GSB#2010-2318

UNION#2010-0252-0010

IN THE MATTER OF AN ARBITRATION

Under

THE CROWN EMPLOYEES COLLECTIVE BARGAINING ACT

Before

THE GRIEVANCE SETTLEMENT BOARD

BETWEEN

Ontario Public Service Employees Union (Myciak et al)

Union

• and -

The Crown in Right of Ontario (Ministry of Community Safety and Correctional Services)

Employer

BEFORE

Felicity D. Briggs

Vice-Chair

FOR THE UNION

Christopher Bryden Ryder Wright Blair & Holmes LLP Counsel

FOR THE EMPLOYER

Jonathan Rabinovitch Treasury Board Secretariat Labour Practice Group Counsel

HEARING

July 13 and September 21, 2015

Decision

1On November 29, 2011 Eugene Myciak and a number of other members of staff at the Niagara Detention Centre filed a grievance that said:

I/we grieve the Employer is in violation of, but not limited to, Preamble, Article 2 (management rights) of the Collective Agreement and any other Act, Regulation or Policy pertaining to privacy. The Employer is also in violation of the Personal Health Information Protection Act, and the Freedom of Information and Protection of Privacy Act. The Employer electronically posted sensitive information of a private and confidential nature on the “P” (public) drive of the institution’s computer network, regarding employee WSIB claims. The Union requests disclosure of all affected staff under Article 22.14.5 (Grievance Procedure).

2By way of remedy the grievors requested amongst other things, a “thorough investigation by an independent agency outside of the Corrections Division” and financial compensation for those affected.

3It was ultimately agreed by the parties that this matter should be determined under Article 22.16 and therefore this decision is without precedent or prejudice. The parties also suggested that a short decision would suffice with a “bottom line”.

4The parties entered a partial agreed statement of fact. It is useful to set out these facts in total in order to provide not only a summary of what occurred but also a summary of the position of the parties regarding this alleged breach. The agreed facts regarding the circumstances that gave rise to the filing of this grievance were:

a) These proceedings arise from a group grievance filed by Correctional Officers and other staff members working at the Niagara Detention Centre (NDC).

b) In and around July 2010, the Union alleges that it came to the attention of several staff members that a folder on the institution’s “P” intranet drive contained compensation materials and WSIB forms and other information on NDC employees.

c) The Union takes the position that access to the folder was unrestricted and accessible to staff members at NDC.

d) Shelly Morrish-Paradis, a Cook III contacted Tizanna Testana, the Office Manager, as well as Tom Dykstra, then Acting Deputy Superintendent of Administration to advise them of the situation. This occurred on July 10 or July 15, 2010.

e) The Employer takes the position that, immediately upon being advised of the situation, Ms. Testana did check the drives and determined that the folder in question was secured and that access was password authorized. The Union is holding the Employer to the strict proof of this assertion.

f) The Union takes the position that, over the month of July, 2010, numerous employees spoke to then Local President Eugene Myciak and expressed concern and outrage regarding the accessibility of their private information on the public P drive. The Employer is holding the Union to the strict proof of these assertions.

g) Mr. Myciak looked into the matter, and sent an email to DS Dykstra on Civic Holiday Monday, August 2. For ease of reference, Mr. Myciak’s email is produced below:

As Local President it has been brought to my attention that there are a total of 482 files in 24 folders (of which 310 files are personal WSIB reports of numerous officers, managers, kitchen and health care staff) on the “P” or public drive, which is accessible to all employees in the facility.

Included in this list are the WSIB monthly reports from 1998 through to 2008; 9 letters to WSIB concerning various staff members dating back several years; the institution phone list.

Of the 319 WSIB forms: they are held in 12 folders and cover the period of time 1999 to 2010 inclusive, many of which include Social Insurance Numbers amongst other personal information.

This main folder, labeled WSIB on the public drive, was created Tuesday October 27, 2009 at 10:36:50 am and contains 482 files, 24 folders, is 57.7 MB in size and consumes 58.6MB of disk space and is marked ‘Read Only’.

A number of staff brought this to my attention and all of them have expressed outrage at what they perceive to be a breach of their privacy.

Presently I am considering the options available to these affected members and will advise them accordingly.

