PRIVACY COMPLAINT REPORT

 

 

            PRIVACY COMPLAINT NO. MC-040015-1

 

 

           City of Greater Sudbury

 

 

 

 

 

 

 

PRIVACY COMPLAINT REPORT

 

 

PRIVACY COMPLAINT NO.                   MC-040015-1

 

 

 

INVESTIGATOR:                                       Tara Coccimiglio

 

 

 

INSTITUTION:                                            City of Greater Sudbury

 

 

 

BACKGROUND AND SUMMARY OF COMPLAINT:                      

 

The Information and Privacy Commissioner/Ontario received a complaint under the Municipal Freedom of Information and Protection of Privacy Act (the Act), regarding the City of Greater Sudbury (the City) and specifically that the City had contracted Greater Sudbury Utilities, formerly Sudbury Hydro (the Utility) to provide billing services for the City’s water/waste customers.  The complainant stated that he had been informed by the Utility that the City had retained it to provide billing services to its water and waste customers.  The complainant alleged that he had not consented to the City sharing his personal financial information to a third party.  The complainant questioned the City’s statutory authority for disclosing his personal information to the Utility.

 

During the course of my investigation, I had discussions with both the complainant and the City.  As a result, the City provided me with the following information:

 

The City explained that under section 86 of the Municipal Act, it is responsible for supplying water and sewer services to buildings serviced by the public utility infrastructure. 

 

Section 86 of the Municipal Act, 2001, states:

 

(1) Despite section 19, a municipality shall supply a building with a water or sewage public utility if,

 

(a)    the building lies along a supply line of the municipality for the public utility;

 

(b)    in the case of a water public utility, there is a sufficient supply of water for the building;

 

 

(c)    in the case of a sewage public utility, there is sufficient capacity for handling sewage from the building; and

 

(d)   the owner, occupant or other person in charge of the building requests the supply in writing. [emphasis added].

 

The City also relies on section 391 of the Municipal Act, 2001, for the authority to charge fees for the services that it provides.  Section 391 of the Municipal Act, 2001, states:

 

(1) Despite any Act, a municipality and a local board may pass by-laws imposing fees or charges on any class of persons,

 

(a)    for services or activities provided or done by or on behalf of it;

 

(b)    for costs payable by it for services or activities provided or done by or on behalf of any other municipality or local board; and

 

(c)    for the use of its property including property under its control.

 

The City stated that it therefore has the statutory authority to supply sewer and water services and to charge the recipients of those services accordingly. 

 

The City explained that prior to April 2004, water and wastewater services were provided and billed by the City and hydro-electricity was supplied and billed by the Utility.  In order to improve operating efficiencies and achieve savings, the City decided to consolidate the administration of electricity, water and wastewater billing and collection functions.  The City stated that under section 8 of the Municipal Act, it has the authority to enter into agreements with other parties to deliver administrative functions on its behalf.

 

Sections 8 and 9 of the Municipal Act, 2001 states:

 

8.      A Municipality has the capacity, rights, powers and privileges of a natural person for the purpose of exercising its authority under this or any other Act.

 

9.      Sections 8 and 11 shall be interpreted broadly so as to confer broad authority on municipalities,

           

a)      to enable them to govern their affairs as they consider appropriate; and

b)      to enhance their ability to respond to municipal issues.

 

The City therefore decided to enter into a service agreement with the Utility to provide water and wastewater billing and collection on its behalf.  The City explained that the Utility is a municipal utility created by the City under the authority of the Electricity Act and that the City is the sole shareholder of the Corporation. 

 

On March 11, 2004, the City passed By-law 2004-66A authorizing a service agreement with the Utility to provide water and waste water billing and collection functions on its behalf.  Under this arrangement, the City’s customers would receive one bill that includes electricity, water and wastewater charges.  This consolidated bill would be issued and the monies collected by the Utility.  The City explained that the Utility is not a private sector company and the personal information provided to the Utility is used strictly for the purposes of water account billing and collection “just as it was when this service was provided directly by employees of the City”. 

 

The City stated that it advised its customers of the impending change in the billing system through a series of communications including a survey and letters directed to the individual customers and three public radio announcements. 

 

During my investigation, the City provided me with copies of various documents that have been sent to the water/waste water customers to notify them of the change in the billing process.  In March 2004, the City wrote to the customers to explain that it was changing the billing process and that the customers would now receive one bill for electricity, water and wastewater charges.  The City also advised that the new consolidated bill would be issued by the Utility.  There was a contact number listed in the letter for the customers to call with any questions or concerns.  The City sent a survey on the new process for the customers to complete and information flyers were also sent to the customers.  Three radio service announcements were made in an attempt to notify and remind customers of these changes.

