OPC issues significant findings in response to online reputation complaint

The IPC recently responded to a complaint by a dentist about the the RateMDs review site, at which several individuals purporting to be her patients had posted anonymous reviews. The OPC findings are significant favor the public’s right of expression over doctors’ interest in personal privacy.

The OPC first held that RateMDs did not need the complainant’s consent to publish the reviews because the reviews constituted so-called “mixed personal information” – a term used by the IPC/Ontario to refer to personal information that relates to more than one individual. The Federal Court of Appeal test from Pirrie calls for a very contextual balancing of interests in addressing access requests for such information. In this case, the OPC applied a similar approach to deny the complainant the ability to block the publication of others’ opinions about her. It said:

Giving effect to the Complainant’s lack of consent would mean the interests of the patients who are consenting to the publication of their reviews and ratings would not be respected, and the benefits to the public more broadly would be negated. We are therefore of the view, based on a balancing of interests of the Complainant with those of the reviewers and the public more generally, that this aspect of the complaint is not well-founded.

The OPC held that RateMDs’ accuracy and correction obligations under PIPEDA require it to correct ratings that are inaccurate, incomplete or out-of-date. However, it also acknowledged that challenging the inaccuracy of an anonymous review is difficult and held that that PIPEDA will “generally” prohibit review sites like RateMDs from disclosing the identity of anonymous reviewers.

Finally, OPC held, that RateMDs should discontinue a paid service that allowed doctors to hide up to three reviews “deemed to be suspicious.” While this finding is understandable, it is ironic that a privacy regulator has applied our commercial privacy statute to take away a potential privacy remedy. All in all, that is what this finding does: it makes clear that PIPEDA is not an effective remedy for challenging seemingly fair reviews posted on a bona fide review site. Those aggrieved must go to court and sue in defamation or (if they are up for a challenge) breach of privacy.

PIPEDA Report of Findings #2020-002, June 30, 2020.

Alberta QB deals with scope of application of Alberta health privacy statute

On September 12, the Alberta Court of Queen’s bench issued a decision in which it held that the Alberta Health Information Act may apply to information about individuals other than those who receive a health service that is collected when a health service is provided to an individual.

The case involves an FOI request filed by the daughter of two residents of a health facility. The daughter sought records of her personal information in the custody of the facility after it imposed conditions on her visitation privileges. The facility denied access to a number of records on the basis that references in the records to the daughter constituted the health information of her parents. The Court agreed, and said the following:

These hypotheticals suggest that “other information about an individual that is collected when a health service is provided to the individual” includes, at the very least, information about the mental or physical health of others that relates to the physical and mental health of an individual or a health service provided to an individual and is collected when a health service is provided to an individual. It may affect the diagnosis or the health service provided to the patient.

Using this standard to determine whether any of the information in the records of Covenant Health about Ms. McHarg is classified as health information under the Health Information Act, the adjudicator must ask two questions. First, is there any information in Covenant Health’s records about Ms. McHarg that relates to or may directly affect the physical and mental health of Ms. McHarg’s parents or a health service provided by Covenant Health to Ms. McHarg’s parents? Second, if so, was this information collected when Covenant Health provided a health service to her parents?

The Court also addressed two issues pertaining to the application of exemptions under the Alberta Freedom of Information and Protection of Privacy Act. It found in favour of the facility on all issues and quashed the OIPC’s disclosure order.

Covenant Health v Alberta (Information and Privacy Commissioner), 2014 ABQB 562 (CanLII).

OPC issues important decision for federally-regulated employers on access to “mixed personal information”

Federally-regulated employers should pay heed to OPC report of findings 2013-004, issued in July 2013. It contains the most detailed guidance on how to administer requests for access to personal information about employees that is received from other employees in confidence – information sometimes called “mixed personal information.”

The OPC adopts the case-by-case balancing of interests approach endorsed by the Federal Court of Appeal in a Privacy Act case called Pirrie: “In determining the right to have access to this information under PIPEDA, the interests of the individuals concerned should be balanced against each other along with the public interest for and against disclosure.”

This test does not support a “bright line,” so the OPC guidance is welcome. It uses 2013-004 to distinguish between two scenarios:

  • The OPC held that notes containing peer feedback that an employer received in conducting a routine performance feedback process were exempt from the right of access. It helped that the employer had provided the complainant with a high-level summary of feedback and helped that the complainant himself had expressly promised to his peers that their feedback would be given anonymously.
  • The OPC distinguished its prior treatment of information gathered in an internal investigation from witnesses when the investigation led to the complainant’s dismissal from employment. The OPC affirmed the complainant’s right of access in this scenario, but specified that the complainant required access to her personal information “as part of her efforts to be re-instated in her position,” which suggests that the complainant had either commenced litigation or that litigation was reasonably contemplated. The OPC also noted, “there were no formal assurance made that the information the investigation participants provided would be kept confidential.”

This gives federally-regulated employers some indication of the OPC’s perspective on a common and significant access issue, though the analysis invited by the Pirrie test is very contextual and outcomes will differ based on a wide range of potentially relevant facts. While the OPC’s decision on access to information gathered from witnesses in an internal investigation might be of some concern to employers, employers cannot provide witnesses with an absolute promise of confidentiality given witness statements may be producible in litigation. If the OPC decision merely suggests that witness statements are likely to be accessible under PIPEDA when litigation is reasonably contemplated it will be rather harmless in its impact.

Bank provides former employee with insufficient access to his personal information, 2013 CanLII 71855 (PCC).

