Privacy violation arises out of failure to notify of FOI request

On September 21st, the Information and Privacy Commissioner/Ontario held that a municipality breached the Municipal Freedom of Information and Protection of Privacy Act by failing to notify an affected person of an FOI request.

The complainant discovered that the municipality had released e-mails he had sent to councilors about a planning matter in responding to FOI requests and without providing notice. MFIPPA requires notification of a request for records containing personal information if the head has “reason to believe” their release “might constitute an unjustified invasion of personal privacy.”

The IPC held that the municipality had not met this requirement. It reasoned:

As indicated above, the County disclosed the complainant’s name, address and views and opinions about Hastings Drive without notifying him pursuant to section 21(1)(b). Given the nature of the complainant’s personal information at issue, in my view, the disclosure of at least some of this information might have constituted an unjustified invasion of his personal privacy.

In my view, the complainant should have been notified and given an opportunity to make representations as to why the Emails should not have been disclosed. As noted in Investigation Report MC-000019-1, except in the clearest of cases, fairness requires that the person with the greatest interest in the information, that is, the complainant, be given a chance to be heard. In this matter, he was not given that opportunity.

The complainant had sent his e-mails to politicians about a matter of apparent public interest. The standard for notification is low, but the notice requirement here was at least debatable.

Unfortunately, the IPC does not address the balancing of interests contemplated by the unjustified invasion exemption. For notice to be required there must be “a reason to believe” – a reason based on a provisional application of the unjustified invasion exemption. “Clearest of cases” is not the legal test, and it is wrong to notify simply because “at least some” information responsive to a request is bound to trigger the notification requirement.

This is a mild warning to institutions. There is a statutory immunity that offers some protection from civil claims for failure to notify, but the IPC has shown itself to be strict.

PRIVACY COMPLAINT MC17-35, 2020 CanLII 72822 (ON IPC).

BC arbitrator admits surveillance that captures “sexual relations” in the office

Vernon Professional Firefighters’ Association I.A.F.F. LOCAL 1517 v Corporation of the City of Vernon is a well argued video surveillance case in which Arbitrator Dorsey held that a fire service properly employed video surveillance in response to a suspicion that documents had been taken from a filing cabinet in the (interim) Chief’s office. The surveillance captured two employees having “sexual relations,” an act for which they were terminated.

The Association’s theory was the decision to employ surveillance was a product of “paranoia and distrust” arising out of bad labour relations. The Employer argued the bad labour relations in its favour, ultimately convincing Mr. Dorsey that protecting its information was one concern, but determining who it believed had accessed the information without authorization was an equally legitimate objective in the context. It’s a decision that turns on its facts, though there are some other notable findings. Namely, Mr. Dorsey found that:

  • the installation of surveillance in this context was an  “indirect collection” of personal information under British Columbia’s public sector privacy legislation (para 79);
  • the standard for employing surveillance under public sector privacy legislation and a collective agreement ought to be the same (para 239);
  • having a meeting with staff about the the terminations was a legitimate means of addressing rumors and speculation about the terminations and did not invite a further breach of privacy as alleged (para 93).

Arbitrator Dorsey does suggest, problematically in my view, that surveillance evidence ought to be excluded if collected via “an unjustified employer invasion of employees’ privacy rights.” Like many arbitrators, Arbitrator Dorsey frames the power to exclude evidence as discretionary but links the exclusion analysis to one factor above all others – justification. If the exclusion analysis is to be undertaken reasonably, it must encompass “all relevant factors,” including the impact of any exclusion decision on the administration of (administrative) justice and ongoing labour relations.

Vernon Professional Firefighters’ Association I.A.F.F. LOCAL 1517 v Corporation of the City of Vernon, 2018 CanLII 111669 (BC LA).