1

Access to Information andProtection of Privacy

80 Bloor Street WestSuite 1700Toronto, OntarioM5S 2V1

The Information and Privacy Commissioner/Ontario

2

Meet the Team

Tom Mitchinson- Assistant Commissioner

Diane Frank- Manager, Mediation

Mona Wong- Team Leader/Mediator, Municipal Team

3

Overview

Part 1:The Information and Privacy Commissioner/Ontario

Part 2: What are my rights, and how are they guaranteed? Part 3: Who’s covered? Who’s not?Part 4: AccessPart 5: AppealsPart 6: Privacy

4

The Information and Privacy Commissioner/Ontario

5

Mandate and Role

The IPC provides an independent review of government decisions and practices regulated by the following laws:o Freedom of Information and Protection of Privacy Act –

January 1, 1988

o Municipal Freedom of Information and Protection of Privacy Act – January 1, 1991

The Commissioner is appointed by and reports to the Legislative assembly; she remains independent of the government of the day to ensure impartiality.

6

Mandate and Role (cont’d)

Five key roles:o resolve appeals (mediation and/or adjudication)

o investigate privacy complaints (recommendations)

o ensure that government organizations comply with the Acts

o research and advice to government on new legislation and programs

o public education

7

What Are My Rights, and How Are They Guaranteed?

8

What Are My Rights under the Acts?

Access to informationo Helps promote an open, transparent and

accountable government

Protection of personal privacyo The right to expect that the personal information

you give to the government will not be misused

9

How the Acts Protect Your Rights

1) The Acts provide a right of access to information under the control of government organizations in accordance with the following principles:

o information should be available to the publico exemptions to the right of access should be limited and

specifico decisions on the disclosure of government information

may be reviewed by the Information and Privacy Commissioner (the IPC)

2) The Acts protect personal information held by government organizations, and provide individuals with a right of access to their own personal information.

10

Promoting Open Government and Accountability

Examples of how the Acts work:o Correction of Personal Information recorded in

the Ministry of Health and Long Term Care’s OHIP database regarding fraudulent billings

o Disclosure of Expense Accounts of Public Servants

o Disclosure of an institution’s accounting records regarding aggregate legal costs

11

Who’s covered? Who’s not?

12

Provincial Government Organizations Covered by the Act

The provincial Act applies to:

o all provincial ministries

o most provincial agencies, boards and commissions

o community colleges

o and district health councils

13

Municipal Government Organizations Covered by the Act

The municipal Act applies to local government organizations, including:o municipalities

o school boards

o public utilities

o transit and police commissions

o conservation authorities

o boards of health

o and other local boards

14

Organizations Not Covered

Federal government organizationso Covered by separate federal access and privacy Acts

Non-profit or charitable organizations Certain public organizations, such as universities or

hospitals Private institutions, however, Federal Bill C-6

(PIPEDA) covers federally regulated private companies

15

Access

16

Access to government records

You can obtain government records through two processes:

- routine disclosure/active dissemination,

or

- making a request under the Acts

17

RD/AD

Routine Disclosureo Automatic release of certain types of

administrative or operational records in response to informal or formal requests

Active Disseminationo Periodic release of general records in the

absence of a request• For more information on a proactive approach to

RD/AD, check out our website.

18

It’s better to be proactive – some examples:

- Routine disclosure of - Restaurant Inspection Reports by the City of

Toronto- Council and Committee Agendas, Minutes,

Reports setting out Committee and Council decisions, Staff Reports and By-Laws by the City of Mississauga

- Fire Incident Reports and Building Inspection Reports by the City of Mississauga

19

Making a Request under the Acts

Determine which organization has the relevant information.

Contact the freedom of information officer (FOI) of that organization to discuss access.

Prepare letter or complete form requesting access to the info; be as specific as possible.

Include $5 application fee and forward to the organization’s Freedom of Information and Privacy Co-ordinator.

20

Fees

Apart from the $5 request fee, some other fees may apply.

Other fees include:o Photocopies and computer printouts – 20 cents / page

o Floppy disks - $10/disk

o For manually searching a record - $7.50 /15 minutes

o Preparing a record for disclosure - $7.50/15 minutes

o For developing a computer program or other method of producing a record from machine readable record - $15 /15 minutes

o No search fee for searching for an individual’s own personal information, or preparation of the record

21

How Will the Government Respond to My Request?

