Responsible information-sharing in situations involving intimate partner violence

Resolution of the Federal, Provincial and Territorial Privacy Commissioners and Ombuds with responsibility for privacy oversight

Toronto, Ontario, October 8-10, 2024

Context

Intimate partner violence (IPV) is a pervasive problem in our society, affecting Canadians from coast to coast to coast, in urban, rural, and remote communities. IPV refers to a form of gender-based violence that primarily harms women and gender-diverse individuals and includes multiple forms of harm caused by a current or former intimate partner. It often takes place behind closed doors, can make the victim or survivor feel isolated and afraid, and have devastating impacts on children and youth that are exposed to it.

The global pandemic exacerbated rates of IPV, as stay-at-home orders and other factors resulted in many victims or survivors being trapped in their home with their abusive partner.^{Footnote 1} In 2023, there were 123,319 police reported incidents about IPV in Canada with victims or survivors aged 12 years and older.^{Footnote 2} While alarming, this statistic very likely underrepresents the number of IPV cases across the country as many incidents are unreported due, for example, to fear, stigma, or lack of confidence in the criminal justice system.^{Footnote 3}

There are multiple sectors responsible for reducing or eliminating IPV harm, including the justice, health, and social services sectors whose work may involve direct engagement with abusive partners, victims or survivors, or other affected individuals (for example, children). The private sector can also play an important role by identifying and taking the necessary and reasonable steps to prevent potential IPV-related harm to clients^{Footnote 4} and employees. Those working across these sectors may be subject to different privacy legislation.

Recently, Canadians have seen a number of significant public inquiries and inquests related to IPV, including the National Inquiry into Missing and Murdered Indigenous Women and Girls, the Nova Scotia Mass Casualty Commission, and the Ontario Coroner’s 2022 inquest into the tragic deaths of three women in Renfrew County (Ontario Inquest). A common thread across these inquiries involved misconceptions around permissible disclosures of personal information or personal health information (personal information) under Canada’s privacy laws. Organizations and their staff, who are subject to privacy laws, sometimes feel conflicted about how to respond to an IPV situation due to concerns around confidentiality and the potential of infringing individual privacy rights. This is sometimes referred to as a “privacy paralysis.” In response to the Ontario Inquest, the Ontario Information and Privacy Commissioner issued guidance on Sharing Information in Situations Involving Intimate Partner Violence: Guidance for Professionals to empower organizations and their staff to make informed decisions about privacy, confidentiality, and public safety, particularly around assessing and reducing IPV risk.

A critical component of IPV prevention and mitigation includes the timely and responsible disclosure^{Footnote 5} of personal information to at-risk individual(s) or other individuals or organizations who need this information to reduce or eliminate a serious health or safety concern. For example, an organization may be permitted to disclose the personal information of the abusive partner to the victim or survivor or to another organization for risk assessment and safety planning when certain conditions are met. Effective information sharing could mean the difference between life and death.

Government, organizations, and their staff must educate themselves about Canada’s privacy laws to address misconceptions around permissible disclosures for IPV prevention. Privacy laws generally permit the disclosure of personal information if there is a risk of serious harm to health or safety and the disclosure is reasonably necessary to reduce or eliminate that risk.^{Footnote 6} They also permit disclosures with valid consent or as otherwise permitted or authorized by law.

Some Canadian jurisdictions^{Footnote 7} have taken the additional step of adopting a Clare’s Law^{Footnote 8} scheme, which generally enables a police service to disclose certain risk-related personal information about an individual to their current or former intimate partner to support informed decision making about their safety and the relationship.

Under child protection laws in Canada, disclosures related to health and safety are either explicitly mandated or authorized by law. Children and youth exposure to IPV between parents and other caregivers accounts for nearly half of all cases investigated and substantiated by child welfare authorities in Canada.^{Footnote 9} Generally, professionals and other individuals have a positive legal duty to report to the appropriate authority when a child is in need of protection.^{Footnote 10}

Therefore

Against this legal and policy backdrop, Canada’s federal, provincial, and territorial Privacy Commissioners and Ombuds with responsibility for privacy oversight (FPT Commissioners) collectively affirm that Canada’s privacy laws generally permit the disclosure of personal information if there is a risk of serious harm to health or safety. Governments, organizations, and their staff must take the necessary steps to understand and assess the conditions under which they may disclose personal information to reduce or eliminate IPV harm, and how to do so without putting an at-risk individual at greater risk of harm.

Therefore, FPT Commissioners call on governments and organizations in their respective jurisdictions to develop privacy compliant governance frameworks, including policies and procedures, around the disclosure of personal information in situations where there is a risk of serious harm to life, health, or safety.

