Investigation finds that RCMP handled polling appropriately

Report of Findings
Complaint under the Privacy Act (the Act)

1. On October 7, 2009, the Privacy Commissioner of Canada initiated a Privacy Act complaint investigation against the Royal Canadian Mounted Police (RCMP) regarding the Use and Disclosure of personal information by the Canadian Firearms Program (CFP) to a public opinion research firm, EKOS Research Associates Inc. (EKOS), for the purpose of conducting a survey of firearms licensees.

Background

2. The Canada Firearms Centre (CFC) was created in 1996 to oversee the administration of the Firearms Act and Regulations.  In 2003, it was established as a stand-alone agency within the portfolio of Public Safety Canada.
3. In 2006, the Government of Canada introduced a series of non-legislative measures to ease the burden on firearms owners and to realize efficiencies in the firearms regime.  These measures included, among others, transferring the CFC and responsibility for the Firearms Act, its Regulations and the CFP to the RCMP.
4. Over the last two decades, several national surveys of Canadian households have been conducted with the purpose of estimating the firearm-owning population, identifying trends in firearm ownership or describing attitudes toward gun-control.  However there had been no systematic national survey of what firearm owners and users, who possess a valid firearms licence do as firearms clients and this posed a significant information gap for the CFP.
5. The CFP had also been taken to task by the Auditor General of Canada with respect to its client services.  Information obtained from the survey at issue would assist in identifying patterns and trends in the actions of firearms clients that have implications for program administration and service delivery.

Summary of Investigation

6. Numerous interviews were conducted with both RCMP and EKOS officials and evidence was reviewed to determine whether the RCMP improperly used or disclosed personal information about firearms licensees in contravention of sections 7 and 8 of the Act.

Contract between the RCMP and EKOS Research Associates Inc.

7. The investigation confirmed that the RCMP went though the tender process with Public Works and Government Services Canada for the purpose of conducting a National Client Demographics/Behaviors survey and the contract was awarded to EKOS on March 18, 2009.
8. The contract between the RCMP and EKOS included clauses relating to RCMP Security Requirements and the Handling of Personal Information as well as a detailed Statement of Work outlining the objective, background and scope of the survey.
9. It was established that the confidentiality clause in the contract – under the heading of Handling of Personal information – follows the government contracting policy and is in fact worded exactly as the “Public Works and Government Services Canada’s Standard Acquisition Clauses and Conditions” paragraph with respect to the handling of personal information.
10. It was also established that the RCMP Security Requirements clause stipulated that EKOS be security cleared at the level of RCMP Reliability as verified by the Personal Security Unit of the RCMP.

The Survey

11. As stated in the contract, the survey in question – which was conducted by telephone from September 8-18, 2009 – would study a representative sample taken from the 1.9 million licence-holders in Canada and focus on the characteristics and actions of valid licence-holders and the status of the firearms they possess.
12. It was determined that EKOS called approximately 9285 individuals and, of those, approximately 1270 agreed to complete the survey.  EKOS’ goal was to obtain 2500 completed surveys however, it fell short when it was directed by the RCMP to stop the survey on September 18, 2009.
13. It is the standard practice for EKOS – in all surveys it conducts – that interviewers identify themselves by name and, prior to asking any questions, advise respondents that their participation is voluntary.  It was further confirmed that respondents could choose to opt-out at any time during a call.
14. The survey was conducted by an independent third party to ensure that respondents felt in no way obligated to participate as they might were they to be contacted by the RCMP directly.
15. A review of the questionnaire confirmed that licensees were asked about the manner in which they contact the CFP; their demand for services; how the CFP could best communicate with its clients; and their level of satisfaction with each of the aforementioned.  Statistical information was also collected.
16. At the end of the project – as stipulated in the contract – EKOS will deliver all personal information to the RCMP in whatever form, including all working papers, notes, memos, reports, data (in all formats) and documentation made or obtained in relation to the survey.  EKOS has no right to retain the information in any form and shall ensure that no record of personal information remains in its possession.  The final report provided to the RCMP would contain statistical information only.