I trust that these files will be preserved for whatever outcome that may demand their disclosure, but that they will become inaccessible to all employees as soon as possible.

h) In response to the email, the Employer looked into the matter and access to the folder was restricted Tuesday August 3, 2010. The Employer then issued letters to all former and current employees who had files on the drive and took steps to inform the Information and Privacy Commissioner. The Union holds the Employer to the strict proof of establishing what steps, if any, the Employer in fact took to advise the Information and Privacy Commissioner.

i) On August 15, 2010, Mr. Myciak emailed then Superintendent Barry McDonnell enquiring as to whether he can or should be contacting individuals who were no longer with the Ministry but whose private information may have been disclosed on the “P” drive. Mr. Myciak noted that he was “unsure as to the standing of these individuals with respect to FIPPA”.

j) Further emails between Mr. Myciak and Mr. McDonnell (and other members of administration) followed on August 16, and 26 – 30, 2010.

k) In early August, 2010, a CISU investigator was appointed to look into the posting of the impugned information on the P drive. The CISU Report was finalized on or around December 15, 2010.

l) The CISU investigation determined that, as a result of the Ministry’s and the Institution’s IT and record-storage practices, it would not be possible to recover the required information, nor would it be possible to identify precisely when the information was transferred nor who did it, or why.

m) The CISU Investigator also noted that since the “files were located on a public [sic] accessible area, anyone with access to that area could have accessed modified, moved or copied the files contained in the WSIB folder”. The Union takes the position that, as Mr. Myciak noted in his email referenced above, the folders and documents were also marked as “read-only”, meaning that they could not in fact be accessed, modified or moved as the CISU concluded.

n) On April 26, 2011, the CISU provided an addendum to its report dated December 15, 2010, as a result of the back-up server tapes for NDC becoming located. The addendum noted that as part of its analysis it “attempted to compare the before and after state of the servers, but since an image of the new server was not taken following the refresh this was not possible, making it difficult to ascertain whether the permissions were changed during the refresh process or sometime after”. As a result, the CISU determined that a conclusion as to when the alteration of the permissions occurred cannot be established” and that the file should be closed. The Union takes issue with the CISU’s assertion that a conclusion could not be reached, as the CISU noted that it would be “difficult” to determine when the permissions were changed, not that it was impossible or could not be performed.

o) The Union takes the position that numerous members were extremely upset and discouraged about the disclosure of their WSIB information on the P drive. Several of those members will testify in this matter as representative witnesses to support the Union’s claim for damages on behalf of the grievors.

p) In June 2011, the Employer circulated a memo to all Regional Directors titled “Safeguarding Personnel Information”.

5In addition to the agreed statement of fact, three witnesses testified. Mr. Myciak, Ms. Morrish-Paradis and Ms. Testana.

6Mr. Myciak testified that he first heard of the breach in July of 2010 from a fellow Correctional Officer who referred him to Ms. Morrish-Paradis. When he spoke with her she was upset and told him that her WSIB information and file was available on the P drive. Ms. Morrish-Paradis told him that she had complained to her manager who “told her it was not a big deal”. The same or following day Mr. Myciak went to a computer in the workplace and found the WSIB information “on all the employees” on the P drive.

7Mr. Myciak wrote an email to the Superintendent “probably another week or ten days later” on August 2, 2010. He stated that he informed management on the Friday before the long weekend and it was dealt with on the following Tuesday, that is, the day after a holiday weekend. He testified that during this time he was approached by many of his coworkers about the breach. He stated that he became concerned that employees would suffer harassment as the result of their health information becoming known in the workplace; because they could suffer identity theft; and because employees’ Social Insurance Numbers were revealed.

8In cross examination Mr. Myciak conceded that he spoke with one manager on the Monday of the holiday weekend and then wrote his email at the end of that day, not the Friday before the long weekend. He also agreed that the matter was dealt with the following day. He accepted the suggestion that to his knowledge no one had suffered identity theft, no one had any private information used inappropriately and no one suffered any harassment or financial harm.

