This Report of Findings relates to a Commissioner-initiated complaint under the Privacy Act (the Act) against Health Canada (HC). It relates to the mailing of 41,514 letters using windowed envelopes to "Marihuana Medical Access Program" (MMAP) clients that allowed the name of the program to be openly visible.
Background
On November 21st, 2013, HC posted a notice on its website from the Deputy Minister stating that the department had "recently sent approximately 40,000 informational letters to individuals with an interest in upcoming changes to the Marihuana Medical Access Program." It further stated that, "as a result of an administrative error the envelopes were labelled to indicate that they were sent by the Program. This is not standard Health Canada practice."
The Office of the Privacy Commissioner of Canada (OPC) determined that there were reasonable grounds for a Commissioner-initiated complaint against the department.
Accordingly, the OPC initiated a complaint against HC on December 5th, 2013, pursuant to subsection 29(3) of the Act.
The OPC's investigation focused on whether HC contravened the disclosure provisions of the Act when it included the name of the MMAP in the return address which was clearly visible through the windowed envelopes.
The OPC also received 339 complaints against HC from individuals who received the mail-out. Instead of investigating each complaint separately, the Commissioner-initiated process served as the representative complaint investigation by the OPC. As such, the results of the Commissioner-initiated complaint are being shared with the 339 complainants.
Since 2001, HC has granted Canadians access to marihuana for medical purposes provided they have the support of their physicians. Once approved under the Marihuana Medical Access Regulations (MMAR), individuals had three options for obtaining a legal supply of dried marihuana. They could:
apply under the MMAR to access HC's supply of dried marihuana;
apply for a personal-use production licence; or
designate someone to cultivate on their behalf with a designated-person production licence.
In response to concerns from stakeholders that the program was open to abuse, the Government of Canada repealed the MMAR on March 31st, 2014, and introduced the new Marihuana for Medical Purposes Regulations (MMPR). HC stated that these new regulations aimed at treating marihuana, as much as possible, like any other narcotic used for medical purposes by creating conditions for a new commercial industry that would be responsible for its production and distribution. Consequently, under the MMPR, the only way to access marihuana for medical purposes is through commercial licensed producers.
Following these changes, a letter and a "Questions and Answers" document were drafted by HC to communicate information about the upcoming transition to clients.
Summary of Facts
On July 18th, 2013 HC and Canada Post Corporation (CPC) entered into a Memorandum of Agreement (MOA) setting out the framework that would allow CPC to handle the mail-out of HC information packages to all clients of the MMAP.
The investigation revealed that on October 24th, 2013, HC provided pre-printed envelopes to CPC with return addresses that did not include the program name and postal indiciaFootnote 1. HC submitted that it was notified by CPC on October 30th, 2013, that the envelopes it had provided were not compatible with CPC's machine for mass mail-outs.
Because HC wished to send these informational letters out as soon as possible, CPC recommended that it use generic, oversized windowed envelopes. These envelopes would allow the letter to be folded in such a way that both the mailing address and return address would be visible through the window. This eliminated the extra step of having to print the addresses directly on the envelopes, or on labels that would then have to be affixed to each envelope. HC has no specific policies regarding return addresses and thus agreed with CPC's recommendation in the interest of expediency. HC provided the full program name and address in both English and French to CPC, which printed off the package as directed.
On November 19th, 2013, a total of 41,514 letters were sent to MMAP clients with the full program name openly visible through the windowed envelopes.
The OPC received 339 complaints from MMAP clients who received the mail-out and were concerned that the full name of the program was legible through the envelope.
Summary of Complainants’ Concerns
The complainants alleged that HC failed to protect their privacy by including the name of the MMAP in a clearly visible manner on the mail-out packages, thereby revealing their personal information (i.e. their identity and involvement with the MMAP) to CPC employees and members of the public.
The complainants cited several concerns relating to the impact ofHC's actions on their personal lives. In particular:
Career and financial position: Some individuals raised concerns that they could lose their jobs if their employers learned of their usage of medical marihuana.
Reputation: The use of marihuana, even for medical purposes, carries a social stigma due to its status as a prohibited substance. Some complainants alleged that they received comments from people about their association with the program as a result of the HC mail-out.