 

The City provided me with a copy of the draft agreement between the City and the Utility.  The City advised that there was a labour strike at the Utility, which had delayed the finalization of the service agreement.  While the strike has prevented the parties from signing the final agreement, the City confirmed that the Utility had already begun providing the billing services.

 

I have reviewed the draft agreement.  The agreement requires the Utility to comply with the provisions of the Act in the course of providing services pursuant to the agreement.  Under the terms of the agreement, the Utility agrees that all personal information in its custody will be kept secure and confidential and that all requests made under the Act will be directed to the City’s Freedom of Information and Privacy Co-ordinator within seven days of receipt of the request.  The Utility agrees further that it will use the information disclosed to it by the City, for the sole purpose of service delivery and upon expiry or other termination of the service agreement, will return all disclosed or relevant information to the City.  Finally, the Utility agrees to designate a person to be responsible for records management, access to information and protection of privacy matters.  The draft agreement contains the safeguards necessary for the protection and security of the personal information used by the Utility and clearly stipulates the privacy protection measures that must be in place.

 

 

 

 

 

 

 

DISCUSSION:

 

The following issues were identified as arising from the investigation:

 

Is the information “personal information” as defined in section 2(1) of the Act?

 

Section 2(1) of the Act states, in part:

 

“personal information” means recorded information about an identifiable individual, including,

 

(a)    information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b)   information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c)    any identifying number, symbol or other particular assigned to the individual,

(d)   the address, telephone number, fingerprints or blood type of the individual,

 

…

 

(h)    the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual;

 

During the investigation, the City confirmed that the information that was shared with the Utility for the purposes of billing and collection services consists of customer names, addresses, names of banks, and bank account numbers with transit codes.  Accordingly, I conclude that this information qualifies as personal information in accordance with sections 2(1)(a), (b), (d) and (h) of the Act. 

 

Was the disclosure of the “personal information” in accordance with section 32 of the Act?

 

The complainant states that his personal information was disclosed by the City without his consent and expressed his concerns that the City did not have the statutory authority to do so.  The City relies on section 32(c) of the Act and submits that the disclosure of the personal information is a permitted disclosure.

 

Section 32 sets out a number of circumstances under which an institution may disclose personal information and section 32(c) reads as follows:

 

An institution shall not disclose personal information in its custody or under its control except,

 

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

 

The City states that it is required by law to provide water and waste water services and that it disclosed the personal information (customer names, addresses, bank names, transit codes, and account numbers) to the Utility as the information was required for the new billing process that will combine electricity, water and wastewater charges on one bill.  The City states that it disclosed the information to the Utility to use for the same purpose for which it had originally collected the information i.e. delivery of service, billing and collection of charges.

 

The City confirmed that the only information that was disclosed to the Utility was information necessary for the Utility to provide the billing services.  This includes the customer’s name, address, bank name and account number with transit code.  The City explained also that this disclosure was not made to a third party or private sector – it was made to an entity in which the City is the sole shareholder and for same purpose for which the information was originally obtained.

 

Based on the information provided to me by the City, I accept that the City disclosed the personal information to the Utility to use for the purpose of delivering billing services, which is the original purpose for which the personal information was obtained.  I am satisfied that the disclosure of personal information was for the purpose for which the information was obtained or compiled, the “original purpose” and conclude that such disclosure was in accordance with section 32(c) of the Act.

 

During the course of the investigation, the City advised that the labour strike had ended and it was now proceeding to have the service agreement finalized.  As I have indicated previously, I have reviewed the draft agreement and I am satisfied that it contains adequate safeguards to protect the personal information provided by the City.  However, the fact remains that at the time of the disclosure of the personal information by the City to the Utility, the service agreement had not been executed and was not in place.  I note that as of the date of this report, the City has still not finalized its agreement with the Utility.  The result being that the Utility is providing billing and collection services without the benefit of an agreement to safeguard the personal information, which was disclosed to it.  It is imperative that the City puts the signed agreement in place as soon as possible.  I will address this further in my recommendations below.

 

CONCLUSIONS:

 

I have reached the following conclusions based on the results of my investigation:

 

1. The information qualifies as personal information, as defined under section 2(1) of the Act.

 

2. The disclosure of the personal information was in accordance with section 32 (c) of the Act.

 

RECOMMENDATION:

 

I recommend that the City finalize its service agreement with the Utility, a draft copy of which I have reviewed. 

 

By May 10, 2005, the City should provide the Office of the Information and Privacy Commissioner with proof of compliance with the above recommendation.

 

 

 

 

 

 

 

 

                                                                                                            February 9, 2005

Tara Coccimiglio Investigator