could have been a disclosure of an individual's identity within a household, the disclosure would be permissible under sections 42(b) and (c) of the Act. Sections 42(b) and (c) state:

An institution shall not disclose personal information in its custody or under its control except,

(b) where the person to whom the information relates has identified that information in particular and consented to its disclosure;

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

Section 43 of the Act further provides:

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might reasonably have expected such a use or disclosure.

The Ministry states that when an individual gives the Ministry a household telephone number to facilitate contact regarding the issue he or she has with the Ministry, "the individual must be taken to be consenting to have the Ministry disclose to other household members that the individual is dealing with the Ministry." The Ministry stated: "It must be remembered that we are not talking about the details concerning the contact, simply that the individual has contacted the Ministry. Therefore, it makes little sense to suggest that in contacting a household for the purposes of the survey, the Ministry has thereby disclosed personal information to other people without the consent of the individual in question."

Section 42(b) of the Act states that personal information may be disclosed where the individual to whom the information relates identifies that information in particular and consents to its disclosure.

In our view, the fact that an individual has given their telephone number to the Ministry to facilitate contact with the Ministry, does not equate to consent to the disclosure of the particular information, namely, that they had had dealings with the Ministry. Thus, the disclosure would not be in compliance with section 42(b) of the Act.

The Ministry also submits that contacting individuals at a household telephone number to assess the level of service provided by the Ministry in its dealings with the individual, also satisfies the consistent purpose provision in section 42(c) of the Act.

The Ministry states that although an individual might not assume that a follow-up survey concerning quality of service was a definite thing, an individual could certainly reasonably expect that this might occur.

In our view, an individual would only have a reasonable expectation that the Ministry would conduct a follow-up survey of its services provided if the Ministry had informed the individual at the outset that it might do this.

It is also our view that the individual would not reasonably expect that the fact that he or she had had dealings with the Ministry would be disclosed to other members of his or her household, or to members of his or her workplace. Thus, it is our view that the disclosure would not be for a consistent purpose, in compliance with section 42(c) of the Act.

We have carefully examined the remaining provisions of section 42 of the Act and have found that none would have applied in the circumstances of this complaint.

Conclusion: We had no evidence before us that an individual's personal information was disclosed by the private company on behalf of the Ministry. However, if a disclosure had occurred, it would not have been in compliance with section 42 of the Act.

Other Matters

Collection

Section 38(2) of the Act sets out the conditions under which personal information may be collected. It states:

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.

Section 39(2) of the Act further provides that:

Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of,

(a) the legal authority for the collection;

(b) the principal purpose or purposes for which the personal information is intended to be used; and

(c) the title, business address and business telephone number of a public official who can answer the individual's questions about the collection.

Therefore, if the Ministry collects personal information for the purposes of conducting a survey, it must have the authority to collect under one of the conditions of section 38(2) and must provide notice in compliance with section 39(2), unless a waiver has been obtained. The notice should state that one of the intended purposes of the collection is to conduct a survey. Any subsequent use or disclosure of the personal information collected would then fall under sections 41(b) and 42(c) respectively, i.e., use or disclosed for the same purpose for which it was obtained or compiled.

Sections 41(a) and 42(b) provide for the use and disclosure of personal information where the person to whom the information relates has identified that information in particular and consented to its use or disclosure.

Therefore, alternatively, the Ministry could seek the individual's consent to subsequently participate in the survey, when the individual first lodges their complaint or seeks the Ministry's services. The Ministry could record the individual's response accordingly.

Best Practices Paper

During our investigation of this matter, the Ministry informed us that the Ontario Government had asked ministries to assess their services to the public, and to subsequently develop action plans to improve any detected service gaps. The Ministry stated that, as a result, a number of ministries have conducted or are planning to conduct client service surveys.

In view of the above, and since it is also interested in conducting future surveys, the Ministry suggested that our two organizations work together to develop a best practices for protecting individual privacy in conducting client service surveys.

We accepted the Ministry's suggestion, and are currently working with the Ministry in this regard. The best practices will be published for the benefit of all institutions planning to conduct such surveys.

SUMMARY OF CONCLUSIONS

• The information in question would have been personal information as defined in section 2(1) of the Act.

• We had no evidence before us that an individual's personal information was disclosed by the private company on behalf of the Ministry. However, if a disclosure had occurred, it would not have been in compliance with section 42 of the Act.

RECOMMENDATIONS

We recognize that in requiring the private company to use only the client telephone numbers, the Ministry intended to protect the privacy of its clients, and that any actual disclosures of personal information would have been inadvertent.

Nonetheless, we recommend that the Ministry take steps to ensure that personal information is disclosed only in compliance with section 42 of the Act. For example, if the Ministry intends to collect an individual's personal information for the purpose of conducting a survey, it should (a) incorporate this intended use into its notice of collection, or (b) obtain the client's consent for disclosure (or use).

(Since we are working with the Ministry to develop a best practices for protecting individual privacy in conducting client service surveys, there is no need for the Ministry to provide this Office with proof of compliance with the above recommendation.)

Original signed by: August 7, 1998

Tom Mitchinson Date

Assistant Commissioner

APPENDIX A

2.--(1) In this Act,

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except if they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

APPENDIX B

42. An institution shall not disclose personal information in its custody or under its control except,

(a) in accordance with Part II;

(b) where the person to whom the information relates has identified that information in particular and consented to its disclosure;

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

(d) where disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and where disclosure is necessary and proper in the discharge of the institution's functions;

(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament or a treaty, agreement or arrangement thereunder;

(f) where disclosure is by a law enforcement institution,

(i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or

(ii) to another law enforcement agency in Canada;

(g) where disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;

(h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;

(i) in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;

(j) to a member of the Legislative Assembly who has been authorized by a constituent to whom the information relates to make an inquiry on the constituent's behalf or, where the constituent is incapacitated, has been authorized by the next of kin or legal representative of the constituent;

(k) to a member of the bargaining agent who has been authorized by an employee to whom the information relates to make an inquiry on the employee's behalf or, where the employee is incapacitated, has been authorized by the next-of-kin or legal representative of the employee;

(l) to the responsible minister;

(m) to the Information and Privacy Commissioner; and

(n) to the Government of Canada in order to facilitate the auditing of shared cost programs.