Copying Google Result is Collecting Personal Information

In June 2010, an individual contacted officials at Veterans Affairs and the National Capital Commission to obtain information about the Aboriginal War Veterans Monument, which had been unveiled in Ottawa in 2001.

Subsequently, the individual complained that his personal email address had been disclosed to new recipients added to the email thread.

One of those new recipients, a Veterans Affairs official, put the individual's email address into a Google search to see if it was publicly available. That search turned up a Google group discussion page, where the individual had posted personal information about his education and his views on open government. His email address was "masked" by Google on that page - which means that users must enter special characters on the page in order to "unlock" and view the complete e-mail address. This is defined by Google as "email masking", intended to prevent automated computer programs from harvesting full email addresses for spamming purposes.

Nonetheless, the Veterans Affairs official responded to the individual: "Your email is public domain. Like mine," and emailed that message, along with the webpage URL, to the entire email thread.

The individual complained to our Office that his personal information had been improperly collected.

Under section 4 of the Privacy Act, personal information collected by a government institution must relate directly to an operating program or activity of the institution. Our Office concluded that Veterans Affairs did not have a demonstrable need to collect the URL linking to the personal information posted by the complainant on the Google group discussion page.

Veterans Affairs contended that the public availability of information on the Internet is incompatible with a claim of privacy.

However, concerning personal information that is publicly available, the Privacy Act draws a distinction between its use and disclosure - which is not protected - and its collection, which still must relate directly to an operating program or activity.

Accordingly, the collection of the complainant's URL violated the Privacy Act and the complaint was well founded.

The Department apologized to the individual by letter and took steps to ensure that the email was deleted from its computer systems.