Speeding Up Criminal Reference Checks

The federal government is implementing new digital technology to speed up the process for obtaining criminal reference checks.  This change will be welcome relief to employers who are required to perform criminal reference checks on employees or prospective employees, such as school boards and social services agencies.  A link to a CTV article on the announcement is here.

Alberta CA Addresses Jurisdiction to Consider Alleged Privacy Breach by Privacy Commissioner

On February 3rd, the Alberta Court of Appeal considered who has jurisdiction to consider an alleged privacy breach by the Alberta Office of the Information and Privacy Commissioner. It held that the proper means to allege a breach of the OPIC’s confidentiality duty in the Alberta Personal Information Protection Act is by filing an application for judicial review and not by seeking appointment of a special adjudicator under the Alberta Freedom of Information and Protection of Privacy Act.

The complainant first filed a complaint to the OPIC under PIPA. He later took issue with the OIPC itself when it copied the respondents on a letter dismissing his complaint as constituting an abuse of process. The complainant alleged a breach of section 41 of PIPA, which imposes a duty of confidentiality on the OPIC that expressly permits disclosures that are necessary for the purposes of conducting an investigation and inquiry. He sought and obtained an order appointing a special adjudicator to investigate a complaint against the Commissioner under provisions allowing for such an appointment in the Alberta FIPPA.

The Court of Appeal held that the adjudicator did not have jurisdiction to hear the complaint because of an exclusion provision in Alberta FIPPA for “a record that is created by or for or is in the custody or under the control of an officer of the Legislature and relates to the exercise of that officer’s functions under an Act of Alberta.” The Court held that the adjudicator (deciding on his own jurisdiction) and the reviewing judge erred by finding that this provision excluded certain records from the right of public access but did not exclude complaints about the disclosure of personal information in such records. It held that absolute exclusion was supported by the plain language of the exclusion and a contextual reading of the exclusion. It commented on the appropriate remedial path as follows:

However, some recourse does exist in situations where the Commissioner has allegedly improperly disclosed confidential information. He acknowledges that his actions are subject to judicial review, that he may face an action based on abuse of public office given his role as a public official and, also, that he is subject to sanction or removal by the legislature should he engage in improper conduct. That said, somewhat ironically, s. 4(1)(d) protects him from the operation of the same statutory complaint mechanisms as apply to others should he improperly disclose confidential information. This result concerned the Adjudicator and the reviewing judge. If it applied, such a mechanism would provide less expensive, cumbersome and uncertain recourse than that available through judicial review or removal from office by the legislature. However, had the legislature wished the Commissioner to be subject to the same sanctions as other people, it could have included an express provision in FOIPPA to create that result while nonetheless protecting him from release of information properly required in the exercise of his functions.

The Court also held that the adjudicator and reviewing judge erred by grounding jurisdiction in section 77 of the Alberta FIPPA, which grants a right to review certain decisions of the Commissioner when acting as head of the OIPC. It held that the Commissioner does not act as head of the OPIC when exercising his adjudicative functions.

The Court’s interpretation of the records-based exclusion has some significance given the existence of similarly worded exclusions in other public sector access and privacy statutes.

Alberta (Information and Privacy Commissioner) v. Alberta (Freedom of Information and Protection of Privacy Act Adjudicator), 2011 ABCA 36 (CanLII).

Retaining Pension Records: New Regulatory Policy

As one can imagine, pension plans can operate for years.  Over the life of a pension plan thousands of documents are generated containing information vital to the operation of the plan itself as well as the personal information of members (and their spouses and beneficiaries).  One question has always been – how long must an administrator retain plan documents and records?

That question has been answered in part by a new policy of the Ontario pension regulator, the Financial Services Commission of Ontario (“FSCO”).  FSCO has finalized a new policy — Management and Retention of Pension Plan Records by the Administrator – containing rules regarding the manner in which plan administrators retain and manage all of the information and records of a pension plan, both current and historical.  The new policy is important given that new pension legislation will expressly require plan administrators to retain records for prescribed periods.