9Ms. Morrish-Paradis testified that she thought the information was available on the computer on July 10th but she was not sure and had no documentation to assist her recall. Another employee told her about the information being available on the computer. She then checked a computer and found her own WSIB information on the P drive. During the course of her evidence she admitted to being “computer illiterate” at the time. After finding her information on the P drive she complained to Ms. Testana, her manager, who told her she would look into it. Later that same day Ms. Morrish-Paradis spoke again with Ms. Testana who told her that the information could only be obtained with a password. Ms. Morrish-Paradis took issue with that assertion because when she attempted to find her own information again she could still access the information. Ms. Morrish-Paradis testified that during this later discussion she thought that Ms. Testana found the information accessible without a password. She also said in her evidence that she was of the view that Ms. Testana thought that the entire situation was “no big deal”.

10Ms. Morrish-Paradis said that the information was available for well over a week. She checked the computer later and found she could still access the files. She later complained to Mr. Drykstra and Mr. Myciak.

11She testified that she felt violated because her personal information was “out there” for all to see. She conceded in cross examination that she did not experience any harassment but was quick to say that this was perhaps because staff were very conscientious about not accessing information that was not needed in the course of one’s duties in accordance with Ministry policy. She said it was known that such activity could bring about a suspension or termination of employment.

12Ms. Testana testified that on July 15, 2010, when Ms. Morrish-Paradis first spoke with her about this matter she stopped what she was doing and immediately conducted a search on the P drive. She undertook her own investigation using various search strings and could not find any documents with Ms. Morrish-Paradis’ name that were improperly secured.

13Ms. Testana testified that she took Ms. Morrish-Paradis’ complaint seriously because if any of her own documents had been accessible she would have been very upset. She spent the rest of the day attempting to find a breach and rechecked the situation from time to time over the following few days but found no instance when WSIB files were accessible without a password.

14Ms. Testana notified the Superintendent and Deputies of the breach and was told to continue her search and keep management updated. She was not involved further in this matter.

15The parties set out their positions briefly in the agreed statement of fact document. Those submissions were elaborated further at the hearing but are well summarized as follows:

THE PARTIES’ RESPECTIVE POSITIONS IN BRIEF

• The Union takes the position that the disclosure or posting of employees’ private medical information on the institution’s P drive gives rise to a breach of the Collective Agreement, including Article 9 and 41, as well as a violation of PHIPPA, including but not limited to ss. 29 and 31; the WSIA, including but not limited to section 37(4), 59(6), and 181(3), and; FIPPA, including but not limited to ss. 41, 42 and s. 4 of Regulation 460.

• The Union takes the further position that the availability and accessibility of the grievors’ SIN and other personal information as outlined above constitutes a violation of FIPPA, including but not limited to section 41, 42 and s. 4 of Regulation 460.

• The Union will be taking the further position that the Employer’s failure to adequately investigate this matter and address its causes constitutes a violation of Articles 2, 9 and 41.

• The Union will be seeking the following remedies:

o - A declaration that the Employer has breached the Collective Agreement

o - A declaration that the Employer has violated FIPPA, PHIPPA, and the WSIA.

o - An award of general damages for each grievor in respect of the Employer’s violation of the Collective Agreement and/or statutory provisions cited above

• On a without prejudice basis, the Employer will not argue that the Board has no jurisdiction to make findings or award damages pursuant to FIPPA, PHIPPA, and the WSIA in this particular matter. This is in relation solely to this matter and is without precedent or prejudice to any other matter between the parties.

• The Employer takes the position that there has been no breach of any Collective Agreement article. Further, PHIPPA does not apply to the employer, as the employer is not a health information custodian under s. 3 of PHIPPA, nor is it a recipient pursuant to ss. 7 and 49. FIPPA does not apply as the documents at issue fall within FIPPA’s exception for labour and employment related matters under s. 65(6). In the alternative, in the event that the Board finds that the Employer has breached the Collective Agreement, FIPPA, PHIPPA, or the WSIA, the Employer states that awarding damages would not be appropriate in the circumstances, and in any event the Employer holds the Union to strict proof with regard to proving any alleged damages suffered by its grievors.

16Much case law was provided by both parties. Although I will not provide a list of the jurisprudence provided I assure the parties that it was reviewed in total. Some was of little assistance, but the majority was helpful.

17Turning first to exactly what occurred at NDC in the summer of 2010, I am of the view that there was a breach of employee WSIB information that lasted for a matter of days and not for a few weeks as suggested by Mr. Myciak.

