Mishandling employees’ personal information – Public Services and Procurement Canada

Complaint under the Privacy Act (the Act)

1. The complainant alleges that Public Works and Government Services Canada (PWGSC) contravened the provisions of the Act with respect to the disclosure of her personal information. Specifically, she claims that during a management meeting of her division the Director disclosed that the complainant had filed a harassment complaint against her.

Background Information

2. The complainant states that she filed a harassment complaint against the Director and that she received an acknowledgement from the Assistant Deputy Minister of the Human Resources Branch shortly thereafter.
3. The complainant states that a colleague informed her that during a meeting chaired by the Director, the Director disclosed that the complainant had filed a harassment complaint against her.

Summary of Investigation

4. Our investigation confirmed that a management meeting chaired by the Director was held.
5. According to the notes taken by an employee who attended the meeting, the Director disclosed, for information purposes, that the complainant had filed a complaint against her. She also indicated that the Director admitted that she had hesitated before sharing this information with her team but, since it was also her own personal information, she believed she was entitled to share it.
6. Our investigation confirmed that the notes taken by the employee at the meeting were authentic. These meeting notes attest that the Director did indeed disclose that the complainant had filed a complaint against her.
7. We also interviewed all the employees who had attended this meeting, including the Director. In all, eight individuals were present at the meeting. Of those eight individuals:
   • five, including the Director, confirmed that the Director had indeed disclosed that the complainant had filed a complaint against her; and
   • the three others could not remember whether the Director had specified who had filed a complaint against her.
8. Although our investigation revealed that the Director had disclosed who had filed the complaint against her, we did not find any evidence that she had also specified what type of complaint it was.

Application

9. To render a decision in this case, we considered sections 3 and 8 of the Act.
10. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing, information relating to race; national or ethnic origin; colour; religion; age; marital status; education; medical, criminal or employment history; identifying numbers; fingerprints; blood type and personal opinions.
11. Subsection 8(1) of the Act stipulates that personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this section.
12. Paragraph 8(2)(a) of the Act stipulates that personal information under the control of a government institution may be disclosed for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.

Analyses

13. Sometimes, the same information can be considered “personal” to more than one person. In this case, the fact that the complainant had filed a complaint against the Director is information that concerns both the complainant and the Director, which constitutes personal information under section 3 of the Act.
14. On the one hand, the fact that a complaint was filed against the Director is the personal information of the Director. On the other hand, the name of the complainant constitutes her personal information because it reveals information about her, i.e. her identity as the complainant.
15. In such circumstances, when the personal information belongs to both parties, a decision must be made to balance the public and private interests of each party.
16. Subsection 8(1) of the Act prohibits a government institution from disclosing personal information about an individual, unless it obtains the consent of the individual concerned. There are, however, very specific circumstances where this rule does not apply, and they are set out in subsection 8(2). The purpose of our investigation was to verify whether the disclosure of information by (the institution concerned) was in compliance with paragraph 8(2)(a) of the Act. This paragraph stipulates that personal information under the control of a government institution may be disclosed to third parties for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose.
17. The Treasury Board Directive on the Harassment Complaint Process states as follows:

    5.2.1 Complaints of harassment are handled fairly, confidentially,^{Footnote 1} and in a timely manner.

18. In addition, according to the PWGSC Guideline on Dispute Resolution of Harassment in the Workplace, all persons directly or indirectly involved in a complaint or dispute resolution process must recognize the serious nature of such cases, respect the confidentiality involved and refrain from discussing such cases amongst themselves. Every effort must be made to preserve the dignity and respect of the parties involved at all times. Namely, the respondent must:

    …limit all discussion of the complaint to those who need to know.

19. Our investigation revealed that during the management meeting the Director of her division within PWGSC disclosed that the complainant had filed a complaint against her.
20. Our investigation determined that the Director had not obtained the complainant’s consent before disclosing this information, and we did not find any indication that the employees present at the meeting were involved in this complaint resolution process or needed to know this information. As a result, we are not satisfied that PWGSC reasonably contemplated the appropriateness of disclosing the complainant’s identity to the employees present at the meeting.

Findings

21. We therefore find that the complaint is well-founded.