The policy generally divides the records relating to a pension plan into three categories: (i) records pertaining to legislated requirements, (ii) records pertaining to the day-to-day operation of the plan, and (iii) member specific information.  Falling into the first two categories are all documents that create and support the pension plan (i.e., plan texts and funding documents), as well as financial documentation (i.e., actuarial reports and financial statements) and documents relating to governance and administration (i.e., committee meeting minutes and advisor reports).  Member specific information includes personal information used to determine benefit entitlements (i.e., age, years of employment) and details regarding spouses and beneficiaries.

The policy requires administrators to retain documentation pertaining to legislated requirements indefinitely.  The Pension Benefits Act does not currently contain a limit on the retention period for such records.  Administrators are permitted to make decisions regarding the retention period for documents relating to day-to-day administration.

The retention period as it relates to member specific information is contingent on whether the member retains an entitlement under the plan or the entitlement has been paid out in full.  All member specific records must be retained until the last dollar has been paid out to the member and his or her spouse or beneficiary (which could be decades after the member starting participating in the plan).  Following the final payout, administrators are still expected to retain a summary of the member’s information in case a challenge is raised in the future.  Other legislation regarding personal information may also apply to these records (i.e., Freedom of Information and Protection of Privacy Act), but the other legislation will not overrule an administrator’s duties under pension laws.

Clearly, the FSCO policy results in administrators retaining records and information for many, many years.  Even where a plan terminates, it is important for the administrator to retain a summary of all vital information regarding the plan and its members long after the plan is wound up.  Thankfully, the policy permits electronic record retention and allows administrators to convert records into electronic form subject to certain conditions.

This policy is an important read for anyone who sponsors or administers a pension plan or provides services to a plan administrator.  As a matter of good governance, plan administrators should consider whether they have sufficient policies regarding the retention of plan and member information and records and consider preparing a written guideline that complies with the FSCO policy.

Workplace Privacy Here and Now

I had fun speaking at the OBA Institute privacy session today. I did a hot topics presentation on (1) the blurring boundary between work and private life, (2) access to stored communications on corporate systems, (3) PIPEDA application to employment in the provinces and (4) the remedial approach to dealing with employees who breach privacy rules.

Case references here:

HO-010 is quite the case for Ontario health information custodians. It’s controversial because of the following paragraph on dealing with employees who breach privacy rules:

For other staff members of the hospital involved, knowing that all of the details of the disciplinary action imposed will be publicly disclosed, should serve as a strong deterrent. This is especially true if those details also become known to other employees, either through the actions of the aggrieved individual, the custodian, or both. Employees must understand that, given the seriousness of these types of breaches, their own privacy concerns will take a back seat to the legitimate needs of the victims involved to have a full accounting of the actions taken by the health information custodian. Our primary concern must lie with the aggrieved party, whose privacy was completely disregarded.

This statement suggests (very mildly) that employers should publish information about the outcome of the disciplinary process as a means of remedying a data breach that is caused by intentional employee misconduct. As I comment in the slides below, this suggestion should be approached with great caution.

Thanks to the program chairs and the other speakers. I enjoyed the afternoon!

Investigating Computer Abuse – Help for Human Resources

My colleague Kathryn Bird and I presented today at the HRPA 2011 conference on “Investigating Computer System Abuse – Help for HR.” It was our aim to help human resources professionals charged with investigating computer-related misconduct to identify issues, ask proper questions of internal IT and know when to get professional IT forensics and legal help. We covered investigation basics, sources of digital evidence, preservation best practices, interview tips and managing the investigation record. Big thanks to Kevin Lo of Froese Forensics for reflecting on some of our ideas over beers. Slides are below.

Divisional Court Rebuffs Charter Challenge to Health Regulator Investigation Power

On January 17th, the Divisional Court held that the power to issue a summons without judicial authorization that is granted to investigators appointed under the Health Professions Procedural Code complies with section 8 of the Canadian Charter of Rights and Freedoms.

Section 76(1) of the Code gives investigators appointed by a college of a regulated health profession the power to summons a person to give evidence on oath or produce evidence relevant to the subject matter of an investigation. The appellant – a doctor whose license was revoked for engaging in acts of sexual misconduct with three boys – argued that the power is wide-sweeping, prone to misuse and disproportionate in light of the legislative purpose underlying the Regulated Health Professions Act and its Code. The appellant also argued that the power interferes with the public interest in keeping the contents of a Crown brief private.