18Ms. Testana’s notes indicate that Ms. Morrish-Paradis approached her on July 15, 2010 and I accept that date. I also accept that Ms. Testana attempted to ascertain whether there was a breach and found none. Ms. Testana’s facility with computers was not challenged by the Union and she testified that she undertook a fairly extensive review that failed to show a breach of confidential information being universally accessible on the P drive.

19I am of the view that the totality of the evidence revealed that there was a breach either just before or during the August long weekend of 2010. Mr. Myciak testified that most of the employees that he worked with complained to him about the breach and were “outraged”. I find it highly unlikely that – given his membership outrage and concern - he then waited almost two weeks to report this breach to management. I also note that the report of the CISU ultimately found that the breach “probably” took place between July 15, and August 2, 2010.

20It is not as apparent how it was that Ms. Morrish-Paradis could access her information during this time. The Employer proposed during oral submissions that Ms. Morrish-Paradis must have been looking at her own information on the Y drive. This may be the case, however this suggestion was never put to her in her evidence and she specifically said that she accessed the P drive. While she admitted that she was not totally facile with a computer, she certainly appeared to understand what the P drive was and how it was accessed.

21It is possible that there were two breaches of this information, one occurring in mid July and the second on the August long weekend. But for the purposes of these grievances, it does not make a meaningful difference.

22The Employer was notified in writing by the Union of the accessibility of this information during the early evening on Monday August 2, 2010. Within less than two hours the Deputy Superintendent responded to Mr. Myciak saying that the matter would be his first priority the following morning. The information was removed from the P drive within twenty-four hours. Once the Employer had received a written complaint about this leak of information it moved quickly.

23I am of the view that the Employer then took all appropriate steps. In an email exchange between Mr. Myciak and the Superintendent on August 16, 2010 it was noted that “this matter is the subject of a CISU investigation.”

24In an August 26 & 27, 2010 email exchange between Mr. Myciak and the Superintendent it was stated that the “Employer is in the process of contacting all current and former staff to advise them of this breach” and “the Information Privacy Commissioner’s Office has been contacted and briefed.”

25The documents provided to this Board revealed that the Employer notified affected employees of the “matter involving the inappropriate storage of electronic personal information in relation to Workplace Safety Insurance Board (WSIB) claims…”. It reported the breach to the Privacy Commissioner of Ontario, the Office of the Chief Information and Privacy Officer, and the Ministry’s Freedom of Information and Protection of Privacy Office. Finally it requested the Correctional Services Investigation Unit to conduct “a comprehensive investigation into the circumstances of this incident.”

26The CISU could not determine who was responsible for the breach. In summary it found:

It is highly likely, in this particular case, a copy of the file WSIB was made and placed on the P-drive of the NDC server by an individual that had access privileges to restricted files which would include a number of administrative employees. This probably occurred between July 15, 2010 and August 2, 2010. The reason for this action, mistake or otherwise, cannot be determined nor can an individual be identified.

27In an addendum to its findings the CISU findings stated:

As part of the analysis process we attempted to compare the before and after state of the servers, but since an image of the new server was not taken following the refresh this was not possible, making it difficult to ascertain whether the permissions were changed during the refresh process or sometime after.

28Following these reports, the Privacy Commissioner wrote to an individual who had complained and stated the following in part:

On May 3, 2011 I received a report from MCSCS with respect to this privacy breach. The report included details of their investigation and their conclusion that MCSCS was unable to determine how the breach occurred, or who was responsible for it and the report also explained that as a result of this incident, the Niagara Detention Centre Superintendent has committed to ensuring that their shared drive is monitored on a regular basis to confirm that all information stored on the shared drive continues to have appropriate security and permission. Lastly the report advised that the MCSCS’s Correctional and Investigation Security Unit (CISU) Inspector had recommended that this investigation be closed and that recommendation had been accepted.

After reviewing MCSCS’s report, I am satisfied with steps taken by MCSCS to deal with this matter and as a result this complaint file has now been closed.

29The Employer urged that given that the Privacy Commissioner was “satisfied” so too should this Board. I understand that view, but that is not the end of the matter. Just because there was a thorough investigation and the breach was terminated, does not mean that there was not a violation of the Collective Agreement and various statues in the first instance and the Union is entitled to have the grievance determined.

