Sharing of health information unjustified

Complaint under the Privacy Act (the Act)

1. The complainant alleged that the Public Service Commission of Canada (PSC) contravened the use and disclosure provisions of the Privacy Act (the Act) when it disclosed her personal information in the course of a PSC investigation. Specifically, she alleged that in 2011, an investigator with the PSC shared her medical information via a factual report to all individuals that were part of the PSC's investigation into potential fraud during an appointment process.

Background

2. Under the authority of the Public Service Employment Act (PSEA) the PSC conducts investigations of staffing appointment processes, including external appointments, internal appointments, appointments involving possible political influence, and appointment processes where fraud is suspected.
3. In conducting investigations, PSC investigators follow an Investigator's Guide which outlines PSC procedures for conducting investigations under the PSEA. PSC investigations can be conducted by way of fact-finding meetings, written submissions, and individual interviews or on-site meetings. During these interviews investigators identify and write down the relevant facts and views provided by each individual interviewed. The information collected from each individual is then included in a factual report. Factual reports are prepared by PSC investigators and contain the allegations, facts, and the information gathered during the course of PSC investigations. They do not include an analysis of the facts or draw conclusions.
4. PSC investigators share factual reports with those individual(s) who may be affected by the information for their comments or responses. According to thePSC's Investigator's Guide an affected person is defined as follows:

   A "person who may be affected by the information", is someone whose status may be affected by the investigation (appointee, proposed appointee, qualified, eliminated, dismissed); whose character may be questioned by it (their credibility, integrity or reputation), whose position regarding the concerns/allegations under investigation may be challenged or regarding whom the Commissioner may order corrective actions."

   ThePSC's Investigator's Guide also states the following:

   "If a person is affected by only a minor part of the factual report (a few paragraphs, for example), then the investigator may decide that only that part of the factual report needs to be shared with this person for comments or responses."

5. After reviewing any comments and responses received, PSC investigators determine whether any comments or responses need to be shared with other individuals and whether to allow for rebuttal. Investigators then prepare a final investigation report based on the facts collected in the factual report. The final investigation report is submitted to either the deputy head of the department concerned or the Commission (the President of the PSC and two or more other Commissioners), as the case may be, who can revoke or not make the appointment at issue and take any appropriate corrective action.

Complainant’s PSC Case

6. The complainant was a candidate in an appointment process where an interview and reference checks were used to assess her qualifications. During the interview stage of the process, the complainant was taken to a vacant office where she was given the interview questions to review and formulate her responses. During this 30-minute preparation time, the complainant was seen making a telephone call. The PSC conducted an investigation under the PSEA to determine whether the complainant had committed fraud by making this phone call during the staffing process.
7. In the course of PSC's investigation, the PSC investigator interviewed the complainant and four individuals who were considered to be witnesses in this case (the "witnesses"). During the investigation, the complainant provided the PSC investigator with a letter from her doctor (the "doctor's letter") that provided details about her medical condition at the time of the incident. The complainant requested that the PSC investigator present the doctor's letter to the Commission, so that it would be used in the deliberation of her case. The PSC investigator then prepared a factual report, which included a full reproduction of the doctor's letter, and circulated the factual report for review, comment and additional submissions to the complainant and each of the witnesses.

