The Information and Privacy Commissioner/Ontario issued a notable privacy investigation report on July 8th. It held that a municipality did not “collect” personal information under MFIPPA by receiving unsolicited correspondence. Investigator Ratner said:
I have considered the City’s position. Sections 31 and 32 of the Act both make reference to personal information having been “obtained or compiled” by an institution. In my view, in drafting the Act, the legislature intended the meaning of the term “obtained or compiled” to be different from the term “collect,” which is employed in section 28. Had the legislature intended sections 31 and 32 to only apply to personal information that is collected, it would have used that terminology in those sections.
I note that personal information may come into the custody or control of an institution in a variety of circumstances: it may be actively solicited, it may be passively received, or it may be created by the institution. In my view, the term “obtained or compiled” is intentionally broad, and is intended to accommodate the various ways in which an institution may acquire personal information. This analysis supports the notion that the term “collect” is intended to be interpreted narrowly so as not to apply to situations such as this where correspondence is sent to institutions voluntarily and without solicitation.
All About Information 