30It is important to recall that the Union did not allege bad faith or malice. It did not take exception to the Employer’s characterization of this as an inadvertent breach. Where the disparity arose is regarding the consequences of such a breach.

31The parties agreed that this decision is without prejudice or precedent and should be relatively short. While I appreciate that request, I am of the view that it would be helpful to the parties to understand the reasoning for the ultimate disposition of this matter.

32The Union alleged a violation of Articles 9 and 41 of the Collective Agreement. Article 9.01 states:

The Employer shall continue to make reasonable provisions for the safety and health of its employees during the hours of their employment. It is agreed that both the Employer and the Union shall co-operate to the fullest extent possible in the prevention of accidents and in the reasonable promotion of safety and health of all employees.

33I appreciate the Union’s view that the accessibility of personal and health information of those employees with WSIB files to any and all who cared to sign into a computer at NDC during one or two periods between July to August period in 2010 constituted something short of “reasonable provisions for health and safety” of those employees. It might be observed that putting files containing information that is highly sensitive regarding health and other personal data on a public drive even though secured was ill advised in the first instance. The Employer would remind this Board that the information was generally secured and not accessible to those without the proper authority. However, the fact of this grievance reveals that there were exceptions to that general security. Indeed, the Ministry itself determined within a year to remove “sensitive personnel information” from the P drive “in support of continuing efforts to safeguard” the information.

34In Re The Crown in Right of Ontario (Ministry of Community & Social Services & OPSEU (MacLean, More & Union Grievance) GSB#3155/92 (Barrett) the Union alleged that Article 9 of the Collective Agreement was violated when the addresses of staff were actively being sought by a young offender and the Employer took insufficient steps to ensure the grievors’ confidential information. In upholding the grievance the Board found that the Employer had no confidentiality policy at the time and failed to teach staff to ensure that the young offenders could not access private information regarding staff. The Board stated at page 10:

…..Bargaining unit and contract employees were careless with private staff information because they were simply not aware through training or direction of the potential harm that could result. What was needed, and was finally provided, was direction from above; but the barn door was not closed until the proverbial horse had bolted. ……

Employer counsel further argues that the job of a correctional officer is one that has inherent risks in it and those risks are voluntarily assumed by the correctional officers. That is true, but only to the extent of unavoidable risks, not risks that can be avoided through foresight and planning.

35The Union urged that this case has application to the case at hand because while this Employer had policies in place, it had placed personal employee information on its P drive. The Employer argued that there was nothing inappropriate about that information being on the P drive and the fact that it was accessible to any and all who cared to look was an unfortunate and inadvertent mistake. The Union accepted that the breach of confidentiality was inadvertent as does this Board. I think it obvious that the risk of a breach was completely avoidable had the Employer not placed this information on the P drive in the first instance. This breach of confidential information was, as considered by Vice Chair Barrett in the above cited case “foreseeable and avoidable” in my view. However, for reasons found below, I do not need to make a finding of a violation of Article 9.1 of the Collective Agreement.

36I find that there has been no breach of Article 41 of the Collective Agreement. This provision sets out various terms regarding the coverage, benefits, payment and absences but does not address the treatment of personal information of employees receiving WSIB.

37As seen from the Agreed Statement of Facts, the Union also alleged a breach of the WSIA, the Personal Health Information Protection Act, the Human Rights Code of Ontario, the Workplace Safety and Insurance Act and the Freedom of Information and Protection of Privacy Act.

38The Employer urged that PHIPA does not apply to the dispute before this Board as the Employer is not a “health information custodian.” I agree with that contention. As was noted in Re Revera Long Term Care Inc. & CUPE, Local 2564 (2014), 246 L.A.C. (4th) 340 (Goodfellow), “PHIPA is aimed at health care providers, not Employers.”

39The Employer was prepared, on a without prejudice basis, to concede that this Board has the jurisdiction to make findings under or award damages as the result of FIPPA. I appreciate the Employer’s concession in that regard. Like others before me, I accept that FIPPA is an employment related statute and the substantive rights and obligations found therein are implicit in this collective agreement.