Privacy Investigation

8. It is the PSC's position that "conducting investigations under the PSEA is an administrative function that may have serious implications for the persons involved and therefore the principles of procedural fairness apply. Furthermore, one of the principles is that potentially affected persons have a right to know the issue(s) being investigated and must be given the opportunity to respond and comment on all of the relevant information prior to a decision."
9. Our investigation found that in this case, as is the PSC's practice, the PSC investigator read a script to all interviewees. The script advised that personal information including relevant information obtained during interviews and other information obtained in the course of an investigation may be included in a factual report. Furthermore, factual reports are sent to anyone that could be affected by the investigation for comments on the facts and for submissions regarding the concerns raised. The PSC investigator then asked all interviewees not to share this information with anyone.
10. In relation to the Privacy Act, thePSC asserted that:
    1. Its collection of personal information is in keeping with section 4 of the Act, as it is relates directly to an investigation conducted under the PSEA.
    2. The personal information at issue was collected for the purposes of investigating a process under the PSEA and subsequently used for the purpose of the investigation and therefore compliant with section 7 of the Act.
    3. The PSC has an obligation to disclose personal information to certain individuals where required by the duty of fairness and such disclosures are in accordance with paragraph 8(2)(a) of the Act.
11. As well, the PSC asserted that each individual with whom it shared the factual report were "affected persons" in that they could have been the subject of adverse conclusions as a result of the investigation.
12. This Office then met with the PSC to clarify their investigation practices relating to the sharing of personal information. Following this meeting, this Office was concerned that the PSC was not following its personal information sharing practices outlined in its Investigator's Guide, and as described at paragraph 4 of this report.
13. As a consequence, the Privacy Commissioner wrote to the President of the PSC expressing concerns that the PSC may be interpreting the meaning of "affected person" more broadly than necessary to respect the requirements of procedural fairness, resulting in potentially excessive disclosures of personal information of individuals implicated in PSC investigations. Moreover, the Commissioner advised the PSC that this Office had yet to receive a persuasive rationale that demonstrated the PSC's assessment of how each individual was affected and the corresponding need to know in disclosing the complainant's medical information to all witnesses. Additionally, based on the representations the Office had received to that date, it was understood that the procedures followed in this case were reflective of standard practices of the PSC in the conduct of its investigations under the PSEA.
14. The President of thePSC's response stated that:
    1. In reference to the case at hand, there are changes that the PSC could make to its processes to avoid such situations from arising in the future.
    2. The PSC would take steps to enhance its approach to informing individuals who share their personal information during the course of an investigation to avoid any misunderstandings. As well, the PSC would add checks and balances to its existing procedures in order to protect personal information.
    3. The PSC does not, nor does it intend to, automatically share the full factual report with all the individuals who participate in an investigation. In some instances, a portion of the factual report is shared with participants. Some individuals interviewed during the course of an investigation are not considered to be affected persons and the factual report is not being shared with these individuals.
    4. The PSC would continue to be vigilant and exercise judgment to ensure that it acts in accordance with the Privacy Act.
15. In a follow-up meeting, thePSC also advised this Office that:
    1. The PSC strives to conduct its work using the general principles of "need-to-know" and "minimal disclosure".
    2. Since August 1st, 2014, the following actions had been taken:
       1. ThePSC met with all of its investigators and instructed them to:
          • Be very careful in cases of medical and sensitive issues;
          • Ensure that all individuals interviewed have clear expectations regarding how the information they provide will be treated;
          • Ensure that all individuals interviewed understand that information they provide during an interview may be used and shared with other individuals involved and included in a Factual or Final Report; and
          • Ensure that Factual Reports are only to be shared with those individuals affected by the information contained in a report.
       2. The PSC is considering obtaining consent to allow the disclosure of personal information. However, the PSC maintains that absent consent it is authorized to disclose personal information pursuant to section 8(2)(a) or (b) of the Act.
       3. The PSC Website is being modified and will include information concerning the sharing of personal information gathered during investigations.
       4. Training will be provided to all staff of the Investigations Branch, on the Privacy Act and personal information.
       5. Investigators are discussing with the Director, Investigations all cases where medical or sensitive information has been raised.
       6. All Factual Reports are revised by the Director, Investigations or the Manager, Investigations Support, prior to disclosure.
       7. The PSC is re-examining its definition of affected persons.
    3. Furthermore, thePSC will continue to apply the following principles:
       1. The PSC will continue to disclose personal information in a limited and proportional way, while respecting procedural fairness. It was never the PSC's practice to automatically share the full factual report with all the individuals who participated in an investigation.
       2. The PSC gives careful consideration prior to sharing information when multiple persons may be affected by the information. As in the past, the PSC will continue to balance privacy rights and procedural fairness.

Application

16. In making our determination, we considered sections 3, 4, 7 and 8 of the Act.
17. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
18. Section 4 of the Act provides that personal information collected by a government institution must relate directly to an operating program or activity of the institution.
19. Paragraph 7(a) of the Act states that personal information shall not, without the consent of the individual to whom it relates, be used by the institution except for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.
20. the Act states that personal information can only be disclosed with an individual's consent - subsection 8(1) - or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.
21. Paragraph 8(2)(a) of the Act provides that personal information may be used or disclosed by a government institution without the consent of the individual to whom it relates for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.

