INVESTIGATION REPORT

 

 

INVESTIGATION PC-000030-1

 

 

MINISTRY OF THE ATTORNEY GENERAL

INTRODUCTION

 

Background of the Complaint

 

The Office of the Information and Privacy Commissioner (the IPC) received a telephone call from a newspaper reporter about a possible breach of the Freedom of Information and Protection of Privacy Act (the Act) by the Ministry of the Attorney General (the Ministry).  The reporter explained that personal information pertaining to a bail hearing had been faxed to him from one of the Ministry’s Victim/Witness Assistance Program (V/WAP) offices.  The following day, the IPC received a letter from the Ministry regarding the incident.  The Ministry advised the IPC that it was in the process of conducting an investigation, and the Ministry subsequently provided the IPC with a written chronology of the events.

 

Summary of the Ministry’s Chronology of Events

 

The same day he received the faxed document, the reporter contacted the Ministry’s Communications Branch.  The reporter advised that he had received the fax, and explained that it contained confidential personal information, including health information and information concerning previous convictions of an identified young offender who was involved in an ongoing proceeding.  The reporter recognized that the record had been faxed to his office in error, and stated that he intended to write a news story about it.  The reporter told the Ministry that he had already advised the IPC about the disclosure.

 

The Ministry determined that the records at issue were being faxed between two V/WAP offices.  As a result of a dialling error, the records were sent to the reporter’s fax number.  The records were accompanied by a standard fax cover sheet advising the recipient that the information may be privileged and confidential and that if the fax was received in error, the recipient should notify the sender immediately by telephone to arrange for the return or destruction of the records.

 

The Acting Director of the V/WAP Program personally retrieved the records from the reporter and received his assurance that no copies had been made by him.

 

The following day, the Ministry sent a private and confidential letter to the identified young offender, explaining what had occurred and confirming that the Ministry had retrieved the records from the reporter.

 

The Ministry then established an internal committee to review its V/WAP faxing policies and procedures.

 

Issues Arising from the Investigation

 

The following issues were identified by the IPC as arising from the investigation:

 

(A)             Was the information in question “personal information” as defined in section 2(1) of the Act?  If yes,

 

(B)              Was the personal information disclosed in compliance with section 42 of the Act?

 

 

 

RESULTS OF THE INVESTIGATION

 

Issue A:          Was the information in question “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act defines “personal information” as recorded information about an identifiable individual, including,

 

            (a)        information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or martial or family status of the individual,

 

            (b)        information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

 

            ...

 

 

            (d)        the address, telephone number, fingerprints or blood type of the individual,

 

            ...        

 

 

(h)        the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual.

 

Based on my review of the records, I find that they clearly contain the “personal information” of the identified young offender, as defined in the various cited paragraphs of the definition contained in section 2(1) of the Act.  This information includes his name, colour, age, sex, martial status, date of birth, address, medical information, the charges laid against him and the amount and conditions of bail.

 

I also find that the records contain the personal information of a second individual, an alleged victim in the ongoing proceedings, including his name and a statement made to the Toronto Police Service regarding the incident.

 

The Ministry does not dispute these findings.

 

 

Conclusion:    The information in question was personal information as defined in section 2(1) of the Act.

 

Issue B:           Was the personal information disclosed in compliance with section 42 of the Act?

 

Section 42 of the Act sets out a number of circumstances under which an institution may disclose personal information. 

 

Having reviewed these provisions, I find that none are applicable in these circumstances.

 

The Ministry does not dispute this finding.

 

Conclusion:    The disclosure of personal information was not in compliance with section 42 of the Act.

 

OTHER MATTERS

 

During the course of our investigation we determined that the records contained the personal information of an alleged victim.  We asked the Ministry to notify this individual that his personal information had been disclosed.  The Ministry agreed, and sent a letter to the last known address of this individual.  The letter was returned and, although the Ministry made efforts to obtain a current address, notification of this individual was not possible.

 

During the course of our investigation, the Ministry committee completed its review of the V/WAP faxing policies and procedures, and provided our office with a draft for review and comment.  The IPC provided input and advice to the Ministry, which was incorporated into the final version of the policies and procedures.

 

The Ministry provided the IPC with a copy of the final version the policies and procedures, entitled V/WAP Confidential Information Faxing Procedures.  This document is attached as Appendix A.

