Access to Information and Protection of Privacy

1
Access to Information andProtection of Privacy
The Information and Privacy Commissioner/Ontario

• 80 Bloor Street West
• Suite 1700
• Toronto, Ontario
• M5S 2V1

2
Meet the Team

• Tom Mitchinson
• - Assistant Commissioner
• Diane Frank
• Manager, Mediation
• Mona Wong
• - Team Leader/Mediator, Municipal Team

3
Overview

• Part 1The Information and Privacy
  Commissioner/Ontario
• Part 2 What are my rights, and how are they
  guaranteed?
• Part 3 Whos covered? Whos not?
• Part 4 Access
• Part 5 Appeals
• Part 6 Privacy

4
The Information and Privacy Commissioner/Ontario
5
Mandate and Role

• The IPC provides an independent review of
  government decisions and practices regulated by
  the following laws
• Freedom of Information and Protection of Privacy
  Act January 1, 1988
• Municipal Freedom of Information and Protection
  of Privacy Act January 1, 1991
• The Commissioner is appointed by and reports to
  the Legislative assembly she remains independent
  of the government of the day to ensure
  impartiality.

6
Mandate and Role (contd)

• Five key roles
• resolve appeals (mediation and/or adjudication)
• investigate privacy complaints (recommendations)
• ensure that government organizations comply with
  the Acts
• research and advice to government on new
  legislation and programs
• public education

7
What Are My Rights, and How Are They Guaranteed?
8
What Are My Rights under the Acts?

• Access to information
• Helps promote an open, transparent and
  accountable government
• Protection of personal privacy
• The right to expect that the personal information
  you give to the government will not be misused

9
How the Acts Protect Your Rights

• 1) The Acts provide a right of access to
  information under the control of government
  organizations in accordance with the following
  principles
• information should be available to the public
• exemptions to the right of access should be
  limited and specific
• decisions on the disclosure of government
  information may be reviewed by the Information
  and Privacy Commissioner (the IPC)
• 2) The Acts protect personal information held by
  government organizations, and provide
  individuals with a right of access to their own
  personal information.

10
Promoting Open Government and Accountability

• Examples of how the Acts work
• Correction of Personal Information recorded in
  the Ministry of Health and Long Term Cares OHIP
  database regarding fraudulent billings
• Disclosure of Expense Accounts of Public Servants
• Disclosure of an institutions accounting records
  regarding aggregate legal costs

11
Whos covered? Whos not?
12
Provincial Government Organizations Covered by
the Act

• The provincial Act applies to
• all provincial ministries
• most provincial agencies, boards and commissions
• community colleges
• and district health councils

13
Municipal Government Organizations Covered by the
Act

• The municipal Act applies to local government
  organizations, including
• municipalities
• school boards
• public utilities
• transit and police commissions
• conservation authorities
• boards of health
• and other local boards

14
Organizations Not Covered

• Federal government organizations
• Covered by separate federal access and privacy
  Acts
• Non-profit or charitable organizations
• Certain public organizations, such as
  universities or hospitals
• Private institutions, however, Federal Bill C-6
  (PIPEDA) covers federally regulated private
  companies

15
Access
16
Access to government records

• You can obtain government records through two
  processes
• - routine disclosure/active dissemination,
• or
• - making a request under the Acts

17
RD/AD

• Routine Disclosure
• Automatic release of certain types of
  administrative or operational records in response
  to informal or formal requests
• Active Dissemination
• Periodic release of general records in the
  absence of a request
• For more information on a proactive approach to
  RD/AD, check out our website.

18
Its better to be proactive some examples

• Routine disclosure of
• Restaurant Inspection Reports by the City of
  Toronto
• Council and Committee Agendas, Minutes, Reports
  setting out Committee and Council decisions,
  Staff Reports and By-Laws by the City of
  Mississauga
• Fire Incident Reports and Building Inspection
  Reports by the City of Mississauga

19
Making a Request under the Acts

• Determine which organization has the relevant
  information.
• Contact the freedom of information officer (FOI)
  of that organization to discuss access.
• Prepare letter or complete form requesting access
  to the info be as specific as possible.
• Include 5 application fee and forward to the
  organizations Freedom of Information and Privacy
  Co-ordinator.

20
Fees

• Apart from the 5 request fee, some other fees
  may apply.
• Other fees include
• Photocopies and computer printouts 20 cents /
  page
• Floppy disks - 10/disk
• For manually searching a record - 7.50 /15
  minutes
• Preparing a record for disclosure - 7.50/15
  minutes
• For developing a computer program or other method
  of producing a record from machine readable
  record - 15 /15 minutes
• No search fee for searching for an individuals
  own personal information, or preparation of the
  record

21
How Will the Government Respond to My Request?

• Government organizations must respond to requests
  within 30 days. An extension may be warranted
  when
• A large number of records have been requested, or
  a search through a large number of records is
  necessary
• Consultations with a third party are deemed
  necessary

22
Exemptions Limited Specific

• MANDATORY
• Relations with government
• (S9 MFIPPA only)
• Cabinet records (S12 FIPPA only)
• Third party information (S10 MFIPPA / 17 FIPPA)
• Someone else's personal information (S14
  MFIPPA/21 FIPPA)

