INVESTIGATION REPORT
INVESTIGATION PC-990034-1
Workplace Safety and Insurance Board
INTRODUCTION:
Background of the Complaint
This investigation was initiated as a result of a complaint concerning the Workplace Safety and Insurance Board (the Board).
The complainant was concerned that the Board had improperly disclosed his personal information in a press release, and in particular that the press release had been posted on the Board’s Internet web site. The complainant believed that this disclosure was contrary to the Freedom of Information and Protection of Privacy Act (the Act).
The Board is responsible for administering the province’s workplace safety and insurance system established under the Workplace Safety and Insurance Act (WSIA). The system provides compulsory, employer financed, “no-fault” accident insurance to workers in Ontario.
WSIA provides for a number of offences and penalties under section 151(1) for failure to register with the Board as required, and under section 152(3) for failure to report an accident.
Section 157 of WSIA makes these failures an offence for both the corporation and/or its directors and officers. It reads as follows:
If a corporation commits an offence under this Act, every director or officer of the corporation who knowingly authorized, permitted or acquiesced in the commission of the offence is guilty of an offence, whether or not the corporation has been prosecuted or convicted.
If the person is convicted, section 158 of WSIA provides for a fine against the corporation and a fine and/or imprisonment against the individual.
The complainant is the sole owner of a company. The Board issued a press release concerning charges laid against the complainant and the company, and also posted this press release on its Internet web site. This information consisted of the complainant’s name, age, home address, the registered name of the company, and the operating name of the company and information regarding charges laid against the complainant and the company for violations of WSIA. The press release also identified the date, address and name of the Court where the complainant and the company were scheduled to appear in relation to the charges.
Issues arising from the Investigation
The following issues were identified as arising from the investigation:
(A) Do the records involved in this complaint fall within the parameters of sections 65(6) and (7) of the Act? If not,
(B) Is the information in question "personal information" as defined in section 2(1) of the Act? If so,
(C) Does section 37 of the Act apply to the personal information? If not,
(D) Is the disclosure of the personal information by the Board in accordance with section 42 of the Act? If so, is the disclosure of the personal information by the Board on its Internet web site in accordance with section 42 of the Act?
RESULTS OF THE INVESTIGATION:
Issue A: Do the records involved in this complaint fall within the parameters of sections 65(6) and (7) of the Act?
The Board submits that the complaint falls within the scope of section 65(6)3 of the Act.
The Labour Relations and Employment Statute Law Amendment Act, 1995 (Bill 7) came into force on November 10, 1995. This statute added sections 65(6) and (7) to the Act, placing various categories of records concerning labour relations and employment-related matters outside the scope of the Act.
These sections state:
(6) Subject to subsection (7), this Act does not apply to records collected, prepared, maintained or used by or on behalf of an institution in relation to any of the following:
Proceedings or anticipated proceedings before a court, tribunal or other entity relating to labour relations or to the employment of a person by the institution.
Negotiations or anticipated negotiations relating to labour relations or to the employment of a person by the institution between the institution and a person, bargaining agent or party to a proceeding or an anticipated proceeding.
Meetings, consultations, discussions or communications about labour relations or employment-related matters in which the institution has an interest.
(7) This Act applies to the following records:
An agreement between an institution and a trade union.
An agreement between an institution and one or more employees which ends a proceeding before a court, tribunal or other entity relating to labour relations or to employment-related matters.
An agreement between an institution and one or more employees resulting from negotiations about employment-related matters between the institution and the employee or employees.
An expense account submitted by an employee of an institution to that institution for the purpose of seeking reimbursement for expenses incurred by the employee in his or her employment.
Section 65(6) is record-specific and fact-specific. If this section applies to a specific record, in the circumstances of a particular complaint, and none of the exceptions listed in 65(7) are present, then the Act does not apply to the record (Orders P-1223, PO-1782 and PO-1797).
The Board submits:
Certain records containing labour relations and employment related records are excluded from FIPPA under section 65(3). In order to fall within the scope of paragraph 3, the IPC established a three part test, namely: 1) the record was collected, prepared, maintained or used by the institution or on its behalf; 2) this collection, preparation, maintenance or usage was in relation to proceedings or anticipated proceedings before a court, tribunal or other entity; and 3) these proceedings or anticipated proceedings relate to labour relations or to the employment of a person by the institution [e.g. Orders M-835, M-840, M-1034]. Further, in the same orders, the IPC defines “labour relations” as the collective relationship between an employer and its employees.