Government organizations must respond to requests within 30 days. An extension may be warranted when:o A large number of records have been requested, or

a search through a large number of records is necessary

o Consultations with a third party are deemed necessary

22

Exemptions: Limited & Specific

DISCRETIONARY Draft by-laws, record of closed

meetings (S6 MFIPPA only) Advice or recommendations (S7

MFIPPA/ 13 FIPPA) Law enforcement (S8 MFIPPA/ S14

FIPPA) Economic and other interests (S11

MFIPPA/ 18 FIPPA) Solicitor-client privilege (S12 MFIPPA/

19 FIPPA) Danger to safety or health (S13

MFIPPA / 20 FIPPA) Information soon to be published (S15

MFIPPA / 22 FIPPA) Requester’s own personal information

(S38 MFIPPA / 49 FIPPA)

MANDATORY Relations with government

(S9 MFIPPA only) Cabinet records (S12 FIPPA only) Third party information (S10 MFIPPA /

17 FIPPA) Someone else's personal information

(S14 MFIPPA/21 FIPPA)

23

Appeals: When Does the IPC Become Involved?

24

Appeals -- The IPC’s Role

If you are dissatisfied with an organization’s response to an access or correction request, you can appeal this decision to the IPC.

The IPC acts as a tribunal in such matters, and has the power to order the organization in question to disclose or correct information.

25

When Can I File an Appeal? Some Examples:

If you…o have been denied access to some or all of the requested

informationo disagree with the fee being chargedo do not receive a response within 30 dayso do not agree with the reason given for a time extensiono have been denied when requesting a correction to your

personal information o are informed that an institution intends to disclose your

business or personal information to someone else

26

Appeal Process

Within 30 days of receiving a decision from the organization you must:o write a letter to the IPC explaining why you

disagree with the decision, or use the Appeal Form on our Web site

o include a copy of your original request and the organization’s response

o include the appeal fee

27

Appeal Fees

The Acts were amended in 1996 to include fees for filing an appeal:

$10.00 if the request is for your own personal information

$10.00 if the request is to correct your own personal information

$25.00 if the request is for general records or someone else’s personal information

28

How Does the IPC Handle Appeals?

The IPC will examine the situation and may contact you or the government organization for more information (“Intake”).

The appeal may be dismissed at this stage. If not, the appeal will proceed to mediation, the IPC’s

preferred method of dispute resolution If the appeal is not resolved through a mediated

settlement, it will proceed to adjudication, and an order will be issued.

29

Privacy

30

Whom do you want to have access to your personal information?

Know your rights.

31

What is Personal Information?

Personal information is recorded information about an identifiable individual. Some examples are:o name

o address

o sex/marital status/sexual orientation

o age

o education

o medical/employment history

o other

32

The Government’s Duties

The Acts require the Government to protect the privacy of your personal information.

There are rules that specify how the Government may collect, retain, use, disclose, and dispose of personal information.

33

When Can I Make a Privacy Complaint?

If you believe that…

o a provincial or municipal government organization has failed to comply with one of the Acts

o and that your privacy has been compromised as a result

34

What Happens When IPC Receives a Privacy Complaint?

The IPC’s goal is to assist government organizations in taking whatever steps are necessary (e.g. policies, procedures, training) to prevent future occurrences.

Intake staff attempt to resolve complaints informally, liaising with the relevant government organization.

Complaints not resolved during intake will be streamed to the investigation stage of the process.

A mediator is assigned to investigate the complaint. At the conclusion of the investigation, the mediator

prepares a report. Any report containing recommendations is published on our Web site.

35

Privacy Investigation Reports

Province of Ontario Savings Office (POSO)- the POSO wanted to survey account holders to evaluate their reaction to the potential privatization of the Savings Office, and disclosed to an outside polling firm the account holders’ names and addresses, SIN numbers, account numbers and balances

Family Responsibility Office (FRO)- the FRO intended to send multiple Cost-of-Living Allowance notices to a number of employers who have numerous support payers on staff, but inadvertently sent the multiple notices to one of the payers in each package

36

Privacy Investigation Reports (cont’d)

Ministry of Health and Long Term Care (MOHLTC)

- After obtaining a patient’s records from a hospital, the Ministry forwarded a copy of the file to the patient. The patient informed the Ministry that her file included records relating to another patient

Note: In most cases, our privacy complaint investigations deal with the inadvertent disclosure of personal information and institutions, for the most part, are anxious to have the assistance of our office in putting measures in place to prevent any possible reoccurrence.

37

Other Legislation Protecting Your Privacy

Personal Information Protection and Electronic Documents Act (federal legislation which came into force 1 Jan 01) covers federally regulated bodies such as banks and airlines

Privacy of Personal Information Act (provincial integrated health and private sector legislation proposed by the Ministry of Consumer and Business Services)

38

Final Questions

Take steps to keep informed of your rights

39

IPC Resources

For all IPC publications, orders, information on who we are and what we do, links to

related sites, and lots more, visit our Web site: http://www.ipc.on.ca

We also have a variety of materials, with information on a broad range of privacy-

related issues