Summer camp's background check of new camper required consent

PIPEDA Report of Findings #2012-007

---

The complainant attempted to enrol her child in a summer camp. She submitted her online application and spoke with the camp's director. She later filed a complaint with our Office, alleging that the prospective camp's director had collected her child's personal information from a camp her child had previously attended without her consent in order to make a decision about whether the child would be a suitable camper. The complainant also filed a complaint against the child's previous camp for disclosing the child's personal information without consent.

The prospective camp denied any collection taking place but claimed that it was a longstanding practice for camps to exchange camper information. It claimed that, in any case, it had obtained consent from the camper's mother by virtue of clauses contained in the online application form and an accompanying document.

For its part, the previous camp confirmed to our Office that there had been personal information about the camper exchanged between the two camps' directors during their phone call.

Our Office reviewed the prospective camp's application documents, as well as the organization's privacy and confidentiality policies. We noted that the documents did not mention that camper personal information could be collected from other parties. We also observed that the language used in the documents was too vague to clearly communicate the specific purposes for which any personal information collected about campers would be used or disclosed. For these reasons, we determined that consent for the collection, use and disclosure of the complainant's child's personal information in this case had not been obtained.

Our Office issued a preliminary report of investigation to the prospective camp recommending that it obtain individual consent for any collections, uses and disclosures of the personal information of its campers, and that it provide privacy training for its employees.

We found the complaint to be well-founded and conditionally resolved, based on the camp's commitment to implementing our recommendations within agreed-upon timelines.

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act”)

1. The complainant alleged that a summer camp organization collected her child's personal information without her knowledge and consent.

Summary of Investigation

Consent

2. The summer camp (the “first camp”) organization is a privately operated, for-profit organization that runs summer camps in Ontario.

3. The complainant is a legal guardian of her child. In 2011, she was telephoned by the summer director of the organization's camps (the “first camp's director”) in response to her on-line application to enroll her child for the first time in one of its camps.

4. During the call, they discussed her application and her child. The complainant mentioned to the organization's director that her child had previously participated in canoe trips at another camp (the “second camp”), one operated by another organization. She named the second camp during their conversation.

5. During an ensuing telephone conversation, the first camp's director informed the complainant that her application for her child to attend the first camp had not been accepted.

6. The complainant claims that the director told her at that point that he had been speaking with the second camp's director. She claims the first camp's director told her that her child could not be supported at that camp and that her child's disabilities would not be fair to other campers.

7. The complainant alleges that the first camp's director had collected from the director of the second camp specific information about her child, without her consent. She thus filed the current complaint against the first camp's organization, which we accepted on August 2, 2011.

8. We obtained evidence from the second camp which confirmed that the first camp's director telephoned the second camp about the complainant's child. During the conversation, the first camp's director reportedly explained that it had an application from the complainant and asked about her child as a camper. Based on experience with the complainant's child, the second camp provided information about the child's camping history, the child's personality and the type of support that the child required from camp staff. The second camp also told the first camp's director that the second camp had recently declined an application from the complainant as the session that she requested was fully booked.

9. The first camp's director also confirmed to our Office that it had contacted the director of the second camp. According to the first camp's director, it asked the second camp about the length of the canoe trip that the complainant's child had taken there. However, the first camp's director denied collecting any personal information about the complainant's child from the second camp.

10. The first camp's director claimed that his organization “… undertakes extensive background checks on all camper and staff applicants for places during the summer programme as part of its vigorous enrolment and hiring process, and uses the collected personal information for this process.”

11. The first camp's director maintained that, within the context of the events related to this complaint, all its “data” collections were carried out with consent.

12. He stated that when the complainant submitted her online application, she accepted the terms of the application, including the terms from the application's “Additional Agreement.” At the time, these terms clearly stated that camp directors, at their discretion, could use the information supplied in applications for any means.

Identifying and documenting purposes

13. We examined the first camp's privacy and confidentiality policies.

14. We observed that from all the purposes listed therein (and also in its online application), there was no mention of the organization's collection, use or disclosure of personal information for the purpose of “performing background checks on campers” or a similar purpose.

15. Lastly, we examined the privacy section of the Code of Professional Ethics (the “Code”) of the Ontario Camps Association (the “OCA”), of which the first camp is a member. The Code states that the confidentiality of campers, parents and staff are to be protected. As well, the OCA website highlights the requirement to comply with the Act:

Does the camp comply with the Personal Information Protection and Electronic Documents Act? The Personal Information Protection and Electronic Documents Act (PIPEDA) is federal legislation that requires you to: obtain the clear consent of an individual before you collect, use or disclose personal information about that individual; use the information only for the purposes for which you have consent; protect the information from unauthorized access and use; keep the information up to date and correctly filed so that decisions are based on correct information; destroy information when you no longer need it for the original purpose, and implement accountability mechanisms in your organizations to ensure compliance with the act [sic].