 

It is evident from our review of these policies and procedures that, in preparing the document, the Ministry considered and applied the various options outlined in the IPC’s paper entitled Guidelines on Facsimile Transmission Security.

 

In the course of developing these policies and procedures, the Ministry considered the feasibility of requiring encryption of all faxed records.  The Ministry rejected this option on the basis that it would be incompatible with the administration of the V/WAP Program.  The Ministry explains that encryption would delay transmission of this time-sensitive information, and also that when information is sent directly to victims, these individuals would generally not have access to the necessary fax technology to decrypt the documents.

 

The Ministry has also upgraded the fax machines in the various V/WAP Offices, and all of them now have a speed dial feature which will reduce the risk of a dialling error.

 

As part of the implementation of the new policies and procedures, V/WAP offices are required to post a standardized notice prepared by the Ministry committee in the vicinity of each fax machine.  This notice summarizes the steps that should be followed when faxing personal and confidential information.  The committee also prepared a revised fax cover sheet for use in all V/WAP offices.  Both of these documents are included as attachments to Appendix A.

 

 

The Ministry also advised the IPC that it intends to adapt the new V/WAP faxing policies and procedures for use throughout the Ministry.

 

CONCLUSIONS

 

I have reached the following conclusions based on the results of our investigation:

 

1.                  The information in question was personal information as defined in section 2(1) of the Act.

 

2.                  The disclosure of personal information was not in compliance with section 42 of the Act.

 

 

FINAL COMMENTS:

 

I commend the Ministry and the V/WAP Program for the prompt action taken in retrieving the faxed records and for notifying and attempting to notify the individuals whose personal information was contained in them.  As well, Ministry officials should be commended for the steps they have taken to address this particular situation on a systemic basis, through the establishment of the Ministry committee and the development of the new V/WAP policies and procedures.

 

RECOMMENDATIONS:

 

I recommend that the Ministry adapt the V/WAP Confidential Information Faxing Procedures for implementation throughout all other Ministry offices. 

 

By July 10, 2001, the Ministry should provide the IPC with proof of compliance with the above recommendation.

                                   

 

           

 

 

Original signed by:                                                                                                                                                                                                     

Tom Mitchinson                                                          Date:

Assistant Commissioner

 

 

 

 

 

APPENDIX A

 

 

VICTIM WITNESS ASSISTANCE PROGRAM

CONFIDENTIAL INFORMATION FAXING PROCEDURES

 

 

OVERVIEW

 

Sending or receiving sensitive or personal information can have serious implications for privacy, confidentiality and security.  Much of the information handled by the Ministry of the Attorney General is private or confidential.  All employees of the Ministry have a duty on behalf of the public to be vigilant when handling such information.  Faxing errors compromise confidentiality and have implications pursuant to the Freedom of Information and Protection of Privacy Act.

 

CONTEXT

 

The Victim Witness Assistance Program is often required to send and receive such information on an urgent basis.  Generally speaking, personal and confidential information should not be faxed.  The procedures contained in this document are intended to balance recognition of the fact that in many circumstances it is necessary for such information to be sent via fax, and minimize the risk of inadvertent disclosure of personal and confidential information through faxing.

 

A large number of faxes sent to and from V/WAR offices involve cases where victim safety is an issue.  Faxes containing confidential information are sent between V/WAR offices within different Courthouses.  Documents are also faxed to victims of crime, either directly, or through a shelter or other agency.  Both the May/lies In quest and the Joint Committee on Domestic Violence recommended that information be provided to victims as soon as possible.  It is therefore good practice to contact the victim of a domestic violence offence as soon as possible after a charge has been laid and the defendant has appeared in court.  Early contact is necessary in order to enhance safety of victims and to begin to build a relationship with the complainant.  In order to understand the often complicated issues surrounding a particular victim̓s situation, the V/WAR staff must have access to some of the information within the Confidential Crown Instructions which are prepared by the police for the Crown Attorney for the purposes of the prosecution.  Quite often the only practical and expedient manner of conveying the information will be to fax it to the V/WAR offices.  This is particularly true when information needs to be conveyed to a remote community on an urgent basis.

