On May 14th, the Information and Privacy Commissioner/Ontario dismissed a privacy complaint by a university professor who alleged his university had improperly collected and used his personal e-mails for disciplinary purposes.
The complainant sent e-mails about a weekly event series from his personal account to a list of over 1000 individuals. The emails apparently contained statements that encouraged recipients to “send to friends.” The e-mails were received by one or more University administrators, who forwarded them to other administrators for “operational purposes.” The University ultimately imposed discipline on the complainant based on the content of the e-mails.
The investigator held that the University did not collect the unsolicited e-mails. He reasoned that the use of the terms “obtained and compiled” elsewhere in the Act indicate that the legislature contemplated means of coming into custody or control of personal information other than collection. He also reasoned that the requirement to give notice of collection suggests that collection requires something more active than demonstrated by the University.
Regarding the allegation of improper use, the Investigator held that the e-mails were used by the University for a purpose consistent with the purpose for which they were obtained or compiled:
In this case, the e-mails were obtained by the University on an unsolicited basis. In order to administer its operations effectively, a University is required to review and address correspondence, including e-mails that are received on an unsolicited basis. Based on the information before me, the University compiled the e-mails for the purpose of addressing issues related to the operation of the University. Accordingly, I am satisfied that the University obtained or compiled the e-mails for the purpose of the effective administration of the University.
The finding about unsolicited receipt of personal information is based on an interpretation of FIPPA, but is of relatively broad significance given the parts of FIPPA relied upon by the investigator are neither technical nor unique. The decision also raises a notable jurisdictional issue about records that are obtained for a non-employment related purpose and subsequently used for an employment-related purpose and FIPPA’s employment-related records exclusion.
All About Information 