Safety: As mentioned in HC's letter to its clients regarding the program, "The current practice of allowing individuals to grow marijuana for medical purposes poses risks to the safety and security of Canadians. The high value of marijuana on the illegal market increases the risks of violent home invasion and diversion to the black market." Disclosure of the fact that a person is associated with the program thus increases the above-mentioned risks to these individuals and this statement demonstrates that HC recognizes these risks.
Health or well-being: The purpose of the program is to offer medication to individuals who have serious medical conditions. Many of the complainants in this case alleged that their health was adversely affected due to stress following the disclosure.
Summary of Health Canada’s arguments
HC made four main arguments explaining why the inclusion of the name of the program, the MMAP, in its return address does not constitute a violation of the Act. Each ofHC's arguments is suMMARized below, while theOPC's analysis with respect to each of these arguments can be found further in this report.
MMAP clients shared details of the incident with media, thus contributing to the public attention they received. In fact, they disclosed their affiliation with the MMAP themselves. What was made public about the individuals who received the envelopes is not a disclosure by HC.
If there has been a disclosure of personal information, mail recipients implicitly consented to the disclosure to CPC (in the context of regular mail), and to other individuals, including individuals living at the same address or individuals who pick up mail for the recipient. Therefore, the disclosure was authorized under section 8(1) of the Act.
If there has been a disclosure of personal information, the disclosure was authorized under section 8(2)(a) of the Act, as it was a "consistent use." It is reasonable for an individual to expect that the information would be disclosed for the purposes of corresponding with the individual via mail.
While HC acknowledged that inclusion of "Marihuana Medical Access Program" in the return address was the result of an administrative error, it states that this was within the realm of reasonable and lawful options that it could have chosen. Furthermore, HC states that limiting the amount of information in the return address block could have broad implications on how government institutions communicate with individuals by mail.
Methodology
The OPC examined the circumstances surrounding the incident, as well as the MOA between HC and CPC. To this end, we reviewed the representations received from HC in relation to the incident. Our investigation also included the review of procedures, guidelines, and e-mail exchanges between HC and CPC. Further, we met and discussed the incident with departmental officials.
Application of the Act
In making our determination, we considered sections 3 and 8 of the Act.
Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form, including information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
The Act states that personal information can only be disclosed with an individual's consent - as per section 8(1) - or in accordance with one of the categories of permitted disclosures outlined in section 8(2).
Section 8(2)(a) of the Act provides that personal information may be disclosed by a government institution without consent for the purposes for which the information was obtained, compiled by the institution, or for a use consistent with that purpose.
Analysis
For the purposes of fulfilling its mandate to operate a postal service, CPC outlines the general requirements under which items may be transmitted by post. CPC recommends providing a return address as it gives the recipient a way to determine how to respond to the sender of the message, if needed. While the return address does not have to include a sender's name, it should include an address or P.O. Box in the same format as the delivery address.
The issue in this case relates to how the return address is structured and mailed by CPC on behalf of HC. The return address includes the full name of the program - the MMAP - and can be read in conjunction with the client's name and address.
We are of the view that the phrase "Marihuana Medical Access Program," along with an individual's name and address, constitutes the personal information of the addressee as defined by section 3 of the Act. The reference to the MMAP in the return address reveals information about an identifiable individual, namely the addressee. Whether the inference is drawn that an individual is enrolled in the program, or merely expressing an interest in it, including the name of the program in the return address associates a clearly identifiable individual to the MMAP - a program that, simply by its title, explicitly refers to marihuana access.
HC Argument # I: "Significant media coverage revealed that the letters were sent to MMAP clients"
HC argues that it was the significant media coverage that revealed that the letters were sent to clients of the MMAP, and that at no time before or after the mail-out did HC publicly state that the mail recipients were clients of the MMAP.
HC states that it does not dispute the fact that an individual's name and address combined with the name of the program, MMAP, in the return address is personal information. However, it submits that it was the recipients of the letters themselves who drew public attention to their involvement with the program.
HC maintains that identifying the name of the program in the return address could have simply indicated an interest in the program - i.e. general information requests for research purposes, communication to respond to a previous consultation, or a response to an employment application.
To this end, HC asserts that what has been made public about the individuals who received a letter in this case is not an unlawful disclosure of personal information by HC.
OPC Analysis
HC, as an institution subject to the Act, has a legislative duty to protect the fundamental privacy rights of individuals by limiting the collection, use and disclosure of their personal information.
