1 Access to Information and Protection of Privacy 80 Bloor Street West Suite 1700 Toronto, Ontario M5S 2V1 The Information and Privacy Commissioner/Ontario

2 Meet the Team  Tom Mitchinson - Assistant Commissioner  Diane Frank -Manager, Mediation  Mona Wong -Team Leader/Mediator, Municipal Team

3 Overview Part 1:The Information and Privacy Commissioner/Ontario Part 2: What are my rights, and how are they guaranteed? Part 3: Who’s covered? Who’s not? Part 4: Access Part 5: Appeals Part 6: Privacy

4 The Information and Privacy Commissioner/Ontario

5 Mandate and Role  The IPC provides an independent review of government decisions and practices regulated by the following laws: oFreedom of Information and Protection of Privacy Act – January 1, 1988 oMunicipal Freedom of Information and Protection of Privacy Act – January 1, 1991  The Commissioner is appointed by and reports to the Legislative assembly; she remains independent of the government of the day to ensure impartiality.

6 Mandate and Role (cont’d)  Five key roles: oresolve appeals (mediation and/or adjudication) oinvestigate privacy complaints (recommendations) oensure that government organizations comply with the Acts oresearch and advice to government on new legislation and programs opublic education

7 What Are My Rights, and How Are They Guaranteed?

8 What Are My Rights under the Acts?  Access to information oHelps promote an open, transparent and accountable government  Protection of personal privacy oThe right to expect that the personal information you give to the government will not be misused

9 How the Acts Protect Your Rights 1) The Acts provide a right of access to information under the control of government organizations in accordance with the following principles: oinformation should be available to the public oexemptions to the right of access should be limited and specific odecisions on the disclosure of government information may be reviewed by the Information and Privacy Commissioner (the IPC) 2) The Acts protect personal information held by government organizations, and provide individuals with a right of access to their own personal information.

10 Promoting Open Government and Accountability  Examples of how the Acts work: oCorrection of Personal Information recorded in the Ministry of Health and Long Term Care’s OHIP database regarding fraudulent billings oDisclosure of Expense Accounts of Public Servants oDisclosure of an institution’s accounting records regarding aggregate legal costs

11 Who’s covered? Who’s not?

12 Provincial Government Organizations Covered by the Act  The provincial Act applies to: oall provincial ministries omost provincial agencies, boards and commissions ocommunity colleges o and district health councils

13 Municipal Government Organizations Covered by the Act  The municipal Act applies to local government organizations, including: omunicipalities oschool boards opublic utilities otransit and police commissions oconservation authorities oboards of health oand other local boards

14 Organizations Not Covered  Federal government organizations oCovered by separate federal access and privacy Acts  Non-profit or charitable organizations  Certain public organizations, such as universities or hospitals  Private institutions, however, Federal Bill C-6 (PIPEDA) covers federally regulated private companies

15 Access

16 Access to government records  You can obtain government records through two processes: - routine disclosure/active dissemination, or - making a request under the Acts

17 RD/AD  Routine Disclosure oAutomatic release of certain types of administrative or operational records in response to informal or formal requests  Active Dissemination oPeriodic release of general records in the absence of a request For more information on a proactive approach to RD/AD, check out our website.

18 It’s better to be proactive – some examples: -Routine disclosure of -Restaurant Inspection Reports by the City of Toronto -Council and Committee Agendas, Minutes, Reports setting out Committee and Council decisions, Staff Reports and By-Laws by the City of Mississauga -Fire Incident Reports and Building Inspection Reports by the City of Mississauga

19 Making a Request under the Acts  Determine which organization has the relevant information.  Contact the freedom of information officer (FOI) of that organization to discuss access.  Prepare letter or complete form requesting access to the info; be as specific as possible.  Include $5 application fee and forward to the organization’s Freedom of Information and Privacy Co-ordinator.

20 Fees  Apart from the $5 request fee, some other fees may apply.  Other fees include: oPhotocopies and computer printouts – 20 cents / page oFloppy disks - $10/disk oFor manually searching a record - $7.50 /15 minutes oPreparing a record for disclosure - $7.50/15 minutes oFor developing a computer program or other method of producing a record from machine readable record - $15 /15 minutes oNo search fee for searching for an individual’s own personal information, or preparation of the record

21 How Will the Government Respond to My Request?  Government organizations must respond to requests within 30 days. An extension may be warranted when: oA large number of records have been requested, or a search through a large number of records is necessary oConsultations with a third party are deemed necessary

