The PBC refuses to process requests for record suspension information

Complaint under the Privacy Act (the Act)

Abstract

1. The Office of the Privacy Commissioner (OPC) received two denial of access complaints against the Parole Board of Canada (PBC) in the context of individuals seeking employment for positions of authority or trust in the vulnerable sector.
2. The first complaint relates to requests for access to personal information under the Act facilitated by a third party background screening company operating in Canada (the “company”) on behalf of individuals who use its record suspension verification service. The PBC stated that it would no longer process access requests for record suspension information from the company pursuant to paragraph 22(1)(b) of the Act, in consideration of the requirements set out under section 6.3 of the Criminal Records Act (the CRA).
3. The second complaint raises concerns regarding the PBC’s requirement that requesters provide additional identification information before the PBC accepts to process requests under the Act for record suspension information.

Overview of the investigation

4. The OPC issued a Preliminary Report of Findings (Preliminary Report) to the PBC on February 24, 2016, in order to provide the PBC with our understanding of the facts, to set out our preliminary views and to seek any additional representations in relation to these complaints.
5. In response to our Preliminary Report, the PBC outlined the implications of our preliminary findings for the CRA and organizations within the Public Safety Portfolio, and asked that we reconsider our position in these matters. The PBC provided additional representations to justify its refusal to disclose personal information pursuant to paragraph 22(1)(b).
6. The OPC recognizes that the privacy of its applicants and the protection of their personal information is a key priority for the PBC. However, after considering submissions from the parties and reviewing the facts, we are of the view that the PBC erred in invoking paragraph 22(1)(b) of the Act as a basis to refuse to process requests from the company for record suspension information. To this end, the PBC has not demonstrated to our satisfaction that the disclosure of the requested information in given circumstances could reasonably be expected to be injurious to the enforcement of the CRA. We are also of view that the PBC’s requirement that requesters provide additional identification information before the PBC accepts to process requests under the Act for record suspension information goes beyond what is required to adequately identify a requester. Accordingly, we find the complaints to be well-founded.
7. In light of our findings, we recommended to the PBC pursuant to section 35 of the Act that it cease its reliance on section 22(1)(b) of the Act to refuse to process access requests for record suspension information from individuals or from the company on behalf of individuals who use its record suspension verification service except where there is a potential match between a requester and the subject of the suspended record of conviction, but the identity of the requester cannot be confirmed without fingerprints or additional criminal record information. We further recommended that the PBC limit the amount and type of the information it requests and gathers to what is required to adequately identify a requester and that it reprocess the access requests for record suspension information from applicants of the record suspension verification process who submitted their own Privacy Act requests directly to the PBC.
8. In a response received on December 7, 2016, the PBC did not accept our recommendations in their entirety. The PBC advised that it would continue to process privacy requests received directly from the applicants, as was done prior to the complaints being filed, and that applicants would be required to provide a photocopy of a document to authenticate their identity, along with their FPS number, PBC reference number, and/or copy of their criminal record. The PBC further advised that applicants who are unable or unwilling to provide this information would have their requests deemed abandoned.
9. The rationale for our findings and recommendations is presented below.

Investigation Methodology

10. During the course of our investigation, we received representations from the complainant and the PBC, and reviewed relevant legislative, regulatory, policy, and procedural frameworks and instruments. Our office met with representatives of the PBC, the Royal Canadian Mounted Police (RCMP) and Public Safety Canada at their request on June 8, 2016 and received additional submissions in response to our Preliminary Report of Findings; those submissions were submitted to our office in writing on June 23, 2016. While there are many facets to Vulnerable Sector Verifications (VSV) and pardons or suspended records of conviction, we limited our analysis and comments to the specific situation at hand.
11. This report serves to summarize the facts and the representations received from the parties, and presents the findings of our investigation.