Ontario Court Requires Notice to Non-Parties Whose Privacy Interests at Stake in Production Dispute

On August 15th, the Ontario Superior Court of Justice deferred a motion for production of medical records so two non-parties could be given notice of the production motion.

The action was by a patient of a psychiatric facility who was allegedly assaulted by two other patients. The facility resisted production of records in its custody based on a concern for the privacy of the non-parties, but also did not dispute the records’ relevance.

Mr. Justice Ricchetti ordered production of occurrence reports that recorded facts pertaining to the alleged assaults without requiring notice. Ricchetti J. suggested that the records contained information that was as much about the plaintiff as the two non-parties. He also recognized the occurrence reports were not about the provision of care though they were placed in both of the non-parties’ patient records. Though these factors led him to order production without notice to the non-parties, Ricchetti J. did order the non-parties’ attending physicians to be given notice and an opportunity to object based on criteria for doing so set out in the Mental Health Act, ordered redaction of names and identifying information and ordered receiving counsel to safeguard copies of all information received.

Regarding production of other medical records, Ricchetti J. ordered that notice be given to the affected non-parties. He said:

Rule 30.10 of the Rules of Civil Procedure requires that any motion seeking third party disclosure be on notice to the third party. The real third party in this case are the patients. The purpose of this rule is to ensure that the party whose documentation is to be disclosed has an opportunity to object or consent or request some limitation on the disclosure. This purpose, in my view, is defeated if the “real” owner or person with the “real” interest in the disclosure of the documentation or information is not given notice.

I cannot imagine why a request for disclosure of the patient’s medical records containing PHI should not be on notice to the patient. It is the patient’s PHI, protected by the PHIPA, that disclosure is sought.

In my view, where an order is sought under s.41(1)(d) of the PHIPA or s.35(5) of the MHA, such an order should be obtained, if at all possible, on notice to the patient whose record is sought and not just the custodian of the patient’s medical records containing the PHI.

This is a sensible application of the power over procedure. Note, however, that health information custodians are authorized under PHIPA to disclose personal health information for the purpose of providing production without any notification requirement. Is notification “if at all possible” in the event of dispute too conservative and too costly? Should courts require health information custodians (who are accountable to privacy regulators under statute) to attempt to negotiate a reasonable scope of production and reasonable protective terms before stepping in? These are important questions that are yet to be answered.

M.L. v. Homewood Health Centre Inc. et al, 2011 ONSC 4790 (CanLII).

Case Report – IPC interprets scope of new “compassionate reasons” exception

The Office of the Information and Privacy Commissioner/Ontario has released its first two orders interpreting the new “compassionate reasons” exception in section 14(4)(c) of MFIPPA and section 21(4)(d) of FIPPA.

In 2006, the government passed Bill 190, the Good Government Act. Schedule N of this omnibus bill created a new provision in both acts to create an exception to the mandatory “unjustified invasion of personal privacy” exemption to the right of public access. The carve out allows “close relatives” of a deceased individual to obtain personal information notwithstanding any invasion of privacy where disclosure is “desirable for compassionate reasons.”

MO-2237 – Test articulated

In MO-2237, dated October 19, Assistant Commissioner Beamish ordered a police services board to disclose records created in the course of an investigation into the death of the requestor’s daughter based on the new exception.

Mr. Beamish first held that the exception applies to the personal information of a deceased individual that is mixed with another individual’s personal information. This is significant because the investigations that are likely to produce records litigated under the exception will often include “mixed personal information.” In this case, the mixed personal information was provided by the deceased’s former roommate and was about her interaction with the deceased.

Mr. Beamish then gave meaning to the trigger language, “desirable for compassionate reasons.” He explained that the provision requires a “broad and all encompassing” analysis that involves consideration of both the surviving family member’s need for the information and the privacy interest of both the deceased and any other person whose personal information is mixed with that of the deceased.

Balancing these factors, Mr. Beamish ordered disclosure of most of the information in dispute. While it is not surprising that that deceased’s own privacy interests did not prevail against her mother’s interest (given they were not estranged), it is more significant that Mr. Beamish ordered disclosure of the roommate’s personal information, especially because it appears the information was partly about the roommate’s own health. He characterized the issue as “difficult” but after careful consideration held that the balance weighed in favour of disclosure.

MO-2245 – Limitations made clear

On November 9th, the IPC issued a second order interpreting the exception. It is significant for its rejection of two positions that weigh against disclosure.

First, the IPC made clear a head should readily accept the requestor’s expressed compassionate grounds:

Having been informed that disclosure of the videotape and photographs may be upsetting and disturbing, in my view the appellant is in the best position to determine whether disclosure is in her interests. In general, institutions may have an obligation to inform spouses and close family members of the nature of the information they have requested under section 14(4)(c); for example if it is particularly graphic or disturbing. However, having provided that advice, it does not then rest with an institution to make decisions on behalf of that grieving spouse or relative as to whether disclosure is in their best interests. A well-informed adult can make that decision on their own behalf.

Second, the IPC made clear that a head should not consider a disclosure to the requestor a disclosure to the world in considering the new exception. While this concept is generally accepted as a valid means of ensuring an individual’s right of privacy is not lessened because of the motivations or identity of a specific requestor, the IPC held that the new exception is unique in that it contemplates disclosure to a specific individual.

MO-2237 (19 October 2007, O.I.P.C.) and MO-2245 (9 November 2007, O.I.P.C.).