The rulings to date by the IPC indicate that Board files are covered by the section 65(3) exclusion [Orders M-896, M-1034]. The Board plays a key role in the province’s occupational health and safety system. In addition to its prevention mandate, the Board facilitates return to work and provides insurance for injuries and illnesses incurred in workplaces covered by WSIA. By prosecuting an employer for failure to register, the Board has a unique role in the labour relations between an employer and its employees and their coverage under the system. For this reason, the Board submits that section 65(3) should apply to exclude the record.
In Order P-1772, I stated:
In my view, section 65(6) has no application outside the employment or labour relation context (see Orders P-1545, P-1563 and P-1564). Therefore, unless the Ministry establishes that the anticipated proceedings for which the records are being maintained arises in an employment or labour relations context, the records do not relate to “labour relations or to the employment of a person by the Ministry”, and section 65(6)1 does not apply. Similarly, unless the Ministry establishes that the meetings, consultations and/or discussions concerning the anticipated proceedings for which the records are being maintained arises in an employment or labour relations context, the records are not “labour relations or employment-related matters in which the Ministry has an interest”, and section 65(6)3 does not apply.
There is clearly no employment relationship between the Board and the complainant or the company, and I find that the records do not relate to “labour relations or to the employment of a person by the Board” as the phrase is used in section 65(6)1. I also find that the records were not prepared, maintained or used in an employment or labour relations context, so do not deal with “labour relations or employment-related matters in which the Board has an interest” (section 65(6)3). Accordingly, section 65(6) has no application in the circumstances of this complaint.
Conclusion: Section 65(6) of the Act does not apply to the record. Therefore, the privacy complaint is subject to the provisions of the Act.
Issue B: Is the information in question "personal information" as defined in section 2(1) of the Act?
Section 2(1) of the Act states, in part:
"personal information" means recorded information about an identifiable individual, including,
(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or martial or family status of the individual,
(d) the address, telephone number, fingerprints or blood type of the individual,
(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;
The information contained in the press release and posted to the Board’s web site consists of the complainant’s name, age, home address, the registered name of the company he owns, the operating name of the company, and information regarding charges laid against the complainant and the
company for violations of WSIA. The record also identifies the date, address and name of the Court where the complainant and the company were scheduled to appear in relation to the charges.
With respect to the charges laid against the company, the Board states:
The Board has every right to disclose, in any manner that it sees fit, information about an employer business, its registered name, operating name, address, the fact that charges have been laid for committing an offence under WSIA and the location/date of the court where the charges are scheduled to be heard.
The privacy rules in the Freedom of Information and Protection of Privacy Act (FIPPA) apply to an individual as a natural person and not to a corporation, partnership, sole proprietorship or trade union (e.g. Orders P-53, M-958).
With respect to the charges laid against the complainant personally, the Board states:
The complainant is named in the Board’s news release and Internet posting because the Board charged him in his capacity as the sole director and officer of the corporation. Section 157 of the WSIA holds the officer/director liable to a fine and imprisonment, independent of a prosecution or charge against the company.
The Board further submits that the charge and prosecution of the complainant under section 157 is in his professional/business/employment capacity as the executive officer of his corporation. It is not against the individual in his personal capacity and thereby takes the information outside the definition of personal information in section 2(1) of FIPPA.
The press release identifies the complainant as an individual who was charged pursuant to the WSIA. Although the complainant was charged as a result of being the owner of the company, he was also named personally in the charge pursuant to section 157 of the WSIA.
In my view, the registered name of the company, the operating name, the information regarding charges laid against the company and the date, name and address of the court where the complainant and the company are scheduled to appear in relation to the charges, is information about the company and not the complainant, and this information does not satisfy the requirements of the definition of "personal information" in section 2(1) of the Act.
However, the complainant’s name, age, home address, and information regarding charges laid against him in a personal capacity for violations under the WSIA is information about him in a personal sense and meets the requirements of paragraphs (a), (d) and (h) of the definition of “personal information” in section 2(1) of the Act.
Conclusion: The registered name of the company, the operating name, the information regarding charges laid against the company and the date, name and address of the court where the complainant and his company are scheduled to appear in relation to the charges is not “personal information”, as defined in section 2(1) of the Act.
The complainant’s name, age, home address along with information regarding charges laid against him for violations under the WSIA is “personal information”, as defined in section 2(1) of the Act.
Issue C: Does section 37 of the Act apply to the personal information?
Section 37 of the Act states:
This Part does not apply to personal information that is maintained for the purpose of creating a record that is available to the general public.
"This Part" refers to Part III of the Act, which sets out provisions for the protection of individual privacy.