Background

Vulnerable Sector Verification

12. A VSV is an enhanced criminal record check and is primarily intended to assist organizations in screening applicants for positions of authority or trust relative to children, seniors or other vulnerable persons.
13. A VSV is a query of the RCMP National Repository of Criminal Records, including pardoned criminal files associated with sexually based criminal offences, Canadian Police Information Centre Intelligence and Investigative databanks, and police service records management systems where the applicant has resided.
14. The VSV process is governed by section 6.3 of the CRA. Section 6.3 of the CRA creates an exception to the general rule of non disclosure of pardoned records as set out in subsection 6(2) of the CRA. Section 6.3 permits information pertaining to pardoned records for sex-related offences to be made available to people or organizations responsible for the well-being of children, seniors or other vulnerable persons, where an individual is seeking a position of trust or authority in relation to those persons (either on paid or volunteer basis).
15. The VSV process can only be completed by a police service of local jurisdiction where the applicant resides or an authorized body, which must be satisfied that a request to complete a VSV is consistent with the criteria prescribed in the CRA. If the position is not connected to the vulnerable sector, the police service or the authorized body will refuse to process the request or offer a regular criminal record check instead. If the position is connected to the vulnerable sector, the police service or the authorized body is required to submit fingerprints to the RCMP, which will then check its database to determine whether the individual has received a record suspension for an offence listed in Schedule 2 of the CRA. In cases of a match, it is the Minister of Public Safety who decides whether a record suspension will be disclosed in the context of the position applied for.
16. Wait times for VSVs in many jurisdictions exceed several weeks or months, which can lead to the loss of employment, volunteer opportunities or student placements.

The company and its record suspension verification service

17. The company provides background screening services that include criminal record and local police information checks. In response to a need to provide Canadians with an alternative solution for vulnerable sector screening, the company developed a multi-service screening tool for those seeking positions within the vulnerable sector, which consists of three components: a criminal records check; a query of local police information; and, a record suspension verification.
18. The record suspension verification component of the multi-service screening tool relies on a request made under the Privacy Act to the PBC to determine whether a pardon or a record suspension for a conviction exists that may be releasable under the CRA.

Summary of the Investigation

Summary of the Privacy Act requests and the PBC’s responses

19. The company submitted several hundred Privacy Act requests to the PBC on behalf of its clients / applicants in a matter of months. These requests sought to obtain either a copy of the applicant’s previously granted pardon or record suspension, or a confirmation that no pardon or record suspension had ever been granted. The company also instructed the PBC to forward the results directly to its Canadian police partner(s).
20. The PBC initially accepted and processed at least 170 such requests under the Act, and accepted another 400 for processing, but then refused to process any others submitted by the company. In a letter dated February 19, 2015, the PBC advised the company that it would “no longer process these or any other PA [Privacy Act] requests received from your company, pursuant to paragraph 22(1)(b) of the PA specifically as it relates to section 6.3 of the Criminal Records Act”. Moreover, the PBC stated that it would require additional information, including a photocopy of a document to validate the identity of the applicant, along with the applicant’s Fingerprint Serial (FPS) number, PBC reference number, and/or copy of the applicant’s criminal record before processing such requests. Lastly, the PBC advised that it would only release personal information to the individual to whom the information relates or directly to the third party authorized to make the request, where sufficient proof of consent, as well as the individual’s clear understanding of the implications of this consent, were provided.
21. As a result, a number of applicants of the record suspension verification process subsequently submitted their own Privacy Act requests directly to the PBC, in which they asked for all records in their name pertaining to a pardon or record suspension held in Personal Information Bank (PIB) PBC CLCC 030 [sic]^{Footnote 1}.
22. However, in response to these requests, the PBC insisted on receiving a photocopy of a document to authenticate the applicant’s identity (valid government ID with name, photo, date of birth, and signature), along with the applicant’s PBC reference number, FPS number or copy of the applicant’s criminal record. The PBC advised that failure to provide such additional information would result in the requests being considered abandoned.
23. In more recent responses, the PBC further advised applicants that some companies that offer criminal record and vulnerable sector checks are directing individuals to the PBC as part of their process. It noted that, if this applied to them, the PBC was not involved in vulnerable sector checks and these companies should not be directing them to the PBC as part of their process. The PBC further advised that if these applicants had never been convicted of a criminal offence and/or applied for a record suspension or pardon, it would not be able to process their requests.
24. For the purpose of these complaints, our investigation examined the PBC’s February 19, 2015 response to the company along with its new requirements, and the PBC’s responses to applicants of the record suspension verification process who submitted their own Privacy Act requests directly to the PBC.