In particular, we call on the federal, provincial, and territorial governments to work with their respective FPT Commissioner to

Ensure organizations develop privacy policies around the permissible disclosure of personal information in situations involving risks to life, health, or safety;
Identify and direct the appropriate organizations to conduct a public education campaign on permissible disclosures of personal information in situations impacting risks to life, health, or safety;
Develop culturally sensitive and trauma-informed tools and guidance to support organizations delivering services to marginalized, racialized, or vulnerable groups;
Encourage the proactive disclosure of IPV-related data, including relevant statistics, trends, and race-based data and analyses to shed light on the importance of the issue, and help improve future strategies for IPV prevention. Where there is a reasonable risk that releasing such data may, alone or in combination with other data, identify specific individuals, consider whether the public interest in disclosing such information outweighs any invasion of privacy that could result from the disclosure.^{Footnote 11}

We also call on the public, private, health, and social services sector organizations to

Develop corporate policies and procedures to protect individuals from IPV-related harms in alignment with statutory rules and requirements, including accountability measures;
Require mandatory staff training around the policies and procedures related to the disclosure of personal information concerning life, health, or safety;
Be transparent, and notify affected individuals upfront, about the possibility that their personal information may be disclosed, with whom, and under what circumstances in situations concerning risk to their life, health, or safety;
Ensure privacy and security controls are in place to protect the personal information under its custody and/or control, including response and mitigation plans in the event of a breach;
Respect principles of data minimization to limit the disclosure of personal information to only that which is reasonably necessary. If non-personal information will serve the same purpose, that information should be disclosed instead;
Consider a culturally sensitive and trauma-informed approach in discussing matters related to health or safety with affected individuals and their families, particularly among marginalized, racialized, or vulnerable groups;
Consider the unique experiences of First Nations, Inuit, and Métis individuals and communities and work to advance reconciliation, including by respecting Indigenous principles of data sovereignty;
Document instances where personal information is disclosed. Retain records as required by law, including as required in some privacy statutes;
Proactively disclose IPV-related data, including relevant statistics, trends and race-based data and analyses to shed light on the importance of the issue, and help improve future strategies for IPV prevention. Where applicable, if there is a reasonable risk that releasing such data may, alone or in combination with other data, identify specific individuals, consider whether the (compelling) public interest in disclosing such information (clearly) outweighs any invasion of privacy that could result from the disclosure;^{Footnote 12}
Collaborate with their respective FPT Commissioners to develop policies and procedures, education campaigns, training, and any other relevant guidance around the disclosure of personal information for IPV prevention in situations impacting risks to life, health, or safety.

As FPT Commissioners, we commit to clarify permissible disclosures for life, health, or safety concerns by

Engaging with government and relevant interested parties to educate professionals, affected individuals, and the public on the responsible disclosure of personal information to protect victims or survivors and their children in situations involving risk to life, health, or safety;
Encouraging government and institutions to be open and transparent by proactively releasing data, including trends, statistics, and race-based data and analyses, in the public interest that may improve strategies and particularized approaches to help combat IPV;
Collaboratively working together to provide ongoing policy guidance and support for responsible disclosure of personal information under our respective privacy laws to help prevent situations of violence that put at risk the life, health, or safety of individuals.

Footnotes

Footnote 1

See A Pandemic within a Pandemic — Intimate Partner Violence during Covid-19 | New England Journal of Medicine (nejm.org)

Return to footnote 1

Footnote 2

See The Daily — Trends in police-reported family violence and intimate partner violence in Canada, 2023

Return to footnote 2

Footnote 3

See Fact sheet: Intimate partner violence — Canada.ca for additional information about victim or survivor apprehension reporting IPV to the police.

Return to footnote 3

Footnote 4

See Canadian banks need to do more to stop abusive e-transfers, survivors say | CBC News; Abusers are using e-transfers to contact their victims. Who is responsible for stopping them? | CBC News; and Intimate partner violence survivors want banks to do more to stem abusive e-transfers | CBC.ca

Return to footnote 4

Footnote 5

This resolution focuses on permissible disclosures of personal information for IPV prevention. Government, organizations, and their staff must ensure compliance with their applicable privacy statute around the collection, use, and disclosure of personal information.

Return to footnote 5

Footnote 6

While each jurisdictions privacy law(s) has differences, these laws generally permit disclosures of personal information where there is a risk of serious harm or danger to a person or if there is a public interest to disclose the personal information. Organizations should consult with their respective FPT Commissioner for further guidance.

Return to footnote 6

Footnote 7

See Alberta’s Disclosure to Protect Against Domestic Violence Act; Newfoundland and Labrador’s Interpersonal Violence Disclosure Protocol Act; Saskatchewan’s The Interpersonal Violence Disclosure Protocol Act; and New Brunswick’s Disclosure to Protect Against Intimate Partner Violence Act, which is awaiting proclamation.

Return to footnote 7

Footnote 8

Clare’s Law was named in memory of Clare Wood, a British woman, who was killed in 2009 by her former domestic partner who had a reported history of gender-based violence that she was unaware of.

Return to footnote 8

Footnote 9

See Canadian Pediatric Society’s Recognizing and responding to children with suspected exposure to intimate partner violence between caregivers.

Return to footnote 9

Footnote 10

Jurisdiction specific information around the duty to report can be found on the Government of Canada’s Provincial and territorial child protection legislation and policy, 2018.

Return to footnote 10

Footnote 11

Otherwise known as the public interest override, the specific wording and conditions for allowing the disclosure of identifiable (or potentially identifiable) data in the public interest will vary from jurisdiction to jurisdiction. For example, in some laws, the public interest in disclosure must be “compelling”, and the balancing test requires that it “clearly” outweigh the protection of privacy and may require notification to an FPT Commissioner and/or public reporting to legislative bodies.

Return to footnote 11

Footnote 12