In order to satisfy the requirements of section 37, the Board must establish that the information in question is “personal information”, that the personal information is being maintained by the institution, and that the purpose of maintaining the personal information is to create a record that is available to the general public (Investigation PC-980049-1).
I have already determined that some of the information in question is “personal information” for the purposes of section 2(1) of the Act.
The Board submits:
The Board has two reasons for creating, maintaining the record: to prosecute offences, and to publicize enforcement activity through news releases and its web site so as to ensure public confidence and deter potential would-be offenders.
In Order P-1635, the IPC speaks to the requirement in section 37 differently as, for example, “express purpose”, “no statute expressly authorizes”, and “express authority”. The Board submits that insisting on a specific legislative requirement is clearly inconsistent with a plain reading of the statute. The Corporate Freedom of Information and Privacy Office in its Manual on FIPPA, in discussing Public Records and How Public Records Are Created states “In many jurisdictions, public records of personal information are created and maintained through specific statutes or regulations. However, in Ontario, public records can be created either by: (a) statute; or (b) Policy Decisions by Institutions”.
The Board relies upon its communications strategy of promoting “Zero-Tolerance for Fraud” by publicizing enforcement activity so as to encourage compliance. Public awareness of the Board’s Zero Tolerance Strategy has proven effective. For example, a news release of a charge laid in Bracebridge against a company for failing to register prompted several new business registrations.
Consequently, in this case, the Board relies on section 37 because the information is maintained for the purpose of creating a record that is available to the general public: namely, to fulfil the Board’s statutory obligation to prosecute its offences publicly through the courts and to publicize its enforcement activity.
In addition, the Board states:
The information disclosed about the complainant is information which the Board routinely obtains from public records as part of its investigation. Corporate searches from the Ministry of Consumer and Commercial Relations (MCCR) show the directors/officers of a corporation and their home addresses. Dun and Bradstreet searches provide their ages.
The news releases issued by the Board do not contain any particulars other than such as those found in public court documents and proceedings.
In Investigation MC-980018-1, I dealt with a complaint that three former cities in Metropolitan Toronto had provided incumbent Councillors with access to citizens’ names, addresses, amounts paid for their homes, amounts of down payments and names of vendors. In that case, the new City of Toronto made similar arguments to those put forward by the Board in this complaint. After considering the City’s submissions, I applied the reasoning this Office has used in a number of previous matters involving the interpretation of section 37 of the Act (see, for example, Investigations I94-011P, I95-024M and I93-009M), and concluded that:
... although some of the City’s information may have been obtained from sources that are available to the public (public databases in that case), in our view, the City cannot claim the exclusion in section 27 (municipal equivalent to provincial section 37) in the circumstances of this case because the City itself is not maintaining this personal information as a public record.
Commissioner Ann Cavoukian also dealt with this issue in Order P-1635, where she found:
It is our view that, if applicable, section 37 excludes personal information from the privacy provisions of Part III of the Act only if the information in question is held by the institution maintaining it for the express purpose of creating a record available to the general public. Other institutions cannot claim the benefit of the exclusion for the same personal information unless they, too, maintain the information for the purpose of making it available to the general public. In our view, this interpretation is not only reasonable, but also in keeping with one of the fundamental goals of the Act, namely “to protect the privacy of individuals with respect to personal information about themselves held by institutions.” [emphasis in original]
As far as the charge information at issue in this complaint is concerned, the Board does not collect and maintain this information for the express purpose of creating a record that is available to the public within the meaning of section 37 of the Act. While the Board has a practice of notifying the public of charges and convictions laid against individuals and companies, the Board obtains and maintains the information for the purpose of administering and enforcing the WSIA. Accordingly, in my view, section 37 of the Act is not applicable in the circumstances, and the privacy provisions of Part III apply.
Conclusion: Section 37 of the Act does not apply to the personal information at issue.
Issue D: Is the disclosure of the personal information by the Board in accordance with section 42 of the Act? If so, is the disclosure of the personal information by the Board on its Internet web site in accordance with section 42 of the Act?
Under the Act, personal information in the custody or under the control of an institution cannot be disclosed except in the specific circumstances outlined in section 42 of the Act.
The Board submits that the personal information was disclosed in accordance with sections 42 (a) and (c) of the Act, which state:
An institution shall not disclose personal information in its custody or under its control except,
(a) in accordance with Part II;
(c) for the purpose for which it was obtained or compiled or for a consistent purpose;
Section 43 of the Act further provides that:
Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might reasonably have expected such a use or disclosure.
Where personal information is collected indirectly, a consistent purpose is one which is “reasonably compatible” with the purpose for which the information has been compiled.