The Company’s Representations

PBC’s application of paragraph 22(1)(b)

25. In its complaint and in its representations to our Office, the company takes the view that the PBC erred in exempting the information sought under paragraph 22(1)(b) of the Act. The company argues that any potential injury under paragraph 22(1)(b) cannot be inferred on a theoretical basis and that there must be a reasonable expectation of probable harm, and that the PBC has offered no explanation of how and why the harm alleged might reasonably be expected to result from the disclosure of the requested information. The company takes the position that it is inappropriate for the PBC to invoke paragraph 22(1)(b) without explaining how the record suspension verification process would cause injury in relation to section 6.3 of the CRA, and further argues that the record suspension verification component of the multi-service screening tool does not circumvent the vulnerable sector verification process described under section 6.3 of the CRA.

PBC’s requirement for additional information

26. The company accepts that the PBC has certain rights to request additional identification information to facilitate the processing of requests that it receives. For the most part, the company takes no issue with the additional information that the PBC would want to receive. As well, the company recognizes that the PBC, as the custodian of the record, has a great deal to say with respect to the method of disclosure and to whom the disclosure will be made, and takes no issue with the PBC’s view that it will only disclose information to the individual requester and not to the company’s third-party police partners.
27. However, the company submits that the PBC is insisting on receiving personal information that it knows the requester is unlikely to possess (i.e. an applicant’s FPS number, PBC reference number, and/or copy of their criminal record) as a means to shut down requests for personal information made under the Act. The company contends that this information is not needed in order for the PBC to conduct a search of the Pardon And Record Suspension System (PARSS) and that requests can be processed based on the individual’s name and date of birth. As well, the company is of the view that in those exceptionally rare instances where a search uncovers records pertaining to two distinct records for individuals sharing the same name and date of birth (or in exceptional cases where there are multiple same names), then requesting photo identification would be appropriate. In sum, since the additional information being requested by the PBC is not information that most Canadians have, or readily have available, it constitutes more personal information than is necessary to respond to a request under the Act.

PBC’s Initial Representations

Right of access

28. The PBC argued that the company’s record suspension verification requests seek a confirmation of a negative, that is, that a record suspension does not exist. The PBC submitted that the purpose of the Act is to provide individuals with a right of access to information about themselves that actually exists and is under the control of a government institution. The PBC noted that the vast majority of individuals who use the company’s record suspension verification service will not have a record suspension for a sexual offence.

PBC’s application of paragraph 22(1)(b)

29. In its representations to the Office, the PBC also stated that the record suspension verification component of the company’s multi-service screening tool circumvents the vulnerable sector verification process set out under the CRA. Specifically, the PBC submitted that the administration, enforcement and integrity of the CRA would be injured if individuals use the general access provisions of the Act to override the more specific and restrictive regime under the CRA in respect of the disclosure of information relating to record suspensions. The PBC further submitted that the provisions of the CRA cannot be ignored when individuals file access requests under the Act, and that the application of paragraph 22(1)(b) in this case is consistent with the legal principle that apparently conflicting laws should be interpreted harmoniously.
30. The PBC argued that, given the nature of the records in question, compliance with a Privacy Act request for such records would require it to verify the identity of the applicant in the same way that is currently done for vulnerable sector verifications, which may involve both database checks by local police and fingerprinting by the RCMP. The PBC argued that this process “is essential to ensure that information about the right person is being considered for disclosure”, and that given that such verifications take at least 120 days, this is in excess of the 60-day maximum time allowed under section 15 of the Act and it is therefore not possible to comply with both the Act and the vulnerable sector verification process under the CRA.

PBC’s requirement for additional information

31. With respect to the requirement for additional information, the PBC stated that this is needed to confirm the identity of the person making the request and to ensure that the person requesting information has applied to the PBC for a decision concerning a record suspension. In particular, given the nature of the records in question, compliance with such requests requires the PBC to verify the identity of the applicant in the same way that is currently done for vulnerable sector checks, which may involve both database checks by local police and fingerprinting by the RCMP, and takes far longer than the 60-day maximum time allowed under section 15 of the Act.

Preliminary Report

32. As noted at paragraph 4 of this Report, we issued a Preliminary Report to the PBC in February 2016 in order to set out our preliminary views and to seek additional representations in relation to these complaints.
33. The preliminary report highlighted our views on whether the Act entitles a requester to a confirmation that there are no records responsive to his or her particular access request. We also examined the PBC’s use of section 22(1)(b) to refuse to process access requests for record suspension information from the company on behalf of individuals who use its record suspension verification service, along with the PBC’s requirement for additional information.