16. On July 20, 2012, our Office issued a preliminary report of investigation to the first camp's organization in which we examined the issues raised in the complaint and requested that the organization respond to our recommendations. What follows is the result of our analysis of the evidence obtained during our investigation.

Application

17. In making our determinations, we applied Principles 4.3 and 4.3.2 of Schedule 1, and subsection 2.(1) of Part 1.

18. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate.

19. Principle 4.3.2 stipulates that Principle 4.3 requires knowledge and consent. Organizations shall make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. To make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

20. Subsection 2.(1) states that ”personal information ” means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.

Findings

August 30, 2012

Consent for collection – Principle 4.3

21. At issue is whether the first camp's organization collected the complainant's childs personal information from a third party and whether it had the complainant's consent to do so.

22. We do not accept the first camp's claim that it did not collect any information about the complainant's child from the second camp. Evidence obtained from the second camp organization supports the allegation that, during a telephone conversation that took place between the two organizations, the first camp collected information about the complainant's child, specifically: the child's application history, the child's past experiences at that camp and a subjective evaluation of the child's needs. The complainant has stated that she did not give her consent for such a collection nor did she have knowledge about it occurring until her second conversation with the first camp.

23. In our view, the purpose of the conversation between the two organizations and the personal information collection was to evaluate the complainant's application for her child to attend the first camp, and to determine whether that camp could accommodate the child's needs. This purpose appears to coincide with the first camp's own affirmation to this Office, described in paragraph 10, that it undertakes extensive background checks on campers and that it uses the collected personal information as part of the enrolment process.

24. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information. (Note: A legal representative may act on behalf of the individual to provide consent.)

25. This Office does not share the view of the first camp's director that the complainant's consent was obtained by her agreeing to the terms of the application she submitted, including the terms of the application's “Additional Agreement”. We examined the application as well as that organization's privacy policy and believe that the general statements regarding how the information supplied is to be used are overly broad and not sufficient to obtain consent to collect personal information from a third party as part of the enrolment process.

26. Therefore, since in our view there was no knowledge and consent for the collection of the personal information of the complainant's child from the second camp, Principle 4.3 was not upheld.

Consent for use and disclosure – Principles 4.3 and 4.3.2

27. It appears that the first camp also used and disclosed the personal information of the complainant and her child. From evidence we obtained, it appears that the personal information of the complainant's child collected from the second camp was used by the first camp in consideration of the complainant's application to attend it. As well, evidence obtained from the second camp demonstrates that the first camp disclosed both the complainant's and her child's personal information to the director of that camp, specifically their names and application history, in order to obtain information.

28. Principle 4.3.2 of the Act provides that there be knowledge and consent under Principle 4.3 and that organizations must make a reasonable effort to ensure that the individual is advised of the purposes for which the information will be used. Principle 4.3.2 further explains that to make the consent meaningful, the purposes must be stated in such a manner that the individual can reasonably understand how the information will be used or disclosed.

29. Further, the terms stated in the “Additional Agreement”of the first camp's application and the similar language in the organization's privacy policy are too broad to constitute a means to obtain meaningful consent for the use and disclosure in issue.

30. In our view, an individual would not be able to reasonably understand from the policy and the “Additional Agreement ” that their personal information would be used or disclosed to a third party as part of the enrolment process. As such, there was no knowledge and meaningful consent for the use and disclosure that occurred in this case. Consequently, Principles 4.3 and 4.3.2 were not upheld.

31. In our preliminary report of investigation, we asked the first camp's organization to commit to the following recommendations: (i) that it revise its policies and practices to ensure appropriate consent is obtained for collections, uses and disclosures of personal information of its campers, and (ii) that it train its staff in their privacy obligations under PIPEDA.

32. The first camp's organization responded to our preliminary report of investigation on August 7, 2012, with details about how it will be implementing our recommendations over the next year. It has assured this Office that all of the recommendations will be addressed by June 30, 2013.

Conclusions and Follow-up

33. Accordingly, we conclude that the matter is well-founded and conditionally resolved. We arrive at this conclusion based on the commitment in writing of the first camp's organization to address our recommended corrective measures identified in this report within the indicated time frame.

34. Our Office has a continuing interest in the organization's commitment to adopt the necessary measures to bring it into compliance with the Act. As such, at the end of the specified time frame, we will assess whether the organization has fully complied with our recommendations and, if necessary, will pursue any outstanding concerns in accordance with our authorities under the Act.

Related report of findings:

• PIPEDA Report of Findings # 2012-008: Summer camp provided background-check information about former camper without consent