Summer camp provided background-check information about former camper without consent

PIPEDA Report of Findings # 2012-008

---

The complainant attempted to enrol her child in a summer camp. She submitted her online application and spoke with the prospective camp’s director, who did not accept her child right away. When her application was ultimately rejected, she filed a complaint with our Office, alleging that a camp her child had previously attended had disclosed her child’s personal information to the prospective camp without her consent.

The complainant also filed a complaint against the prospective camp for collecting, using and disclosing her child’s personal information without consent.

The previous camp admitted that when it was asked about the child, it had discussed the child’s previous camp experience with the director of the prospective camp.

The previous camp advised our Office that this type of information exchange was a normal occurrence between camps. Our Office determined that the camp did not have any consent forms or policies in place relating to disclosing this sort of information to third parties. We also found that the privacy information available on the organization’s web site was minimal and insufficient for obtaining consent.

For these reasons, we determined that consent for the disclosure of the camper’s personal information to the prospective camp had not been obtained.

Our Office issued a preliminary report of investigation to the previous camp’s organization recommending that it obtain consent for any disclosures of personal information, and that it train its employees in their privacy obligations.

We found the complaint to be well-founded and conditionally resolved, based on the previous camp organization’s commitment to implementing our recommendations within agreed-upon timelines.

Report of Findings

Complaint under the Personal Information Protection and Electronic Documents Act (the “Act” or “PIPEDA”)

1. The complainant alleges that a summer camp organization disclosed her child’s personal information without her knowledge and consent.

Summary of Investigation

Consent

2. The organization, which runs summer camps in Ontario, is privately operated and for profit.

3. The complainant is a legal guardian of her child, who had previously attended a summer camp (the “previous camp”) in 2009 and 2010. In 2011, she submitted an application to register her child at a different summer camp (the “prospective camp”) for the first time.

4. The complainant and the prospective camp then had multiple telephone conversations about her application. She claims that at one point the prospective camp told her that it had been speaking with the previous camp. She claims the prospective camp, ultimately, also informed her that it could not accept her application or support her child and that her child’s disabilities would not be fair to other campers.

5. The complainant alleges that the previous camp had disclosed to the prospective camp specific information about her child, without her consent. As a result, she filed the current complaint against the previous camp, which we accepted on August 2, 2011.

6. Our Office’s investigation established that the prospective camp telephoned the previous camp to discuss the complainant’s child. The previous camp confirmed to our Office that it disclosed certain personal information of the complainant’s child to the prospective camp. The information disclosed consisted of (i) the child’s recent application history at the previous camp; (ii) the child’s past camping experience at that camp; (iii) an opinion of the child’s personality; and (iv) an evaluation of the support the child requires as a camper.

7. According to the previous camp, the exchange between the two camps was a private conversation and is a usual practice of camps. The camp affirms that the objective of these exchanges is to assure that campers have successful summers.

8. The previous camp informed us that the only consent form that its campers sign is one related to going to the hospital. It also informed us that all of its privacy material is posted on its web site.

9. We examined certain, limited information from the previous camp’s web site that refers to personal information collections and the Personal Information Protection and Electronic Documents Act.

10. We also examined a staff health form that the previous camp’s staff must sign, attesting to their having read the camp’s privacy information. Our Office could not locate any other privacy materials on the camp’s web site.

11. Lastly, we examined the privacy section of the Code of Professional Ethics (the “Code”) of the Ontario Camps Association (the “OCA”), of which the previous camp is a member. The Code states that the confidentiality of campers, parents and staff are to be protected. As well, the OCA web site highlights the requirement to comply with the Act:

Does the camp comply with the Personal Information Protection and Electronic Documents Act?
The Personal Information Protection and Electronic Documents Act (PIPEDA) is federal legislation that requires you to: obtain the clear consent of an individual before you collect, use or disclose personal information about that individual; use the information only for the purposes for which you have consent; protect the information from unauthorized access and use; keep the information up to date and correctly filed so that decisions are based on correct information; destroy information when you no longer need it for the original purpose, and implement accountability mechanisms in your organizations to ensure compliance with the act [sic].

12. On July 20, 2012, our Office issued a preliminary report of investigation to the previous camp, in which we examined the issues raised in the complaint and we requested that the camp respond to our recommendations. What follows is the result of our analysis of the evidence obtained during our investigation.

Application

13. In making our determinations, we applied Principle 4.3 of Schedule 1 of the Act, and subsection 2.(1) of Part 1.

14. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate.

15. Subsection 2.(1) states that “personal information” means information about an identifiable individual, but does not include the name, title or business address or telephone number of an employee of an organization.

Findings

August 30, 2012

16. At issue is whether the previous camp disclosed the personal information of the complainant’s child without the complainant’s knowledge and consent.

17. Evidence received by our Office supports the allegation that, during a telephone conversation that took place between the two camp organizations, the previous camp disclosed information about the complainant’s child, specifically: the child’s application history and past experiences at that camp, its opinion about the child’s personality and a subjective evaluation of the child’s needs.

18. The complainant has stated that she did not give her consent for such a disclosure and this Office received no evidence to support a claim to the contrary. The previous camp has affirmed that it has no consent form for this type of information sharing.

19. Principle 4.3 states that the knowledge and consent of the individual are required for the collection, use or disclosure of personal information, except where inappropriate. Since there was clearly no consent in this case, Principle 4.3 was not upheld.

20. In our preliminary report of investigation, we asked the previous camp to commit to the following recommendations: (i) that it revise its policies and practices to ensure appropriate consent is obtained when the organization discloses personal information, and (ii) that it train its staff in their privacy obligations under PIPEDA.

21. The camp responded to our preliminary report of investigation on August 13, 2012, with details about how it will be implementing our recommendations over the next year. It has assured this Office that all of the recommendations will be addressed by April 1, 2013.

Conclusions and Follow-up

22. Accordingly, we conclude that the matter is well-founded and conditionally resolved. We arrive at this conclusion based on the commitment in writing of the previous camp’s organization to address the recommended corrective measures identified in this report within the indicated time frame.

23. Our Office has a continuing interest in the organization’s commitment to adopt the necessary measures to bring it into compliance with the Act. As such, at the end of the specified time frame, we will assess whether the organization has fully complied with our recommendations and, if necessary, will pursue any outstanding concerns in accordance with our authorities under the Act.

Related report of findings:

• PIPEDA Report of Findings #2012-007: Summer camp's background check of new camper required consent