PBC’s Additional Representations

34. The PBC responded to our Preliminary Report on June 23, 2016. The PBC provided additional representations to explain its refusal to disclose personal information pursuant to paragraph 22(1)(b).
35. In representations to our Office, the PBC submitted four key points:
    1. The screening model proposed by the company (the applicant) would violate the prohibition in the CRA on the disclosure of the existence of a record for which record suspension has been ordered. Such disclosures would contravene the fundamental purpose of the CRA, which is that, after a period of sustained law-abiding behavior, individuals should have the ability to move on without continuing to bear the consequences of having been convicted for criminal offences.
    2. The Privacy Act requests at issue seek to obtain a much broader range of information than that which would be disclosed in a Vulnerable Sector check, i.e. any personal information about a job applicant in the PBC’s possession in relation to a record suspension that has been ordered in respect of any offence, not just those of a sexual nature.
    3. There is a live issue as to whether the “consent” of the person to whom the information relates is valid in this context. Individuals are being required to sign a form as a condition precedent for being further considered for employment and to waive their privacy rights without having reviewed the information that would be disclosed and without being fully informed of its intended uses, retention and disclosure.
    4. The applicant’s proposed use of the personal information runs afoul of human rights legislation. Federal, provincial and territorial laws prohibit discrimination based on the existence of a record for criminal convictions for which a record suspension has been granted. It is improper for the applicant to use the right of access in the PA to obtain information that it is prohibited from using for its core business purpose, at least in some jurisdictions.

Findings

Can an individual make a request for access to personal information under the Act for the purpose of confirming that the PBC does not have any responsive information relating to record suspensions?

36. Our investigation first contemplated whether or not an individual could make a request under the Act for the purpose of confirming that personal information does or does not exist.

Application

37. In arriving at our findings, we considered sections 12, 13, 14 and 16 of the Act, as well as subsection 8(1) of the Privacy Regulations (the Regulations).
38. Section 12 of the Act provides individuals with a right of access to personal information about themselves under the control of a government institution. The Act also specifies the manner in which a government institution must respond to a request for access under subsection 12(1) of the Act.
39. Section 13 of the Act and subsection 8(1) of the Regulations set out the requirements for a complete request for access to personal information.
40. Under section 14 of the Act, the head of the institution concerned must, subject to any time extensions, give written notice to the requester as to whether or not access to the information or a part thereof will be given, and if access is to be given, give the individual access.
41. In cases where an institution refuses to give access to personal information, section 16 of the Act provides that it may state in the notice given under paragraph 14(a) that the personal information does not exist, or must state the specific provision of the Act on which the refusal was based or could reasonably be expected to be based if the information existed.

Analysis

42. We are satisfied that a request from an individual seeking access to pardon or record suspension information about him or herself and described in PIB PBC PPU 010 meets the requirements of an access request for the purposes of subsection 12(1) of the Act. A requester is generally entitled to receive pertinent records or to know if no record exists, subject to limited exceptions expressly specified in the Act. The fact that section 16 of the Act provides that an institution may, in refusing to give access to personal information, state that the personal information sought does not exist, further supports the view that a request can be valid even though it may not result in the recovery of responsive records. Nothing in the Act supports the PBC’s position that the purpose of the Act is to provide individuals with a right of access to personal information that actually exists and therefore that there is no right for a requester to know that no personal information exists in relation to a requester.

Has the PBC properly applied the exemption found under paragraph 22(1)(b) of the Act to refuse access requests for record suspension information in the context of this complaint?

43. Our investigation examined the PBC’s application of paragraph 22(1)(b) of the Act as a basis to refuse to process requests from the company for record suspension information.

