Appearance before the Standing Senate Committee on Human Rights (RIDR) regarding the Study on the issues relating to the human rights of prisoners in the correctional system

February 7, 2018
Ottawa, Ontario

Opening Statement by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

Thank you Chair and members of the Committee for the opportunity to appear before you today and explain the role and work of my office.  I would like to begin by providing this committee with a brief overview of our mandate and the types of complaints we receive from inmates. 

The OPC is charged with overseeing compliance by federal government institutions with the requirements of the Privacy Act. We receive and investigate complaints related to denial of access to personal information, or to matters relating to the protection of personal information, such as improper collection, use, disclosure, retention or disposal.  My Office also reviews and provides recommendations on privacy impact assessment reports (PIAs), public interest disclosures, and reports of material privacy breaches submitted by federal government organizations.

Overview of CSC Complaints

The Privacy Act applies to inmates in the same manner as other individuals. Over the past decade, Correctional Service Canada (CSC) has consistently been on our Office’s top five in terms of the volume of complaints we receive.  Given this high number of complaints to our Office, it is clear that personal information and privacy is valued by inmates. The issues raised by federal inmates largely relate to denial of access to their personal information, including time-limit violations of the access provisions of the Privacy Act. A smaller proportion relates to improper collection, use, disclosure, retention or disposal of their personal information. 

The majority of complaints related to the time limit provisions of the Privacy Act are well-founded. However, aside from the time-limit violations, the majority of privacy complaints made by inmates are resolved to the satisfaction of the inmate, or deemed not well-founded.

About one third of breaches of inmates’ personal information in federal institutions involved health information — such as their medical, mental health, or substance abuse information — many of which were accidental disclosures resulting in the information being misdirected or left in a place accessible to others. 

Disclosures to Parole Board of Canada

It is our understanding that this Committee is interested in our views regarding disclosures of medical or mental health information by CSC to the Parole Board of Canada (PBC).  While we have only issued one finding on this specific matter, I would like to offer some general comments about how the disclosure provisions of the Privacy Act would be engaged in this scenario. 

Section 8 of the Privacy Act sets out the conditions under which personal information may be disclosed by an institution.  It states that personal information shall only be disclosed with an individual’s consent — subsection 8(1) — or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.  

It is our understanding that section 25 of the Corrections and Conditional Release Act (CCRA) gives CSC the authority to provide information to the Parole Board of Canada, provincial governments, provincial parole boards, police, and any body authorized by the Service to supervise offenders, where it is relevant to release decision-making or the supervision or surveillance of offenders.

Given this authority, only if a disclosure met the requirements of section 25 of the CCRA would the disclosure fall within the parameters of permitted disclosures allowed by paragraph 8(2)(b) of the Privacy Act, which states that personal information may be disclosed for any purpose in accordance with any Act of Parliament or regulation made there under that authorizes its disclosure.

That being said, it is only through the investigative process that we could examine the specific circumstances of a complaint and make a determination as to whether or not a disclosure was made in accordance with the applicable provisions of the CCRA, and therefore with section 8(2)(b), or some other appropriate provision under the Privacy Act. 

Section 25 of the CCRA contains an obligation that the information be relevant to release decision-making or the supervision or surveillance of offenders, which would be a crucial factor in our assessment of whether personal information was disclosed in accordance with the Privacy Act.

Concluding remarks

I will conclude by acknowledging that in this context, the privacy rights of federal inmates must be balanced with the government’s objective of ensuring public safety. 

Given the sensitivity of medical and mental health information, we support a principle of minimal disclosure to limit sharing to only that which is necessary and proportionate, while also recognizing there is potentially a need for the Parole Board of Canada, or other bodies, to have access to certain information relevant to release decision-making or the supervision or surveillance of an offender.

Thank you for inviting me to provide this Committee with comment — and I look forward to your questions.