With respect to section 42(a), the Board states:
The Board submits that the disclosure of the information does not constitute an unjustified invasion of privacy of the complainant under section 21(1)(f) of FIPPA and, therefore, may be disclosed under section 42(a).
This Office has determined that section 42(a) only applies in the context of a request by an individual under Part II of the Act for records containing someone else’s personal information (see, for example, Investigations I96-001M, I93-023P and I92-066P). That is clearly not the case in the complaint before me, and I find that section 42(a) of the Act does not apply.
With respect to section 42(c), the Board states:
In this case, the Board collects the information for the purpose of investigating and prosecuting its offences, and equally important, to inform honest employers, who pay for the system, and injured workers who rely upon it of its Zero Tolerance Strategy and enforcement activities. This ensures public accountability and deters would-be-wrongdoers. In fact, the Board has a legislative obligation under section 1 of WSIA to administer its duties in a financially responsible and accountable manner.
In addition, the Board states:
The Board includes the address and age of the complainant, not to unduly embarrass the accused, but to avoid public confusion and prejudicing innocent individuals with the same name whose reputation would be unfairly damaged.
The Board also relies on the findings of Commissioner Cavoukian in Investigation I93-054P, where she found:
In this case, the complainant’s personal information had originated from proceedings conducted in court. Except in the most exceptional circumstances, proceedings before the courts are open to the public. This serves the dual purpose of informing the public of judicial proceedings as well as acting as a deterrent to potential would-be-offenders.
In our view, the Ministry [of the Environment and Energy] subsequently disclosed the complainant’s personal information for substantially similar purposes: namely, to inform the public of its enforcement activities and to deter would-be-polluters. Accordingly, it is our view that the Ministry’s disclosure was for a purpose that was reasonably compatible with the purpose for which the personal information had originally been compiled by the court.
Applying the reasoning in past matters, I find that the Board obtained and compiled the complainant’s personal information in order to administer and enforce the WSIA, and disclosed his name and the charges against him for the purpose of notifying the public of its enforcement activities and to deter others from committing similar offences. Accordingly, I find that the Board’s disclosure of the complaint’s name and the charges against him was for a purpose that was reasonably compatible with the purpose for which the personal information was originally compiled, and was, therefore, a consistent purpose under section 42(c) of the Act.
While an individual might reasonably expect his/her name and charge details to be disclosed by the Board, in my view, it is not reasonable to expect that age and home address would similarly be disclosed. In my view, disclosing an individual’s name together with information concerning the company, provides sufficient information to avoid any possible public confusion with another individual having the same or similar name. I find that disclosure of the complainant’s age and home address was not for a purpose that was reasonably compatible with the purpose for which the personal information was originally compiled and does not meet the requirements of section 42(c) or any other parts of section 42 of the Act.
The complainant was particularly concerned that his personal information was not only disclosed by the Board, but that it was posted on the Board’s Internet web site.
Disclosure of personal information in electronic format introduces added complexities. I discussed this issue in Order M-68, which involved the potential disclosure of the existence or non-existence of a criminal record of four individuals identified by the appellant. I stated:
In reaching this decision [to uphold the section 14(1) exemption claim], I am aware of the fact that the existence of a particular criminal conviction is a matter of public record, and that this fact would have been disclosed to the public during a trial or plea taken in open court. However, in my view, it does not necessarily follow that this information should be freely and routinely available to anyone who asks.
Although that appeal involved a request for a list of names of lottery winners, I feel that some of his comments are equally applicable to the request made in this appeal. At page 11 of Order 180, Commissioner Wright stated:
... In the recent decision in United States Department of Justice, et al., v. Reporters’ Committee for Freedom of the Press et al. 109 S.Ct. 1468(1989), the Supreme Court of the United States considered the question of access to criminal identification records or “rap sheets” which contain descriptive information as well as history of arrest, charges, convictions and incarcerations. Much of the rap sheet information is a matter of public record. ... In considering whether or not the disclosure of the rap sheet would constitute an “unwarranted invasion” of the subject of the sheet, Justice Stevens, speaking for the majority, made the following statements which I feel are relevant to the issues that arise in this appeal. At page 1476, Justice Stevens stated that:
To begin with, both the common law and the literal understandings of privacy encompass the individual’s control of information concerning his or her person. In an organized society, there are few facts that are not at one time or another divulged to another. Thus the extent of the protection accorded a privacy right at common law rested in part on the degree of dissemination of the allegedly private fact and the extent to which the passage of time rendered it private.