Application

44. In arriving at our findings, we considered paragraph 22(1)(b) of the Act. We also considered sections 6 to 6.4 of the CRA.
45. The Act sets out a number of exemptions to the right of access provided under section 12. Paragraph 22(1)(b) of the Act states that a government institution may refuse to disclose personal information if the release of that information could reasonably be expected to be injurious to the enforcement of any law of Canada or to the conduct of lawful investigations. This is a discretionary exemption and government institutions have the evidentiary burden of showing that there is a reasonable expectation of probable harm from the disclosure of the requested information.
46. Sections 6 to 6.4 of the CRA and the Criminal Records Regulations prescribe how personal information concerning record suspensions must be dealt with.
47. Sections 6 and 6.1 outline prohibitions on the disclosure of personal information that relates to record suspensions.
48. Section 6.3 of the CRA creates an exception to the general rule of non disclosure of pardoned records as set out in subsection 6(2) of the CRA. Section 6.3 permits information pertaining to pardoned records for sex-related offences to be made available to people or organizations responsible for the well-being of children, seniors or other vulnerable persons, where an individual is seeking a position of trust or authority in relation to those persons (either on paid or volunteer basis).
49. The CRA is also supported by a number of regulatory, policy and procedural instruments. The purpose of some of these instruments is to reinforce certain provisions of the CRA itself, while others aim at providing an interpretation of certain sections or seek to provide practical guidance to those who have to implement or comply with the CRA. These instruments include:
    • Criminal Records Regulations;
    • Ministerial Directive concerning the Release of Criminal Record Information by the Royal Canadian Mounted Police (the Ministerial Directive for the RCMP); and
    • Dissemination of Criminal Record Information Policy (the CPIC Dissemination Policy). The Dissemination Policy governs the release of criminal record information obtained through the CPIC system.
50. While informative, the instruments described at paragraph 49 above do not apply per se to requests for personal information. Privacy Act requests are in fact governed by the Act and its Regulations. However, it is worth noting that the Ministerial Directive for the RCMP specifies that one of the purposes for which record suspension information may be disclosed is to “[i]ndividuals who are entitled to copies of their own records under the Privacy Act…”.

Analysis

Injury to the enforcement of the CRA

51. The PBC argued in its representations to the OPC that providing an individual with access to record suspension information, or a confirmation that there are no responsive records, would be injurious to the scheme relating to the disclosure of record suspension information set out under the CRA. The PBC essentially argued there is a general conflict between the Act and the CRA, that the CRA should prevail as it is more specifically targeted to the situation, and that the adverse impact on the CRA is also at the level of the general application of both Acts.
52. Our view is that there is a potential conflict only where disclosure pursuant to the Act might violate the proscription in section 6.3 of the CRA against disclosure of a suspended record to a person other than the person who is the subject of that record, except as authorized by the Public Safety Minister under section 6.3 of the CRA. However, as explained below, this conflict can be resolved.
53. To this end, we analyzed three potential scenarios that the PBC could face when presented with requests for access to record suspension information about a particular individual:
    1. The PBC does not find any responsive information based on basic identification information alone (i.e., name and/or date of birth);
    2. The PBC finds a possible match based on basic identification information and can confirm a match with further identification / information (i.e., FPS number, PBC reference number, and/or a copy of the requester’s criminal record); or
    3. The PBC finds a possible match based on basic identification information, but cannot confirm a match without further identification / information (i.e., FPS number, PBC reference number, and/or a copy of the requester’s criminal record).

Scenario a) – The PBC does not find any responsive information based on basic identification information alone (i.e., name and/or date of birth)

54. Having established earlier in this report that a requester can legitimately make a request under the Act in order to receive a confirmation that records do not exist, the first scenario is likely to apply in the majority of the situations that the PBC will encounter.
55. In cases where no record suspension information under the control of the PBC could be found relating to the requester, there would be no injury to the CRA, and as such, it could not be used to justify the application of paragraph 22(1)(b) of the Act. A requester, in accordance with the Act, would be entitled to receive a response to the effect that based on the information provided by the requester, the PBC found no relevant records. This would not violate the CRA as there would be no disclosure of a suspended record of conviction.
56. For clarity, the PBC could add that the response is provided in answer to a request made under the Privacy Act and does not constitute a certified vulnerable sector verification, which requires fingerprints.

Scenario b) – The PBC finds a possible match based on basic identification information and can confirm a match with further identification / information (i.e., FPS number, PBC reference number, and/or a copy of the requester’s criminal record)

57. In cases where record suspension information under the control of the PBC relating to the requestor is found, and a match has been confirmed, the information can be disclosed to the requestor under the Act without violating the CRA. This would be consistent with existing established procedures.

Scenario c) – The PBC finds a possible match based on basic identification information, but cannot confirm a match without further identification / information (i.e., FPS number, PBC reference number, and/or a copy of the requester’s criminal record)

58. Where there is a potential match between a requester and the subject of the suspended record of conviction, but the identity of the requester cannot be confirmed without fingerprints or additional criminal record information, paragraph 22(1)(b) can be relied upon. In such circumstances, there is an evident risk that a disclosure could be to a person other than the subject of the suspended record of conviction, which would be a violation of the CRA unless authorized by the Public Safety Minister.

