City breached privacy rules: Dickson

The City of Saskatoon breached privacy rules when it indiscriminately disclosed personal information about a city resident to the Canada Revenue Agency (CRA) without authority, Saskatchewan’s information and privacy commission has found.

"The blanket policy the City of Saskatoon had to respond to another level of government was troubling," privacy commissioner Gary Dickson said Wednesday, commenting on his report released this week.

The city failed to justify its disclosure of personal information as required by privacy legislation and did not show how the utility information it provided was required by the CRA for enforcing a tax law, the commissioner found.

As well, the city failed to exercise its discretion and disclosed more of a complainant’s personal information than was requested.

"Public bodies should disclose the least amount of personal information necessary for the purpose," for which it was requested, Dickson wrote in the report.

The city then failed to respond adequately to a formal complaint, the commissioner found.

"Yes, we were doing it the wrong way, just because that’s the way we’d always done it. We’ve changed our practices," city solicitor Theresa Dust said Wednesday.

Dust was not able to respond to detailed questions about the matter, which is normally handled by City Clerk Janice Mann, who is away.

The city has 30 days to respond to the report.

The matter arose in 2005 when a city employee discovered the CRA had asked for the name and address of the person who requested and paid for utilities at the employee’s residence.

The next day, the employee’s name, current and former addresses, account number and information that described her financial activities and credit worthiness were faxed back to CRA.

The complainant asked the city what authority they had to disclose her personal information, but did not find the explanation satisfactory. She took her complaint to the privacy commissioner, who investigated.

The city acknowledged that they do not ask CRA for what purpose it intends to use the information, though that is a requirement of the privacy legislation, the commission found.

"We would have expected the city to exercise more rigour in making such a determination before disclosing personal information," the report states.

A local authority must use its discretion and consider the underlying principles of privacy legislation before disclosing personal information, it states.

"The city has effectively affirmed that it has a blanket policy when it applies this supposed discretionary authority vis-a-vis CRA," it states.

In 2006 the city explained that it had an agreement with the CRA for the previous 27 years but did not provide any documented evidence of the agreement.

The commission recommended the city ensure its staff know the specific laws that give it authority to disclose information and the specific laws that give CRA the right to collect such information.

Requests from CRA should be considered on a case by case basis; employees should know they are to provide the least amount of personal information needed for the purpose; the city should try to retrieve the excess information it disclosed; should inform the complainant of the outcome of the recommendations and should apologize, the report said.

In another report, also released Wednesday, the commission dismissed 95 requests for reviews of access denial. The requests, all made by the same person, were found to be vexatious and not made in good faith.

The review report addresses complaints related to five government institutions, four of which were found to have failed to provide notification to the applicant as required by the Freedom of Information and Protection of Privacy Act (FOIP).

The institutions were Advanced Education, Employment and Labour; Executive Council; Justice and Attorney General; Saskatchewan Labour Relations Board; and the Saskatchewan Workers’ Compensation Board.

The commissioner recommended that the Legislative Assembly amend FOIP so that the Commissioner could, in the future, authorize a public body to disregard requests for access that are frivolous, vexatious or not made in good faith.

The reports can be viewed in their entirety at the official website of Saskatchewan’s information and privacy commissioner, under the "reports" tab.

[email protected]杭州龙凤


Comments are closed.