Access to Information and Protection of Privacy

1. Access to Information andProtection of Privacy The Information and Privacy Commissioner/Ontario 80 Bloor Street West Suite 1700 Toronto, Ontario M5S 2V1

2. Meet the Team • Tom Mitchinson - Assistant Commissioner • Diane Frank • Manager, Mediation • Mona Wong - Team Leader/Mediator, Municipal Team

3. Overview Part 1:The Information and Privacy Commissioner/Ontario Part 2:What are my rights, and how are they guaranteed? Part 3:Who’s covered? Who’s not? Part 4:Access Part 5:Appeals Part 6:Privacy

4. The Information and Privacy Commissioner/Ontario

5. Mandate and Role • The IPC provides an independent review of government decisions and practices regulated by the following laws: • Freedom of Information and Protection of Privacy Act – January 1, 1988 • Municipal Freedom of Information and Protection of Privacy Act – January 1, 1991 • The Commissioner is appointed by and reports to the Legislative assembly; she remains independent of the government of the day to ensure impartiality.

6. Mandate and Role (cont’d) • Five key roles: • resolve appeals (mediation and/or adjudication) • investigate privacy complaints (recommendations) • ensure that government organizations comply with the Acts • research and advice to government on new legislation and programs • public education

7. What Are My Rights, and How Are They Guaranteed?

8. What Are My Rights under the Acts? • Access to information • Helps promote an open, transparent and accountable government • Protection of personal privacy • The right to expect that the personal information you give to the government will not be misused

9. How the Acts Protect Your Rights 1) The Acts provide a right of access to information under the control of government organizations in accordance with the following principles: • information should be available to the public • exemptions to the right of access should be limited and specific • decisions on the disclosure of government information may be reviewed by the Information and Privacy Commissioner (the IPC) 2) The Acts protect personal information held by government organizations, and provide individuals with a right of access to their own personal information.

10. Promoting Open Government and Accountability • Examples of how the Acts work: • Correction of Personal Information recorded in the Ministry of Health and Long Term Care’s OHIP database regarding fraudulent billings • Disclosure of Expense Accounts of Public Servants • Disclosure of an institution’s accounting records regarding aggregate legal costs

11. Who’s covered? Who’s not?

12. Provincial Government Organizations Covered by the Act • The provincial Act applies to: • all provincial ministries • most provincial agencies, boards and commissions • community colleges • and district health councils

13. Municipal Government Organizations Covered by the Act • The municipal Act applies to local government organizations, including: • municipalities • school boards • public utilities • transit and police commissions • conservation authorities • boards of health • and other local boards

14. Organizations Not Covered • Federal government organizations • Covered by separate federal access and privacy Acts • Non-profit or charitable organizations • Certain public organizations, such as universities or hospitals • Private institutions, however, Federal Bill C-6 (PIPEDA) covers federally regulated private companies

15. Access

16. Access to government records • You can obtain government records through two processes: - routine disclosure/active dissemination, or - making a request under the Acts

17. RD/AD • Routine Disclosure • Automatic release of certain types of administrative or operational records in response to informal or formal requests • Active Dissemination • Periodic release of general records in the absence of a request • For more information on a proactive approach to RD/AD, check out our website.

18. It’s better to be proactive – some examples: • Routine disclosure of • Restaurant Inspection Reports by the City of Toronto • Council and Committee Agendas, Minutes, Reports setting out Committee and Council decisions, Staff Reports and By-Laws by the City of Mississauga • Fire Incident Reports and Building Inspection Reports by the City of Mississauga

19. Making a Request under the Acts • Determine which organization has the relevant information. • Contact the freedom of information officer (FOI) of that organization to discuss access. • Prepare letter or complete form requesting access to the info; be as specific as possible. • Include $5 application fee and forward to the organization’s Freedom of Information and Privacy Co-ordinator.

20. Fees • Apart from the $5 request fee, some other fees may apply. • Other fees include: • Photocopies and computer printouts – 20 cents / page • Floppy disks - $10/disk • For manually searching a record - $7.50 /15 minutes • Preparing a record for disclosure - $7.50/15 minutes • For developing a computer program or other method of producing a record from machine readable record - $15 /15 minutes • No search fee for searching for an individual’s own personal information, or preparation of the record

21. How Will the Government Respond to My Request? • Government organizations must respond to requests within 30 days. An extension may be warranted when: • A large number of records have been requested, or a search through a large number of records is necessary • Consultations with a third party are deemed necessary