The Court dismissed this challenge. It held that the power was reasonable based on the following factors:

  • The investigation is a regulatory investigation and not a criminal or quasi-criminal investigation. The Court said, “the fact that the same act may also give rise to a criminal consequence does not mean that when the act is dealt with in the regulatory context, the ‘context’ of the regulatory proceedings is criminal or quasi-criminal.”
  • A power of summons is less intrusive than a power to enter and search a premises because it can be challenged prior to being answered. This ability to challenge is enjoyed by the Crown when it is asked to produce a copy of all or part of a Crown brief.
  • Appointment by a college based on a belief in misconduct on reasonable and probable grounds is a precondition to exercising the summons power.
  • There is a strong public interest in regulating health professionals. The Court rejected an argument that the power to investigate need not extend to doctors’ personal (as opposed to professional) activities. It held that acceptance of this argument would lead to impractical and absurd results.

The Court also dealt with a number of grounds of appeal related to the disciplinary committee’s handling of the appellant’s case that I have not covered here.

Sazant v. The College of Physicians and Surgeon, 2011 ONSC 323 (CanLII).

Facebook Postings Just Cause for Dismissal

The BC Labour Relations Board has found, in a recent decision, that an employer had just cause to terminate two employees who posted on Facebook comments highly critical of the employer and other employees.  The Board dismissed claims that the terminations were an unfair labour practice related to the employees’ support of a successful unionization drive.  Interestingly, the Board dismissed any privacy-related claims by the dismissed employees, given the large number of Facebook friends that they each had (100 and 377 respectively), including other employees of the employer.

SCC Clarifies Test for Access to Trial Exhibits

Paul Broad posted earlier today about Friday’s Supreme Court of Canada judgment on media access to courts and its right to broadcast audio recordings of proceedings. Its companion decision – “Canadian Broadcasting Corporation II” – is much less principled, though does settle a debate about whether access to and use of exhibits is governed by the approach endorsed in Vickery v. Nova Scotia Supreme Court (Prothonotary), [1991] 1 S.C.R. 671 (burden of justification on media) or in Dagenais/Mentuck, [1994] 3 S.C.R. 835 (burden of justification on person or persons opposing access).

In a judgement written by Dechamps J., the Court unanimously held that Dagenais/Mentuck governs with the factors identified in Vickery remaining relevant. The Ontario Court of Appeal took a similar position in a judgement last November.

SCC Considers Media Access to the Courts

In Canada Broadcasting Corp. v. Canada (Attorney General), 2011 SCC 2, the Supreme Court of Canada considered the extent to which the media should have unrestrained access to courthouses and whether the media could broadcast official court audio recordings of proceedings.

The genesis of the case was the passage of rules restricting the areas within certain Quebec courthouses in which reporters could conduct interviews or photograph participants.  While not completely barred from undertaking such activities, the reporters were prevented from doing so in areas in which they had previously operated.  Moreover, the rules prevented the broadcasting of audio recordings of proceedings, both the official recordings as well as recordings made by the reporters themselves.

The Court analysed the case as a question of a restriction on freedom of expression, of which the freedom of the press is an integral part.  Moreover, the Court recognized that media access to the courts is essential to a meaningful “open court” principle, as the vast majority of Canadians obtain their information about, and understanding of, court proceedings from media coverage.

Nevertheless, the Court found that the restrictions, while infringing freedom of expression, were justifiable under the Charter.  Notably, the Court found that it was reasonable to preserve a necessary level of decorum and serenity of hearings, which are essential to the proper administration of justice.  Apparently, the Court was concerned that the ability (and willingness) of witnesses to testify in proceedings was being compromised by the concern over being photographed or subjected to unsolicited questions and interviews.  It was also feared that the broadcast of audio recordings would have a similar detrimental effect, in addition to being overly invasive of the privacy of participants in the process.  Thus, the unrestricted media access was felt to be affecting the proceedings themselves, and potentially undermining trial fairness and the quest for truth.