The company’s screening model

59. In representations to our Office, the PBC noted concerns regarding the company’s screening model. The PBCs position is that this process would result in the disclosure of the existence of a record for which a record suspension had been ordered for all individuals for whom the PBC is unable to say that "no records exists" and would violate the prohibition in the CRA on the disclosure of such information.
60. Our view is that, while the CRA proscribes disclosure of specified personal information to persons other than that individual, the Act provides a right of access to information held or not about a given individual. What an individual decides to do with this information afterwards is within the individual’s control.

Scope of request

61. The PBC submitted that the company’s Privacy Act requests seek to obtain information that extends beyond the scope of a VSV. This would include information on all offences for which a record suspension has been ordered, not just the sexual offences listed in schedule 2 of the CRA.
62. We recognize that the company’s Privacy Act requests seek to obtain a much broader range of information that would be disclosed in a VSV, and that the company could limit the scope of the requests to information that falls within the scope of a VSV. However, in its February 19, 2015 response, the PBC advised that it would only disclose information to the individual to whom the information relates or to the authorized representative, where sufficient proof of consent, as well as the individual’s clear understanding of the implications of this consent, were provided, and not to the company’s third-party police partners. As a result, in cases where the response is sent to the individual requester, it would be up to that individual to decide whether or not to share the information in question.

Consent

63. The PBC further questioned whether the consent of the person to whom the information relates is valid in this context. The PBC is of the view that the consent is neither free nor informed, although it provided no evidence to support its submission. The PBC submitted that individuals may feel that they have to comply with the company’s process as a condition for being further considered for employment. The PBC further argued that individuals are required to waive their privacy rights without having the opportunity to review information that would be disclosed and may not be fully informed of the intended use, retention and disclosure of this information by third parties.
64. As referenced earlier in this report, the PBC stated in its February 19, 2015 response that any disclosure of records would be made to the individual requester or to the authorized representative. Therefore, in cases where the response is sent to the individual requester, it would be the individual’s responsibility to convey this information to the company or its Canadian police partner(s) at their own discretion. In such instances, the consent of the individual would be required both to initiate the request for personal information and again, separately, for the disclosure of their personal information to the company or its Canadian police partner(s).
65. As for the applicants of the record suspension verification process who submitted their own Privacy Act requests directly to the PBC, we note that the company notified them not to proceed with this process if they believed they may have been granted a pardon or record suspension at any time in their life and instead, instructed them to go to their local police and request a VSV. In these cases, it was up to the individual to decide whether to proceed with the record suspension verification process or a VSV.

Human rights violation

66. In its representations, the PBC stated that the disclosure of a record for which a record suspension has been ordered may contradict human rights legislation if the information is being used by a third party to discriminate against the individual requesting such information. The PBC submitted that federal, provincial and territorial law prohibit discrimination based on the provision of information regarding suspended records. We have noted the concerns raised by the PBC; however, we do not agree. Neither the CRA nor human rights legislation prohibits an individual from requesting access to their own information pursuant to the Act. As the PBC notes in its submissions, the CRA and various human rights statutes prohibit a prospective employer from asking questions about convictions for which a record suspension has been granted.

Is the PBC’s requirement that the requester provide a photocopy of a document to authenticate the requester’s identity, along with the applicant’s FPS number, PBC reference number, and/or copy of their criminal record required to adequately identify a requester in the circumstances?

67. Our investigation also examined the PBC’s requirement for additional information in order to process access requests for personal record suspension information under the Act.

Application

68. In arriving at our findings, we considered subsection 8(2) of the Regulations.
69. the Regulations outline the procedures for making a request for access to personal information under section 12 of the Act. Subsection 8(2) of the Regulations provides that an individual who makes a request for personal information “shall provide adequate identification to the government institution before access to the information is provided and may be required to present himself in person.”
70. The Treasury Board Secretariat’s Directive on Privacy Requests and Correction of Personal Information (the Directive) offers some interpretation of the identification requirement set out in section 8 of the Regulations.
71. Under section 6.2.3 of the Directive, heads of government institutions or their delegates are responsible for, among other things, establishing procedures to validate the identity of the requester, the authority of an individual making a request on behalf of another individual, and the requester's Canadian citizenship, status as a permanent resident or presence in Canada.