• DISCRETIONARY
• Draft by-laws, record of closed meetings (S6
  MFIPPA only)
• Advice or recommendations (S7 MFIPPA/ 13 FIPPA)
• Law enforcement (S8 MFIPPA/ S14 FIPPA)
• Economic and other interests (S11 MFIPPA/ 18
  FIPPA)
• Solicitor-client privilege (S12 MFIPPA/ 19 FIPPA)
• Danger to safety or health (S13 MFIPPA / 20
  FIPPA)
• Information soon to be published (S15 MFIPPA / 22
  FIPPA)
• Requesters own personal information (S38 MFIPPA
  / 49 FIPPA)

23
Appeals When Does the IPC Become Involved?
24
Appeals -- The IPCs Role

• If you are dissatisfied with an organizations
  response to an access or correction request, you
  can appeal this decision to the IPC.
• The IPC acts as a tribunal in such matters, and
  has the power to order the organization in
  question to disclose or correct information.

25
When Can I File an Appeal? Some Examples

• If you
• have been denied access to some or all of the
  requested information
• disagree with the fee being charged
• do not receive a response within 30 days
• do not agree with the reason given for a time
  extension
• have been denied when requesting a correction to
  your personal information
• are informed that an institution intends to
  disclose your business or personal information
  to someone else

26
Appeal Process

• Within 30 days of receiving a decision from the
  organization you must
• write a letter to the IPC explaining why you
  disagree with the decision, or use the Appeal
  Form on our Web site
• include a copy of your original request and the
  organizations response
• include the appeal fee

27
Appeal Fees

• The Acts were amended in 1996 to include fees for
  filing an appeal
• 10.00 if the request is for your own personal
  information
• 10.00 if the request is to correct your own
  personal information
• 25.00 if the request is for general records or
  someone elses personal information

28
How Does the IPC Handle Appeals?

• The IPC will examine the situation and may
  contact you or the government organization for
  more information (Intake).
• The appeal may be dismissed at this stage.
• If not, the appeal will proceed to mediation, the
  IPCs preferred method of dispute resolution
• If the appeal is not resolved through a mediated
  settlement, it will proceed to adjudication, and
  an order will be issued.

29
Privacy
30
Whom do you want to have access to your personal
information?

• Know your rights.

31
What is Personal Information?

• Personal information is recorded information
  about an identifiable individual. Some examples
  are
• name
• address
• sex/marital status/sexual orientation
• age
• education
• medical/employment history
• other

32
The Governments Duties

• The Acts require the Government to protect the
  privacy of your personal information.
• There are rules that specify how the Government
  may collect, retain, use, disclose, and dispose
  of personal information.

33
When Can I Make a Privacy Complaint?

• If you believe that
• a provincial or municipal government
  organization has failed to comply with one of the
  Acts
• and that your privacy has been compromised as a
  result

34
What Happens When IPC Receives a Privacy
Complaint?

• The IPCs goal is to assist government
  organizations in taking whatever steps are
  necessary (e.g. policies, procedures, training)
  to prevent future occurrences.
• Intake staff attempt to resolve complaints
  informally, liaising with the relevant government
  organization.
• Complaints not resolved during intake will be
  streamed to the investigation stage of the
  process.
• A mediator is assigned to investigate the
  complaint.
• At the conclusion of the investigation, the
  mediator prepares a report. Any report containing
  recommendations is published on our Web site.

35
Privacy Investigation Reports

• Province of Ontario Savings Office (POSO)
• - the POSO wanted to survey account holders to
  evaluate their reaction to the potential
  privatization of the Savings Office, and
  disclosed to an outside polling firm the account
  holders names and addresses, SIN numbers,
  account numbers and balances
• Family Responsibility Office (FRO)
• - the FRO intended to send multiple
  Cost-of-Living Allowance notices to a number of
  employers who have numerous support payers on
  staff, but inadvertently sent the multiple
  notices to one of the payers in each package

36
Privacy Investigation Reports (contd)

• Ministry of Health and Long Term Care (MOHLTC)
• - After obtaining a patients records from a
  hospital, the Ministry forwarded a copy of the
  file to the patient. The patient informed the
  Ministry that her file included records relating
  to another patient
• Note In most cases, our privacy complaint
  investigations deal with the inadvertent
  disclosure of personal information and
  institutions, for the most part, are anxious to
  have the assistance of our office in putting
  measures in place to prevent any possible
  reoccurrence.

37
Other Legislation Protecting Your Privacy

• Personal Information Protection and Electronic
  Documents Act (federal legislation which came
  into force 1 Jan 01) covers federally regulated
  bodies such as banks and airlines
• Privacy of Personal Information Act (provincial
  integrated health and private sector legislation
  proposed by the Ministry of Consumer and Business
  Services)

38
Final Questions
Take steps to keep informed of your rights
39
IPC Resources

• For all IPC publications, orders, information on
  who we are and what we do, links to related
  sites, and lots more, visit our Web site
  http//www.ipc.on.ca
• We also have a variety of materials, with
  information on a broad range of privacy-related
  issues