22. DISCRETIONARY Draft by-laws, record of closed meetings (S6 MFIPPA only) Advice or recommendations (S7 MFIPPA/ 13 FIPPA) Law enforcement (S8 MFIPPA/ S14 FIPPA) Economic and other interests (S11 MFIPPA/ 18 FIPPA) Solicitor-client privilege (S12 MFIPPA/ 19 FIPPA) Danger to safety or health (S13 MFIPPA / 20 FIPPA) Information soon to be published (S15 MFIPPA / 22 FIPPA) Requester’s own personal information (S38 MFIPPA / 49 FIPPA) MANDATORY Relations with government (S9 MFIPPA only) Cabinet records (S12 FIPPA only) Third party information (S10 MFIPPA / 17 FIPPA) Someone else's personal information (S14 MFIPPA/21 FIPPA) Exemptions: Limited & Specific

23. Appeals: When Does the IPC Become Involved?

24. Appeals -- The IPC’s Role • If you are dissatisfied with an organization’s response to an access or correction request, you can appeal this decision to the IPC. • The IPC acts as a tribunal in such matters, and has the power to order the organization in question to disclose or correct information.

25. When Can I File an Appeal? Some Examples: • If you… • have been denied access to some or all of the requested information • disagree with the fee being charged • do not receive a response within 30 days • do not agree with the reason given for a time extension • have been denied when requesting a correction to your personal information • are informed that an institution intends to disclose your business or personal information to someone else

26. Appeal Process • Within 30 days of receiving a decision from the organization you must: • write a letter to the IPC explaining why you disagree with the decision, or use the Appeal Form on our Web site • include a copy of your original request and the organization’s response • include the appeal fee

27. Appeal Fees • The Acts were amended in 1996 to include fees for filing an appeal: • $10.00 if the request is for your own personal information • $10.00 if the request is to correct your own personal information • $25.00 if the request is for general records or someone else’s personal information

28. How Does the IPC Handle Appeals? • The IPC will examine the situation and may contact you or the government organization for more information (“Intake”). • The appeal may be dismissed at this stage. • If not, the appeal will proceed to mediation, the IPC’s preferred method of dispute resolution • If the appeal is not resolved through a mediated settlement, it will proceed to adjudication, and an order will be issued.

29. Privacy

30. Whom do you want to have access to your personal information? Know your rights.

31. Personal information is recorded information about an identifiable individual. Some examples are: name address sex/marital status/sexual orientation age education medical/employment history other What is Personal Information?

32. The Government’s Duties • The Acts require the Government to protect the privacy of your personal information. • There are rules that specify how the Government may collect, retain, use, disclose, and dispose of personal information.

33. When Can I Make a Privacy Complaint? • If you believe that… • a provincial or municipal government organization has failed to comply with one of the Acts • andthat your privacy has been compromised as a result

34. What Happens When IPC Receives a Privacy Complaint? • The IPC’s goal is to assist government organizations in taking whatever steps are necessary (e.g. policies, procedures, training) to prevent future occurrences. • Intake staff attempt to resolve complaints informally, liaising with the relevant government organization. • Complaints not resolved during intake will be streamed to the investigation stage of the process. • A mediator is assigned to investigate the complaint. • At the conclusion of the investigation, the mediator prepares a report. Any report containing recommendations is published on our Web site.

35. Privacy Investigation Reports • Province of Ontario Savings Office (POSO) - the POSO wanted to survey account holders to evaluate their reaction to the potential privatization of the Savings Office, and disclosed to an outside polling firm the account holders’ names and addresses, SIN numbers, account numbers and balances • Family Responsibility Office (FRO) - the FRO intended to send multiple Cost-of-Living Allowance notices to a number of employers who have numerous support payers on staff, but inadvertently sent the multiple notices to one of the payers in each package

36. Privacy Investigation Reports (cont’d) • Ministry of Health and Long Term Care (MOHLTC) - After obtaining a patient’s records from a hospital, the Ministry forwarded a copy of the file to the patient. The patient informed the Ministry that her file included records relating to another patient Note: In most cases, our privacy complaint investigations deal with the inadvertent disclosure of personal information and institutions, for the most part, are anxious to have the assistance of our office in putting measures in place to prevent any possible reoccurrence.

37. Other Legislation Protecting Your Privacy • Personal Information Protection and Electronic Documents Act (federal legislation which came into force 1 Jan 01) covers federally regulated bodies such as banks and airlines • Privacy of Personal Information Act (provincial integrated health and private sector legislation proposed by the Ministry of Consumer and Business Services)

38. Final Questions Take steps to keep informed of your rights

39. IPC Resources • For all IPC publications, orders, information on who we are and what we do, links to related sites, and lots more, visit our Web site: http://www.ipc.on.ca • Wealsohave a variety of materials, with information on a broad range of privacy-related issues