22 Exemptions: Limited & Specific DISCRETIONARY  Draft by-laws, record of closed meetings (S6 MFIPPA only)  Advice or recommendations (S7 MFIPPA/ 13 FIPPA)  Law enforcement (S8 MFIPPA/ S14 FIPPA)  Economic and other interests (S11 MFIPPA/ 18 FIPPA)  Solicitor-client privilege (S12 MFIPPA/ 19 FIPPA)  Danger to safety or health (S13 MFIPPA / 20 FIPPA)  Information soon to be published (S15 MFIPPA / 22 FIPPA)  Requester’s own personal information (S38 MFIPPA / 49 FIPPA) MANDATORY  Relations with government (S9 MFIPPA only)  Cabinet records (S12 FIPPA only)  Third party information (S10 MFIPPA / 17 FIPPA)  Someone else's personal information (S14 MFIPPA/21 FIPPA)

23 Appeals: When Does the IPC Become Involved?

24 Appeals -- The IPC’s Role  If you are dissatisfied with an organization’s response to an access or correction request, you can appeal this decision to the IPC.  The IPC acts as a tribunal in such matters, and has the power to order the organization in question to disclose or correct information.

25 When Can I File an Appeal? Some Examples:  If you… ohave been denied access to some or all of the requested information odisagree with the fee being charged odo not receive a response within 30 days odo not agree with the reason given for a time extension ohave been denied when requesting a correction to your personal information oare informed that an institution intends to disclose your business or personal information to someone else

26 Appeal Process  Within 30 days of receiving a decision from the organization you must: owrite a letter to the IPC explaining why you disagree with the decision, or use the Appeal Form on our Web site oinclude a copy of your original request and the organization’s response oinclude the appeal fee

27 Appeal Fees  The Acts were amended in 1996 to include fees for filing an appeal:  $10.00 if the request is for your own personal information  $10.00 if the request is to correct your own personal information  $25.00 if the request is for general records or someone else’s personal information

28 How Does the IPC Handle Appeals?  The IPC will examine the situation and may contact you or the government organization for more information (“Intake”).  The appeal may be dismissed at this stage.  If not, the appeal will proceed to mediation, the IPC’s preferred method of dispute resolution  If the appeal is not resolved through a mediated settlement, it will proceed to adjudication, and an order will be issued.

29 Privacy

30 Whom do you want to have access to your personal information? Know your rights.

31 What is Personal Information?  Personal information is recorded information about an identifiable individual. Some examples are: oname oaddress osex/marital status/sexual orientation oage oeducation omedical/employment history oother

32 The Government’s Duties  The Acts require the Government to protect the privacy of your personal information.  There are rules that specify how the Government may collect, retain, use, disclose, and dispose of personal information.

33 When Can I Make a Privacy Complaint?  If you believe that… o a provincial or municipal government organization has failed to comply with one of the Acts oand that your privacy has been compromised as a result

34 What Happens When IPC Receives a Privacy Complaint?  The IPC’s goal is to assist government organizations in taking whatever steps are necessary (e.g. policies, procedures, training) to prevent future occurrences.  Intake staff attempt to resolve complaints informally, liaising with the relevant government organization.  Complaints not resolved during intake will be streamed to the investigation stage of the process.  A mediator is assigned to investigate the complaint.  At the conclusion of the investigation, the mediator prepares a report. Any report containing recommendations is published on our Web site.

35 Privacy Investigation Reports  Province of Ontario Savings Office (POSO) - the POSO wanted to survey account holders to evaluate their reaction to the potential privatization of the Savings Office, and disclosed to an outside polling firm the account holders’ names and addresses, SIN numbers, account numbers and balances  Family Responsibility Office (FRO) - the FRO intended to send multiple Cost-of-Living Allowance notices to a number of employers who have numerous support payers on staff, but inadvertently sent the multiple notices to one of the payers in each package

36 Privacy Investigation Reports (cont’d)  Ministry of Health and Long Term Care (MOHLTC) - After obtaining a patient’s records from a hospital, the Ministry forwarded a copy of the file to the patient. The patient informed the Ministry that her file included records relating to another patient Note: In most cases, our privacy complaint investigations deal with the inadvertent disclosure of personal information and institutions, for the most part, are anxious to have the assistance of our office in putting measures in place to prevent any possible reoccurrence.

37 Other Legislation Protecting Your Privacy  Personal Information Protection and Electronic Documents Act (federal legislation which came into force 1 Jan 01) covers federally regulated bodies such as banks and airlines  Privacy of Personal Information Act (provincial integrated health and private sector legislation proposed by the Ministry of Consumer and Business Services)

38 Final Questions Take steps to keep informed of your rights

39 IPC Resources  For all IPC publications, orders, information on who we are and what we do, links to related sites, and lots more, visit our Web site:  We also have a variety of materials, with information on a broad range of privacy- related issues