Further, at page 1477, Justice Stevens stated:
But the issue here is whether the compilation of otherwise hard-to-obtain information alters the privacy interest implicated by disclosure of that information. Plainly there is a vast difference between the public records that might be found after a diligent search of courthouse files, county archives and local police stations throughout the country and a computerized summary located in a single clearing house of information.
Finally, at page 1480, Justice Stevens referred to an earlier decision of the Supreme Court in Whalen v. Roe 97 S.Ct 869 at page 872 where the Court stated:
In sum, the fact that ‘an event is not wholly private’ does not mean that an individual has no interest in limiting disclosure or dissemination of the information.
I went on to find that the appellant might, through diligence and investigation, be able to determine if any of the individuals named in her request do have a criminal record. However, this did not mean that an easily retrievable computerized record of all criminal convictions, if it exists, should be disclosed to the appellant.
In Order M-849, which involved a request for access to Occurrence Sheets and Arrest Sheets in computerized format, I dealt with the issue of electronic access via the Internet. I found that providing the appellant with access to an electronic version of the Arrest Sheets, would enable him to develop a computer database of records, where various fields of data, including those containing personal information, could be easily searched, sorted, matched and manipulated for a wide variety of purposes. I concluded that:
Although section 32(c) of the Act [municipal equivalent to the provincial 42(c)] permits disclosure of this personal information at the time of the arrest, in my view, it is not reasonable to conclude that the individuals identified on the Arrest Sheets could have expected that this same personal information would similarly be distributed in bulk and in computerized format. Therefore, I find that section 32(c) does not extend to the disclosure of the electronic version of the Arrest Sheets.
In addressing the stated intention on the part of the Toronto Police Services Board to post both the Occurrence Sheets and Arrest Sheets on its Internet web site, I stated in a postscript to Order M-849:
If the Arrest Sheets are put on the Police’s Internet web site, the appellant and others will be able to download these records for storage on a computerized database. The information contained on the records, including the personal information which I have found qualifies for exemption in this order, could then be used in the same manner as if the records were provided directly by the Police in electronic format. The fact that the records are only on the web site for a specified period is irrelevant as far as electronic access to the information on the Arrest Sheets is concerned.
The disclosure of personal information at issue in this complaint included disclosure on the Board’s Internet web site. Although I have found that section 42(c) of the Act permits disclosure of certain personal information through the issuance of a press release at the time of the charges, I also find, consistent with past interpretations of this Office in similar contexts, that it is not reasonable to conclude that individuals identified in the context of these charges would have expected their personal information to be distributed in a computerized format via the Board’s Internet web site. accordingly, I find that disclosure of the name and charges of the complainant via the Board’s web site is not in compliance with the provisions of section 42(c) or any other of the permitted disclosures contained in section 42 of the Act.
Conclusion: Section 42(a) of the Act does not apply in the circumstances of this complaint.
The Board’s disclosure, in its press release, of the complaint’s name and the charges against him was in compliance with section 42(c) of the Act.
The Board’s disclosure, in its press release, of the complainant’s age and home address was not in compliance with section 42(c) of the Act.
The Board’s disclosure of any personal information on its Internet web site is not in compliance with section 42 of the Act.
SUMMARY OF CONCLUSIONS:
Section 65(6) of the Act does not apply to the record. Therefore, the privacy complaint is subject to the provisions of the Act.
The registered name of the company, the operating name, the information regarding charges laid against the company and the date, name and address of the court where the complainant and his company are scheduled to appear in relation to the charges is not “personal information”, as defined in section 2(1) of the Act.
The complainant’s name, age, home address along with information regarding charges laid against him for violations under the WSIA is “personal information” as defined in section 2(1) of the Act.
Section 37 of the Act does not apply to the personal information at issue.
Section 42(a) of the Act does not apply in the circumstances of this complaint.
The Board’s disclosure, in its press release, of the complainant’s name and the charges against him was in compliance with section 42(c) of the Act
The Board’s disclosure, in its press release, of the complainant’s age and home address was not in compliance with section 42(c) of the Act.
The Board’s disclosure of any personal information on its Internet web site is not in compliance with section 42 of the Act.
RECOMMENDATION:
I recommend that the Board take steps to ensure that personal information is only disclosed in compliance with section 42 of the Act. In the circumstances of this complaint: (1) the Board should not disclose the age and home address of individuals charged under the WSIA and (2) the Board should not post the type of personal information at issue in this complaint on its Internet web site.
Within three months of receiving this report, the Board should provide the Office of the Information and Privacy Commissioner/Ontario with proof of compliance with the above recommendations.
Tom Mitchinson Date
Assistant Commissioner