 

SUGGESTED PRACTICES TO ENSURE CONFIDENTIALITY

 

Many of the documents handled by V/WAR will contain personal and confidential information.  Prior to faxing such documents consideration should be given to the following:

 

 

•                     Are other methods of transmission feasible?

•                     Is the information of such a nature that it needs to be conveyed immediately?

•                     Can any of the identifying information be blocked out of the document?

•                     Is it possible to fax a limited amount of information with the balance to follow via mail or courier?

•                     If there are any questions regarding the above considerations, a manager should be consulted.

 

Once it has been determined that the document needs to be faxed, consideration should be given to the following procedures:

 

•                     Notify the intended recipient that you are faxing the information, and confirm the destination fax number.  The recipient should stand by to receive the material.

•                     Double-check the entered fax number on the display screen on the fax machine.

•                     Whenever possible, enter frequently used numbers into the speed dial of the fax machine to minimize error in entering the number.

•                     Ensure that there are no locations accessible by speed dial that are public.

•                     Always use a confidential fax cover sheet containing a confidentiality clause and clearly indicate the sender̓s name, the recipient̓s name, and the relevant contact information.

•                     The confidential fax cover sheet should request that the recipient call the sender to confirm receipt of the fax.  If such a call is not received, the sender should follow up to ensure the document was received.

•                     Fax confirmation sheets should be kept stapled to a copy of the material sent.

 

All offices required to send or receive personal and confidential information should consider the following:

 

•                     Where operationally feasible, delegating to a limited number of employees the responsibility of transmitting and receiving such information to reduce the possibility of faxing errors and the possibility of faxes being reviewed by any person other than the intended recipient;

•                     Reducing the risk of incoming faxes being reviewed by unauthorized personnel by ensuring that, where possible, the fax machine is located in a private area;

•                     Keeping a log containing daily fax activity reports in the event that follow up is required.

 

                                                                                                                                 February 6, 2001

 

Ministry of the                         Ministère du

Attorney General                     Procureur général

 

Branch

 

720 Bay Street                        720 rue Bay

Toronto ON M5G 2K1           Toronto ON M5G 2K1

Phone:                                                     Télé:

Fax:                                                         Téléc.:

 

 

 

 

 

 

 

ATTENTION

This facsimile may contain PRIVILEGED AND CONFIDENTIAL INFORMATION only for use of the Addressee(s) named below.  If you are not the intended recipient of this facsimile or the employee or agent responsible for delivering it to the intended recipient, you are hereby notified that any dissemination or copying of this facsimile is strictly prohibited.  If you have received this facsimile in error, please immediately notify us by telephone to arrange for the return or destruction of this document. Thank You.

 

A AVERTISSEMENT

Le présent document télécopie peut contenir des RENSEIGNEMENTS PRIVILEGIES ET CONFIDENTIELS destinés exclusivement aux personnes dont le nom est mentionné ci-dessous.  Si vous n’êtes pas le destinataire de ce document ni l’employé ou l’agent responsable de le délivrer à son destinataire, vous êtes par la présente avisé qu’il est strictement interdit de distribuer ou copier ce document.  Si  celui-ci  vous êtes parvenu par erreur, veuillez nous en aviser immédiatement par téléphone pour arranger le retour ou la destruction de ce document.   Merci.

 

 

 

 

 

THIS FAX CONTAINS

PERSONAL CONFIDENTIAL INFORMATION

 

DATE:                                                      

 

RUSH TO: ____                                        _________________

 

FAX#:                                                        _____________________

 

FROM:                                                      ___TEL:                                  ________________

Pages Including Cover:                                       ________________

 

Person contacted to await receipt of fax:                                              

 

 

 

Please call to confirm you have received this fax

 

 

WHEN FAXING

PERSONAL/CONFIDENTIAL INFORMATION

 

 

 

● ● ●

 

 

 

          1.      Confirm you have the correct fax number entered.

 

 

          2.      Before faxing, call recipient to ensure he or she is waiting to receive it and will call to confirm as soon as the fax is received.

 

 

          3.      Use “Personal Confidential” fax cover sheet,

 

 

          4.      Before pressing “Send” button, check screen on fax machine to ensure you have keyed in the correct number.

 

 

          5.      Check fax confirmation sheet to ensure fax has gone through.  Keep it for your records.