INVESTIGATION REPORT

 

 

INVESTIGATION I93-059P

 

 

MINISTRY OF HEALTH

INTRODUCTION

 

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning the Ministry of Health (the Ministry).

 

The complainant was concerned that the Ministry had disclosed her personal information to the Ontario Breast Screening Program (the OBSP) contrary to the provisions of the Freedom of Information and Protection of Privacy Act (the Act).

 

The complainant had received a letter from the OBSP about a breast screening program.  In this letter, the Director of the OBSP suggested that since the complainant was of "a certain age", she should be aware of certain facts about health risks.  The Director also stated:  "Your name was selected in a confidential manner using your Health Number and your age".

 

The OBSP had asked the Ministry to perform a mailing to women between the ages of 50 and 69, to make them aware of, and to invite them to, local breast screening clinics.  The Ministry had set up a "confidentiality agreement" with Canada Post to perform the mailing from a listing that the Ministry had provided for four test sites.  The listing provided to Canada Post consisted of the names and addresses of women who were between the ages of 50 and 69. 

 

The OBSP had provided the aforementioned form letter to Canada Post.  This form letter did not contain any personal information when provided by the OBSP.  Canada Post then conducted a "mail merge" of the information provided by the Ministry (i.e., the names and addresses from the listing were inserted onto the form letters provided by the OBSP).  Canada Post subsequently sent a letter to each of the targeted individuals.

 

At no time was personal information ever disclosed directly to the OBSP.  The OBSP was not aware as to which individuals had received the letter unless the individual had chosen to contact one of the clinics.  As well, the health number was never disclosed to either the OBSP or Canada Post.

 

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question "personal information", as defined in section 2(1) of the Act?  If yes,

 

(B)       Was the disclosure by the Ministry to Canada Post in accordance with section 42 of the Act?

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question "personal information", as defined in section 2(1) of the Act?

Section 2(1) of the Act states, in part:

 

"personal information" means recorded information about an identifiable individual, including,

 

(a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

 

...

 

(d)       the address, telephone number, fingerprints or blood type of the individual,

...

 

(h)        the individual's name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;  (emphasis added)

 

As already mentioned, the listing provided to Canada Post consisted of the names and addresses of women who were between the ages of 50 and 69. 

 

In our view, the information contained in this listing met the requirements in paragraphs (a), (d), and (h) of the definition of "personal information" in section 2(1) of the Act.

 

Conclusion:    The information in question was "personal information", as defined in section 2(1) of the Act.

 

 

Issue B:           Was the disclosure by the Ministry to Canada Post in accordance with section 42 of the Act?

 

Section 42 of the Act prohibits the disclosure of personal information by an institution, except in certain circumstances.  Section 42(c), in particular, states:

 

An institution shall not disclose personal information in its custody or under its control except,

 

 

(c)        for the purpose for which it was obtained or compiled or for a consistent purpose; (emphasis added)

 

Section 43 of the Act states:

 

Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might reasonably have expected such a use or disclosure.

The Ministry stated that it had collected the personal information in question on the Registered Persons Database for health planning and co-ordination purposes.  This is substantiated by the notice of collection appearing on the Registration for Ontario Health Coverage form which states that:

 

Collection of the information on this form is for the ...  administration of the Health Insurance and the Ontario Drug Benefit Acts and for health planning and coordination.  It is collected/used for these purposes under the authority of the Ministry of Health Act, section 6(1,2), Health Insurance Act, section 4(2)(b,f), 10, 11(1) and Regulation 689/86 under the Ontario Drug Benefit Act, section 2.

 

The Ministry further stated that the Minister of Health has the power to oversee and promote the health and physical well-being of the people of Ontario pursuant to section 6(2) of the Ministry of Health Act which states:

 

It is the function of the Minister and he or she has power to carry out the following duties:

 

...

 

2.         To oversee and promote the health and the physical and mental well-being of the people of Ontario.

 

...

 

Thus, one of the purposes for which the Ministry had obtained the personal information in question was for "health planning and co-ordination".  It is our view that "health promotion" (from section 6(2) of the Ministry of Health Act) is compatible with health planning and co-ordination.  In "promoting health", the Ministry disclosed the personal information to Canada Post so that the OBSP letter could be sent to targeted individuals.  It is our view that these indiviuals could have reasonably expected such a disclosure of their personal information.  Therefore, the Ministry's disclosure of the personal information to Canada Post was for a consistent purpose, in accordance with section 42(c) of the Act.

 

Conclusion:    The disclosure of the personal information by the Ministry to Canada Post was in accordance with section 42 of the Act. 

 

 

Other Matters

 

During the course of this investigation, the following matter was identified which should be brought to the institution's attention

 

In the "Background of the Complaint", we indicated that the Ministry had set up a "confidentiality agreement" with Canada Post to perform the mailing.  We reviewed this agreement and noted that it was signed only by the OBSP and Canada Post.  The Ministry did not sign this agreement but sent a covering letter to Canada Post, stating that the agreement was "acceptable" to the Ministry.  Since the Ministry has custody and control of this personal information, it is our view that the Ministry should also have signed the agreement.

 

 

SUMMARY OF CONCLUSIONS

 

●         The information in question was "personal information", as defined in section 2(1) of the Act.

 

●         The disclosure of the personal information by the Ministry to Canada Post was in accordance with section 42 of the Act. 

 

 

 

RECOMMENDATIONS

 

We recommend that the Ministry sign such agreements since it has custody and control of the personal information in question.

 

Within six months of receiving this report, the Ministry should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

 

 

Original signed by:                                          January 13, 1994            

Susan Anthistle                                               Date

Compliance Review Officer

 

 

****