Analysis

22. We are satisfied that the doctor's letter contains the complainant's personal information as defined in section 3 of the Act.
23. We agree that the PSC has the authority to collect and use personal information in the conduct of its investigations under the PSEA. At issue however, is whether the PSC's disclosure of the doctor's letter to the witnesses (via a factual report) was a disclosure of personal information contrary to the Privacy Act.
24. The PSC primarily asserts that this disclosure was authorized under paragraph 8(2)(a) of the Privacy Act, as it was required to disclose the complainant's personal information to comply with principles of procedural fairness.
25. To qualify as a "consistent use", a use need not be identical to the purpose for which information was obtained. There need only be a sufficiently direct connection between the purpose for obtaining the information and the proposed use, such that an individual could reasonably expect that the information could be used in the manner proposed^{Footnote 1}.
26. In the instant case, the PSC obtained the doctor's letter for the purpose of conducting a fraud-related investigation. The PSC asserts that it included the doctor's letter in the factual report because it was relevant to the PSC's investigation and it then disclosed the factual report to the witnesses for the purpose of meeting a duty of procedural fairness. In this regard, the PSC submits that procedural fairness dictated that all the witnesses in this case could have been the subject of adverse conclusions as a result of the PSC's investigation and thus were given a copy of the factual report.
27. We agree that, as an administrative body conducting investigations that may have serious implications for participants involved, the PSC may need to observe principles of procedural fairness during its investigations. As a result, participants may reasonably expect the PSC to conduct its investigations in a procedurally fair manner. This could mean that in some cases the PSC may need to disclose some personal information to provide participants implicated in PSC investigations with a fair opportunity to know about and respond to information that may affect them. In this regard, disclosing personal information in order to ensure procedural fairness could be considered a "consistent use" within the meaning of the Act. However, we would expect that any such disclosure would be limited to only that which is necessary to achieve this end.
28. We recognize that in a PSC investigation involving multiple issues and parties, it may be challenging to determine which information needs to be shared with individuals in order to ensure the PSC's process is procedurally fair.
29. In the instant case, we find it difficult to see how any of the witnesses in the circumstances of this case would, from a procedural fairness standpoint, need to know the contents of the doctor's letter. While it may be that the witnesses could have been affected by the issues under investigation generally, we do not see how the details concerning the complainant's health at the time of the incident under investigation could affect the witnesses in any way. The PSC has not identified any serious implications for the witnesses if they did not have the opportunity to see the doctor's letter and respond to it. As a result, it does not appear that it was necessary for the PSC to provide the witnesses with the contents of the doctor's letter.
30. We note that the PSC's Investigator's Guide indicates that if an individual is affected by only a minor part of a factual report, the investigator can share only that part of the report with that individual for comment. Therefore, the PSC's own policy supports more tailored disclosures of personal information in PSC investigations.
31. In the circumstances, we cannot conclude, as the PSC has suggested, that it was necessary to disclose details of the doctor's letter to the witnesses for reasons of procedural fairness. In our view, an individual would not reasonably expect that their sensitive medical information be included in a factual report to be shared with anyone who did not have a demonstrated need to know that information. Accordingly, in the circumstances, we are not satisfied that the requirements of paragraph 8(2)(a) have been met.

Findings

32. The PSC's disclosure of the contents of the doctor's letter to all witnesses cannot be considered a "consistent use" within the meaning of paragraph 8(2)(a). The PSC has also not established that another provision under subsection 8(2) of the Act would apply to authorize the disclosure in the circumstances. We therefore find the PSC contravened subsection 8(1) of the Act. Consequently, the complaint is well-founded.

Other

33. The PSC has committed to implement procedures to ensure compliance with the Privacy Act when disclosing personal information in the conduct of its investigations. This Office will follow-up with the PSC within the next year to ensure that it has implemented all of its proposed changes to its investigation process and is respecting its obligations under the Act.
34. Various other government bodies that conduct administrative investigations use investigative techniques that do not require the disclosure of information collected from witnesses to all other witnesses in order to satisfy the requirements of procedural fairness. Therefore, we ask that the PSC consider reviewing its investigative techniques used in disclosing personal information to ensure that its practices follow the need-to-know and minimal disclosure principles.