Consequently, HC is required to protect the information collected for the administration of its programs, which includes protecting the fact that an individual is involved with, has applied for, or expressed interest in a particular program or service. In this case, the fact that the complainants are associated with the MMAP, should have been protected. The very name of the program raises the level of sensitivity of the information, and should only be disclosed with the consent of the individuals, or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.
Subsequent actions by certain individuals, such as communication with the media, do not alter HC's obligations under the Act.
HC Argument # II: Mail recipients implicitly consented to the disclosure of their personal information — in corresponding with the individual recipient, to CPC, or any other individuals living at the same address — as authorized under section 8(1) of the Act
HC submits that there was no unauthorized disclosure of personal information as clients of the program could reasonably expect to receive correspondence from the MMAP.
HC explained that all the letter recipients had an existing relationship with HC as clients of the MMAP and had corresponded with HC via regular mail delivered by CPC in the past. HC submits that it regularly receives mail from recipients using "MMAP" in the destination address block, alongside their name and address in the return address block. As a result, HC states that it is reasonable to rely on these past communications with MMAP clients as an implied consent to disclose their personal information to CPC in the same manner when communicating with them through the post.
In its representations, HC does not deny the fact that there was a disclosure of personal information if an individual living at the same address as a complainant viewed the envelope. Notwithstanding, it relies on the argument that clients of the MMAP have implicitly consented to the disclosure. HC further submits that it is an inherent consequence of individuals living together and sharing a mailing address that somebody other than the recipient might see another's mail.
Consequently, HC is of the view that, as clients of the MMAP, they have implicitly consented to the disclosure of this information and that these disclosures are authorized pursuant to subsection 8(1) of the Act.
OPC Analysis
The question at issue is whether clients of the MMAP have implicitly consented to receive correspondence from HC that visibly identifies the MMAP, alongside their names and home addresses.
The Privacy Act does not expressly state that consent may be implied, as is the case under the Personal Information Protection and Electronic Documents Act. However, the OPC has found that implied consent may, in some circumstances, be reasonably inferred from an individual's actions. When determining whether implied consent is appropriate, the OPC will take into account the sensitivity of the personal information at issue and the reasonable expectations of the individual in the circumstances.
With this in mind, our view is that HC has not demonstrated that it could rely on implied consent in these circumstances. HC has not provided evidence to show that every individual it corresponded with had previously sent correspondence to HC with their name, address and the MMAP on the envelope.
Moreover, the disclosure involves information that is very sensitive in nature as it relates to an individual's potential involvement with the MMAP. Indeed, previous mail contact by HC for the purposes of administering the MMAP never explicitly identified the program. Furthermore, HC admits that including the reference to the MMAP was an administrative error. Absent evidence to the contrary, it is difficult to accept that MMAP clients would have expected HC's envelopes to allow the name of the program to be openly viewed.
We therefore cannot conclude that MMAP clients implicitly consented to the disclosure of their personal information by virtue of past correspondence with HC.
HC Argument # III: "It was a consistent use under section 8(2)(a) of the Act"
HC stated that, if the above-noted argument of implied consent is not accepted by our Office, it would then rely on the consistent use provision under section 8(2)(a) of the Act as authority for the disclosure.
HC's position is that it collected personal information from clients of the MMAP for the purposes of administering the program, which included corresponding with individuals via mail. Specifically, HC states that it disclosed the personal data in the course of sending clients information about upcoming changes to the program. Given the close link between the purposes of collection and disclosure, in HC's view, it is reasonable for an individual to expect that the information would be disclosed for this purpose to the clients of the MMAP.
OPC Analysis
To qualify as a "consistent use" under section 8(2)(a) of the Act, a use need not be identical to the purpose for which information was obtained. There need only be a sufficiently direct connection between the purpose for obtaining the information and the proposed use, such that an individual could reasonably expect that the information could be used in the manner proposedFootnote 2.
The OPC does not disagree that a person would reasonably expect that their participation in the program would require contact by HC for administrative purposes. However, it would not seem reasonable to expect that HC would correspond with individuals in a manner that indicates their involvement with the MMAP, particularly given the sensitive nature of the program. This was confirmed by several complainants, particularly those who live in small communities, who indicated that they never expected to receive correspondence from HC with the name of the program to be openly visible.