Analysis

72. The PBC’s latest position is that it is unable to process requests from individuals seeking access to record suspension information without the following information:
    • A photocopy of a document to support the requester’s identity (i.e. valid government issued ID with name, photo, date of birth and signature); and
    • At least one of the following:
      • The requester’s PBC reference number (which is assigned to individual’s when they apply for a pardon/record suspension with the PBC); or
      • The requester’s FPS number; or
      • A copy of the requester’s Criminal Record.
73. The PBC is responding to such requests by saying that it will be unable to process requests from individuals unless they have been convicted of a criminal offence, or applied for a pardon or record suspension.
74. We disagree with the PBC’s position in this regard. The PBC has demonstrated that it can process these requests on the basis of basic identification information alone. The evidence before our Office is that the PBC processed at least 170 requests, and accepted approximately 400 more without any additional identification information. The PBC is imposing a provision of information that in the vast majority of cases requesters will not be able to meet, making it impossible for these individuals to exercise their access rights under the Privacy Act.
75. That said, we fully recognize the important role of the PBC and the necessity for it to protect against any unauthorized disclosures. In instances where there is a potential match between a requester and the subject of the suspended record of conviction, the PBC would be justified to request additional identification information to resolve / confirm the match.
76. Our views are consistent with the CPIC Dissemination Policy, which provides for checks using a name and date-of-birth where a certified vulnerable sector verification is not required.
77. As such, it is our view that the additional information being requested by the PBC to begin processing a request under the Act for any personal information relating to record suspensions goes beyond what is needed.

Conclusions

78. The following outlines the OPC’s final conclusions in relation to the two complaints against the PBC.
79. First, we are of the view that the access provisions of the Act generally entitle a requester to a confirmation that there are no records responsive to his or her particular access request.
80. Second, our view is that a potential injury to the CRA cannot be used to justify the application of paragraph 22(1)(b) of the Act where the disclosure would clearly be to the person who is the subject of the suspended record of conviction.
81. Third, where there is a potential match between a requester and the subject of the suspended record of conviction, but the identity of the requester cannot be confirmed without fingerprints or additional criminal record information, paragraph 22(1)(b) could be relied upon. In such circumstances, there is an evident risk that a disclosure could be to a person other than the subject of the suspended record of conviction, which would be a violation of the CRA unless authorized by the Public Safety Minister.
82. Finally, we are of the view that the additional identification information being requested by the PBC before it begins processing a request under the Act for record suspension information goes beyond what is necessary. However, as referenced in the previous paragraph of this report, in circumstances where a potential match between a requester and the subject of a suspended record of conviction is identified during the processing of a request, it is our view that it would be reasonable at such a point that the PBC seek to confirm the identity of the requester by appropriate means.
83. Accordingly, we find the complaints to be well-founded.

Recommendations

84. In a letter dated September 12, 2016, our Office provided a Report of Findings to the PBC pursuant to section 35 of the Act. This Report contained details of our investigation, the rationale for our conclusions, and our recommendations. The Report also offered the PBC an opportunity to respond to and describe any actions it proposes to take in order to implement our recommendations.
85. Given the findings of our investigation, we made the following recommendations to the PBC:
    1. We recommended that the PBC cease its reliance on section 22(1)(b) of the Act to refuse to process access requests for record suspension information from individuals or from the company on behalf of individuals who use its record suspension verification service except where there is a potential match between a requester and the subject of the suspended record of conviction, but the identity of the requester cannot be confirmed without fingerprints or additional criminal record information; and
    2. We recommended that the PBC limit the amount and type of the information it requests and gathers to what is necessary to adequately identify a requester and that it reprocess the access requests for record suspension information from applicants of the record suspension verification process who submitted their own Privacy Act requests directly to the PBC.
86. In its response to our Office dated December 7, 2016, the PBC advised that its position remained the same as outlined in its June 23, 2016 submission, and as a result, did not accept our recommendations in their entirety. The PBC advised that it would continue to process privacy requests received directly from the applicants, as was done prior to the complaints being filed, and that applicants would be required to provide a photocopy of a document to authenticate their identity, along with their FPS number, PBC reference number, and/or copy of their criminal record. The PBC further advised that applicants who are unable or unwilling to provide this information would have their requests deemed abandoned.