How was the survey conducted?

17. The investigation confirmed that the RCMP hand-delivered a master CD to EKOS which contained a subset of personal information relating to approximately 37,495 licensees from the Canadian Firearms Database.
18. It was established that EKOS employees who conducted the survey met the personnel security screening requirements identified in the contract.  It was also established that the surveys were conducted on their premises and these have been security-cleared to store documents at the appropriate level.
19. Our review of the master CD confirmed that it contained personal information about licensees including basic demographic information and information relating to the status of their firearms.
20. EKOS officials would then randomly select to contact certain individuals from the master CD and only their personal information would be used for purposes of the survey.
21. The investigation confirmed that EKOS properly safeguarded the information under its control.
22. It was established that EKOS stripped all personal identifiers - other than age and gender – from the master CD, without altering it, so that responses could not be attributed to an identifiable individual.  The investigation confirmed that none of the information stripped from the master CD was retained by EKOS.  It was, in effect, simply deleted.

Application

23. In making our determination, we considered sections 3, 4, 7 and 8 of the Act.
24. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc. 
25. Section 4 of the Act provides that personal information collected by a government institution must relate directly to an operating program or activity of the institution.  This section is complemented by section 5 of the Privacy Act, which states that personal information shall be collected directly from the individual about whom it relates unless the individual authorizes otherwise.
26. Section 7(a) of the Act states that personal information shall not, without the consent of the individual to whom it relates, be used by the institution except for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.
27. The Act states that personal information can only be disclosed with an individual's consent – Section 8(1) – or in accordance with one of the categories of permitted disclosures outlined in section 8(2) of the Act.

Findings

28. The information about firearms licensees extracted from the CFP Database for the purpose of conducting the survey constitutes personal information as defined in section 3 of the Act.
29. I am satisfied that the Canadian Firearms Program is a legitimate operating program for the purposes of section 4 and, consequently, that it is authorized to collect personal information for the purpose of administering and enforcing the Firearms Act and its Regulations.  Furthermore, it is my view that the use of the information for purposes of conducting a client-satisfaction survey to improve the services offered by the CFP is consistent with the reason the information was first collected and therefore does not constitute a contravention of section 7 of the Act.
30. The investigation confirmed that EKOS is performing services for the RCMP under a contract that is in line with standard Government contracting policy and is adhering to the confidentiality and security provisions in its contract.  Furthermore, it is not unusual for a Federal Government Department to engage experts from external organizations, under contract, to carry out a variety of services - whether it be the collection of Canada Student Loans, the processing of Employment Insurance Applications, the processing of requests under either the Access to Information Act or the Privacy Act, or the investigation of complaints to the Office of the Information Commissioner of Canada or this Office.  In such situations, contractors act as agents of the hiring institution and are bound by the same confidentiality and security provisions as other employees.  Therefore, the RCMP did not contravene section 8 of the Act when it provided EKOS with personal information required in order to fulfill its contractual obligations.
31. What was also clearly demonstrated during this investigation was that EKOS officials take their responsibilities under the Act very seriously and for that, they are to be commended.
32. Accordingly, the complaint is not well-founded.

Other

33. Notwithstanding the finding, this Office shared observations gleaned during the course of the investigation with the RCMP.  We are pleased that CFP officials intend to take the necessary steps toward being more privacy-sensitive in their communication to the public with respect to how personal information is being used and disclosed.
34. Specifically, CFP officials will update CFP Personal Information Bank CMP PPU 100 in the next annual update of InfoSource to more clearly communicate to the public that information collected under the CFP may be used for the purpose of conducting surveys aimed at improving its services.
35. CFP officials committed to updating information on its website to more accurately reflect the circumstances under which information collected for the purpose of the administration and enforcement of the Firearms Act and its Regulations can be used and disclosed to a third party under contract.
36. CFP officials agreed that a Privacy Impact Assessment, in this instance, may have assisted in assuring senior officials that all privacy issues had been identified and resolved or mitigated with respect to the contracting of this service to EKOS.