In our opinion, the simple association of an individual to a program such as the MMAP can have social, safety and security consequences, as raised by many of the complainants in this case. While marihuana may be used for medical purposes, and under the MMAP its use and cultivation is overseen by the government, it nonetheless carries a social stigma due to its status as a prohibited substance. Consequently, the information disclosed could support inferences that an individual is consuming or producing the substance, or that an individual has a serious medical condition. For these reasons, we are compelled to take into consideration the sensitivity of this type of information.
Our review of the evidence and representations from HC did not convince us that the disclosure of the name of the program was in any way necessary for the administration of the program - i.e. mailing the letters. While standard mailing information had to be included in the return address to meet CPC guidelines, the exact program name was not necessary for clients to respond to HC, nor would it have been required for the purposes of returning an undelivered letter to HC.
Moreover, HC did not present any evidence that it turned its mind to exercising its discretion under 8(2)(a) to include the MMAP in its return address in the circumstances. On the contrary, HC admits that the reference to the MMAP on the mail-outs was both a departure from its usual practices and an administrative error.
It is therefore difficult to accept that referring to the MMAP on correspondence with individuals involved in the program could fall within an individual's reasonable expectations as a consistent use of that information. As such we are of the view that the disclosure at issue in this investigation was not authorized under section 8(2)(a) of the Act.
HC Argument # IV: "Limiting the amount of information on the return address block could have broad implications on how government institutions communicate with individuals through mail"
HC acknowledged that the inclusion of the name of the program in the return address was the result of an administrative error and was not standard HC practice. However, HC's position is that its inclusion was within the realm of reasonable and lawful options that it could have chosen. Government institutions may decide to include more or less information in a return address, depending on the circumstances.
HC contends that the amount of information in a return address serves two purposes: it captures the recipient's attention, and it allows the mail to be returned, if need be. To take the position that a return address should never include data that would reveal personal information, HC argues, would make it difficult to ever include a return address on mail. Furthermore, HC contends that an overly strict application of the minimal disclosure rule could have broad implications for how government institutions and private sector entities communicate with individuals through the mail.
OPC Analysis
The investigation confirmed that, in the past,HC used an address locator in the return address block as follows:
Health Canada-HECS/Santé Canada-SESC AL/IA 0300A Ottawa, ON, K1A 0K9
In the present case, the return address included the specific name of the HC program which, as noted previously in this report, was not demonstrably necessary for the purposes of program administration, or to facilitate the return of envelopes to HC. In fact, HC was unable to provide any evidence to indicate that it ever had any particular difficulties using an address locator in the return address block.
We do not disagree that a return address on an envelope would facilitate its return; however, consideration must be given to ensuring that the privacy of the addressee is in fact respected.
Institutions must take reasonable steps to ensure that communications sent through the mail sufficiently protect the privacy interests of their clients, especially when handling information as sensitive as one's interest in a program which deals with medical marihuana. In keeping with the spirit and requirements of the Privacy Act, government institutions are expected to implement strategies to mitigate the risks of unauthorized disclosure of personal information.
Findings
We conclude that the reference to the MMAP in HC's return address in combination with the name of the addressee, constitutes sensitive personal information under the Privacy Act. HC has not satisfied the OPC that it had appropriate consent for the disclosure of this information, nor did it establish that any of the permissible disclosures under section 8(2) of the Act would apply in the circumstances. We accordingly conclude that HC was in contravention of the Act. Therefore, the complaints are well-founded.
Other
We recognize that HC's regular practices do not include identifying the specific program name on communications with clients, and that the mail-out in this case was the result of an administrative error. Moreover, following this unauthorized disclosure, HC has put in place strict mail-out procedures which aim at protecting their clients' personal information.
We also note that HC created a new Privacy Working Group to assist the Bureau of Medical Cannabis in meeting its legal obligations to protect the personal information of its clients.
Nonetheless, we would like to emphasize that HC should always consider the sensitivity of the information it handles, the degree of stigma often attached to this information, and the high level of protection that such information calls for.
We encourage HC to follow its new procedures for the management and coordination of mail-outs in a way that ensures consideration is given to the safeguarding of clients' sensitive personal information in order to minimize the risk of unauthorized disclosure.
