INVESTIGATION REPORT

 

 

 

INVESTIGATION I96-065M

 

 

A BOARD OF EDUCATION

 

 

 

 

 

December 18, 1996

INTRODUCTION

 

Background of the Complaint

 

This investigation was initiated as a result of a complaint concerning a Board of Education (the Board).

 

The complainant’s son had been using the Board’s bus transportation service to get to school.   While the complainant’s son did not live the required distance from the school to receive bus privileges, nevertheless, the complainant had requested the service due to his son’s medical condition.

 

However, on October 20, 1995, the Board’s Business/Transportation Officer (the Officer) wrote to the complainant advising him that bus service for his son would be discontinued.  The Officer stated that there was some question about the severity of the complainant’s son’s medical condition and, therefore, his need for the service.  When the complainant expressed his concern regarding this decision, the (then) Director of Education (the Director) reviewed the matter and wrote to the complainant on October 31, 1995, stating that the Board had contacted the complainant’s son’s doctor, with the complainant’s permission, and that the doctor had confirmed that it had been “some time” since he had last diagnosed the complainant’s son.

 

The complainant stated that he had not provided his consent to the Board to collect his son’s personal information from his doctor, and was concerned that the Board’s collection of this personal information was not in compliance with the Municipal Freedom of Information and Protection of Privacy Act (the Act).

 

Issues Arising from the Investigation

 

The following issues were identified as arising from the investigation:

 

(A)       Was the information in question “personal information”, as defined in section 2(1) of the Act?  If yes,

 

(B)       Was the Board’s collection of the personal information in compliance with section 28(2) of the Act?

 

            (C)       Was the Board's indirect collection of personal information in compliance with section 29(1) of the Act?

 

RESULTS OF THE INVESTIGATION

 

Section 2(1) of the Act states in part, that "personal information" means recorded information about an identifiable individual, including,

 

(h)        the individual's name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

The information in question was that it had been some time since the complainant’s son had last been diagnosed by his doctor.

 

It is our view that this information met the requirements of paragraph (h) of the definition of “personal information” in section 2(1) of the Act.

 

Conclusion:    The information in question was “personal information”, as defined in section 2(1) of the Act.

 

Issue B:           Was the Board’s collection of the personal information in compliance with section 28(2) of the Act?

 

Section 28(2) of the Act sets out the circumstances under which an institution can collect personal information.  This section states:

 

No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity (emphasis added).

 

The Board stated that the collection of the complainant’s son’s personal information from his doctor was “necessary to the proper administration of a lawfully authorized activity”.

 

The Board stated that it was lawfully authorized to provide educational services to students and that, as part of those services, the Board was also authorized to provide bus transportation to qualified pupils in accordance with its policy.  The Board further stated that the complainant had requested that his son be given bus privileges, even though his son did not live within the usual distance required for permitting such services.  The Board advised that the complainant’s son’s condition was one of the reasons his parents had cited to obtain bus privileges for him. 

 

The Board submitted that, in determining the complainant’s son’s entitlement to bus privileges, it had been necessary to “investigate” his medical condition to see if it necessitated bus transportation. The Board stated that the “investigation” was, therefore, necessary for the proper administration of the Board’s transportation services, which were a part of the Board’s overall responsibility of providing educational services to students.

 

Section 170, paragraph 6 of the Education Act states:

 

Every board shall:

 

provide instruction and adequate accommodation during each school year for the pupils who have a right to attend a school under the jurisdiction of the board.

 

It is, therefore, our view that the Board’s provision of educational services (instruction and accommodation), including the provision of bus services to qualified students, is a lawfully authorized activity.  It is also our view that in order for the Board to be able to determine if the complainant’s son was eligible to receive transportation services based upon his medical condition, it was “necessary” for the Board to collect information relating to this condition.

 

Therefore, in our view, the Board’s collection of the complainant’s son’s personal information was “necessary to the proper administration of a lawfully authorized activity”, i.e. providing qualified students with transportation services,  in compliance with section 28(2) of the Act.  

 

Conclusion:    The Board’s collection of  the personal information was in compliance with section 28(2) of the Act.

 

Issue C:          Was the Board's indirect collection of personal information in compliance with section 29(1) of the Act?

 

Section 29(1) of the Act sets out the circumstances under which an institution can indirectly collect personal information (see Appendix A for complete text of section 29).  Section 29(1)(a) states that an institution shall collect personal information only directly from the individual to whom the information relates unless,

 

(a)        the individual authorizes another manner of collection;

 

The Board stated that the Director had the verbal consent of the complainant to contact his son’s doctor to determine if he was qualified to receive bus privileges.  The Board further stated that it was its experience, in such matters, that doctors generally will not release such information without the necessary consent.

 

The complainant, however, maintained that he had not given his consent (verbal or otherwise) to the Board to contact his son’s doctor directly.  He stated that, had he given his consent to the Board, as the Board maintained, he would have expected that the Board would have required that consent in writing, and not have relied on a verbal telephone conversation.

 

In our view, if the complainant had given his consent to the Board, he would have authorized the indirect collection of his son’s personal information, and the collection would have been in compliance with section 29(1)(a) of the Act.  If, on the other hand, there was no such consent, it is our view that none of the provisions of section 29(1) would have applied and the Board’s collection would not have been in compliance.  However, since we have received conflicting information as the whether or not the complainant gave his consent, we are unable to make a conclusive determination on this issue.

 

We note also that, in the circumstances of this case, if the complainant had been able to obtain the required information directly from his son’s doctor to forward to the Board, this would have, nevertheless, fulfilled the Board’s need for the information.

 

Conclusion:    We are unable to determine conclusively if the Board’s indirect collection was in compliance with section 29(1) of the Act.

 

 

 

SUMMARY OF CONCLUSIONS

 

∙           The information in question was “personal information”, as defined in section 2(1) of the Act.

 

∙           The Board’s collection of the personal information was in compliance with section 28(2) of the Act.

 

∙           We are unable to determine conclusively if the Board’s indirect collection was in compliance with section 29(1) of the Act.

 

 

RECOMMENDATION

 

Although we are unable to determine conclusively if the Board’s indirect collection of the complainant’s son’s personal information was in compliance with section 29(1) of the Act, having considered the circumstances of this case, we recommend that:  the Board take steps to ensure that staff are made aware that personal information should only be collected directly from the individual to whom the information relates, unless that individual has clearly authorized the collection in compliance with section 29(1)(a), or another provision of section 29(1) applies.

 

Within six months of receiving this report, the Board should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

Ogirinal Signed By:                             December 18, 1996       Susan Anthistle                                                                                   Date

Compliance Review Officer

 

 

 

****

 

 

                                                                                                                                   APPENDIX A

 

 

 

29.-(1)  An institution shall collect personal information only directly from the individual to whom the information relates unless,

 

(a)        the individual authorizes another manner of collection;

 

(b)        the personal information may be disclosed to the institution concerned under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act;

 

(c)        the Commissioner has authorized the manner of collection under clause 46(c);

 

(d)       the information is in a report from a reporting agency in accordance with the Consumer Reporting Act;

 

(e)        the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service;

 

(f)        the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or judicial or quasi-judicial tribunal;

 

(g)        the information is collected for the purpose of law enforcement; or

 

(h)        another manner of collection is authorized by or under a statute.