40In considering this matter I was much guided by the case law provided by the parties. In Re Government of Alberta (supra), Arbitrator Sims was asked to determine whether damages should flow as the result of a breach of privacy for a group of employees. In that case, the Employer ordered a peace officer in its Special Investigation Unit to investigate possible employee fraudulent activity in a particular office. The peace officer so assigned undertook credit checks of the employees without authorization from the Employer in order to determine if anyone was in financial difficulty. It was ultimately found by the peace officer that the fraudulent activity was the responsibility of parties outside of the government.

41According to the agreed facts in that case the employees reported the breach to the Province’s Privacy Commissioner and the government conceded that the searches performed were inappropriate and in violation of the Freedom of Information and Protection of Privacy Act. After the breach was revealed the Employer apologized to the affected employees and told them that all records had been destroyed. The investigation undertaken by the Privacy Commission found that the breach was unauthorized and carried out in contravention of the privacy legislation.

42In that decision the arbitrator stated at page 7:

Both parties accepted the proposition that, as arbitrator under this collective agreement, I am entitled to consider a breach of the Freedom of Information and Protection of Privacy Act as a matter that could be adjudicated within the principles set out in by the Supreme Court of Canada in the Weber and Parry Sound decisions. The Union refers to Article 5 of the collective agreement, providing for management’s rights, and argues that those rights are circumscribed by the obligation to follow the law.

28. As a practical matter, this means that the substantive rights and obligations of employment-related statutes are implicit in each collective agreement over which an arbitrator has jurisdiction. A collective agreement might extend to an employer a broad right to manage the enterprise as it sees fit, but this right is circumscribed by the employee’s statutory rights. The absence of an express provision that prohibits the violation of a particular statutory right is insufficient to conclude that a violation of that right does not constitute a violation of the collective agreement. Rather, human rights and other employment-related statutes establish a floor beneath which an employer and union cannot contract.

29. As a result, the substantive rights and obligations of the parties to a collective agreement cannot be determined solely by reference to the mutual intention of the contracting parties as expressed in that agreement. Under McLeod, there are certain terms and conditions that are implicitly in the agreement, irrespective of the mutual intentions of the contracting parties. More specifically, a collective agreement cannot be used to reserve the right of an employer to manage operations and direct the work force otherwise than in accordance with its employees’ statutory rights, either expressly or by failing to stipulate constraints on what some arbitrators regard as management’s inherent right to manage the enterprise as it sees fit. The statutory rights of employees constitute a bundle of rights to which the parties can add but from which they cannot derogate. (Parry Sound (District) Social Services Administration Board v. OPSEU Local 324, 2003 SCC 42 [2003] 2 SCR 157.

43In the matter at hand, the Employer made known personal health information of certain employees known to anyone who cared to log into the P drive of a work computer. Though this breach was inadvertent, it was an action akin to an accident waiting to happen. Accordingly, I am of the view that FIPPA has been breached.

44The Employer argued that FIPPA did not apply because FIPPA the documents at issue fall within FIPPA’s exception for labour and employment related matters under s. 65(6). I disagree. The exceptions that are set out at Section 65 relate to the protection of documents “collected, prepared or maintained” by an institution in relation to:

1. Proceedings or anticipated proceedings before a court, tribunal or other entity relating to labour relations or to the employment of a person by the institution.

2. Negotiations or anticipated negotiations relating to labour relations or to the employment of a person by the institution between the institution and the person, bargaining agent or party to a proceeding or an anticipated proceeding.

3. Meetings, consultations, discussions or communications about labour relations or employment related matters at which the institution has an interest.

45In my view, the intent of those exceptions are to ensure that an employer is not ham-strung from using information it holds in its possession when facing litigation or other labour relations proceedings. The health information at issue was related to WSIA statutory entitlements and does not fit within those articulated exceptions. It does not forgive the Employer from allowing a circumstance where disclosure of personal health information it holds about a group of employees to anyone who logs into a particular computer drive – albeit inadvertently.

46The parties also made submissions about whether there have been violations of various other statutes. In my view, it is unnecessary to make determinations beyond what is set out above.

47For those reasons, the grievance is upheld. In my view, some damages are owing to those grievors who were employed at the time that the grievance was filed. I remit this matter back to the parties to agree upon the amount. In the event this is not possible, the Board should be informed and a short supplemental decision will be issued – without reasons.

48I remain seized.