Disclosure of military officer’s personal information for litigation purposes permissible under the Privacy Act

Complaints under the Privacy Act (the “Act”)

December 30, 2019

Description

The Department of National Defence (DND) disclosed personal information, including health information, to the Attorney General (Department of Justice), for the purpose of defending against litigation against the Government of Canada initiated by the complainant. We issued two separate reports of finding where we found that the disclosure by DND and the collection by the Department of Justice were permissible under the Privacy Act in that: (i) it was for the purpose of defending the Government of Canada against the complainant’s legal claim, (ii) it appeared directly related to the complainant’s legal claim and (iii) it was made to the Attorney General (Department of Justice). Both reports of findings are included below.

Reports of Findings

Complaint under the Privacy Act (the “Act”)

1. The complainant alleged that the respondent, the Department of Justice (“DOJ”), inappropriately collected his personal medical information from the Department of National Defence (“DND”) for the purpose of defending against litigation launched by the complainant against the DND.

Issues

2. Was the collection of the complainant’s personal medical information by the DOJ from the DND a contravention of the Act?

Methodology

3. Both the complainant (via his legal counsel) and respondent provided written representations in this matter.

Summary of Investigation

4. The complainant is a member of the Canadian Armed Forces (“CAF”). In May 2017, he issued a Statement of Claim in the Ontario Superior Court against the DND for defamation and Military Police negligence. The Statement of Claim named the Attorney General of Canada as the respondent.^{Footnote 1}
5. According to the DOJ, in preparing to defend against the complainant’s allegations, DOJ legal counsel issued a document collection and preservation letter to various federal government departments and organizations, including the DND, requiring them to collect and produce all documents that may be relevant to the complainant’s lawsuit. The document and collection order specified, among other things, that the complainant’s physical and mental health files should be provided.
6. The DND disclosed the requested information, including the complainant’s physical and mental health files, to the DOJ in June 2017.
7. The DOJ submitted that the collection of the complainant’s personal medical information from the DND was consistent with, and indeed required by, the Ontario Rules of Civil Procedure. Rule 30 of the Rules of Civil Procedure (“Rules”) defines the scope of the documentary discovery in a civil action and imposes an ongoing obligation on a party to produce all relevant information.^{Footnote 2} Failure to disclose or produce a relevant document may result in significant consequences to the party in violation of the Rules.^{Footnote 3}
8. The DOJ is of the view that the status of the complainant’s physical and mental health is relevant to his civil claim because he is seeking damages in relation to losses that he alleges are medically-related.
9. With respect to compliance with the Act, the DOJ submitted that:
   • The Surgeon General disclosed the information at issue as the head of the Canadian Forces Health Services (CFHS), a unit of DND, pursuant to paragraph 8(2)(d) of the Act.
   • The Privacy Commissioner has found that the wording of paragraph 8(2)(d) “allows for very broad interpretation” and has determined that as long as the two criteria found in the Act – that the disclosure is to the Attorney General of Canada and that it is for use in a legal proceedings involving either the Crown in right of Canada of the Government of Canada – are met, the government institution is authorized to disclose personal information without consent.
   • The Federal Court has upheld this finding in Sauvé v. Canada (Attorney General), 2016 FC 401.
   • There is no general requirement under paragraph 8(2)(d) to provide notice to the affected individual and, in the absence of a requirement to seek consent, there is no requirement to notify an individual of an impending disclosure in any of the various exceptions enumerated in subsection 8(2) of the Act. In Sauvé v. Canada (Attorney General), the Federal Court has upheld this finding as reasonable.
10. Overall, the DOJ takes the position that the disclosure of the complainant’s personal medical information was consistent with the requirements of the Act, as it was provided by a federal government department to the Attorney General of Canada for use in a legal proceeding involving the Crown in right of Canada. The DOJ argues that the Act is not intended to restrict a federal institution’s ability to communicate personal information with its legal counsel in order to determine whether it must ultimately produce such information as being relevant to a civil proceeding.
11. With respect to the safeguarding of the complainant’s personal medical information, the DOJ advised that any personal information disclosed to the Attorney General of Canada for use in litigation is kept in a secure database. Access to this database is restricted to a finite group of individuals on a need-to-know basis. Furthermore, the “deemed undertaking” pursuant to the Rules, ensures that the disclosed information is only used in relation to the proceeding in respect of which it was originally produced, and for no unrelated or improper purpose.^{Footnote 4} Finally, once the Attorney General of Canada completes its review of the documentation produced in respect of the complainant’s action, it will provide all relevant information to him and his counsel and may return any non-relevant information to DND.
12. The complainant is of the view that while it is expected that the DND would disclose certain information to the DOJ for the defense of his claim against the Attorney General of Canada, such a broad request for medical, mental health, and other health records is overbroad, overly intrusive, and a contravention of the Act.
13. More specifically, counsel for the complainant made the following written representations about the disclosure of the complainant’s personal medical information:

    Doctor-Patient confidentiality is the only standard in Canada. The fact that this was completely disregarded in this case is disturbing and demonstrates a reckless approach by the Attorney General and the Canadian Armed Forces to due process and [the complainant’s] privacy rights.

    Members of the Canadian Armed Forces should be afforded the same basic rights of every Canadian citizen, and litigation does not cause a waiver of these rights. As this case clearly demonstrates, not only were [the complainant’s] rights disregarded during this process, but so were [his physician’s] who was compelled to disclose medical records under implied threat of disciplinary action (failure to follow orders).

Application

14. In making our determination, we considered sections 3, 4, and 5 of the Act.
15. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
16. The information at issue is clearly the complainant’s personal information, since it includes information related to both his medical and employment history.
17. Section 4 of the Act provides that personal information collected by a government institution must relate directly to an operating program or activity of the institution.
18. Section 5 states that personal information shall be collected directly from the individual about whom it relates, unless the individual authorizes otherwise. It also permits collection by other methods in cases where direct collection would result in inaccurate information or defeat the purpose for which the information is collected.

Analysis

19. The Attorney General of Canada, who is also the Minister of Justice and head of the DOJ, is responsible for the regulation and conduct of all litigation against the Crown or any department, in respect of any subject within the authority or jurisdiction of Canada. As such, we find the collection of the complainant’s personal information by the DOJ for the purposes of defending against litigation launched against the Attorney General of Canada to be consistent with section 4 of the Act in that it relates directly to an operating program of the institution.
20. Subsection 5(1) of the Act states that a government institution shall, wherever possible, collect personal information that is intended to be used for an administrative purpose directly from the individual to whom it relates except where the individual authorizes otherwise or where personal information may be disclosed to the institution under subsection 8(2).
21. Implicit in the DOJ’s representations is that its collection of the complainant’s personal information was consistent with subsection 5(1) because the DND properly disclosed it under paragraph 8(2)(d) of the Act.
22. As noted by the DOJ, the Privacy Commissioner previously found that the wording of paragraph 8(2)(d) of the Act allows for very broad interpretation. In our view, a government institution’s role under paragraph 8(2)(d) is to ensure that the objective criteria outlined in that paragraph are met before disclosing personal information without consent. Those criteria are: A) the disclosure must be to the Attorney General of Canada; and B) the disclosure must be for the use in legal proceedings involving either the Crown in right of Canada or the Government of Canada. Once these two conditions are met, the government institution is authorized to disclose personal information without consent.
23. In this case, the complainant filed a civil claim against the DND in the Ontario Superior Court. The Statement of Claim named the Attorney General of Canada as the respondent. The Minister of Justice and Attorney General of Canada is the head of the DOJ. Therefore, the disclosure of the complainant’s personal information to the DOJ meets the first condition set out in paragraph 8(2)(d).
24. Having named the Attorney General of Canada in his statement of claim, the disclosure of the complainant’s personal information by the DND to the DOJ was for the use in legal proceedings involving the Government of Canada (i.e., defending against the complainant’s claim) and appears to have been directly relevant to the complainant’s legal claim. Therefore, the disclosure of the complainant’s personal information also meets the second condition set out in paragraph 8(2)(d).
25. Understandably, the complainant is concerned with the fact that information relating to his physical and mental health is particularly sensitive personal information. We agree that the information at issue in this matter is particularly sensitive personal information. However, the Act makes no distinction between different types of personal information or the sensitivity of those types of information. Therefore, our analysis with respect to compliance with the Act is based strictly on the wording found in the relevant provision.
26. As noted by the DOJ in its written representations, the Privacy Commissioner’s interpretation that such disclosures are consistent with paragraph 8(2)(d) where the two conditions described above have been met was upheld by the Federal Court of Canada in Sauvé v. Canada (Attorney General) (see particularly paragraphs 126-128 of that decision).
27. With respect to safeguarding the complainant’s personal information, the DOJ submitted that it is kept in a restricted and secure database and is also subject to the deemed undertaking rule, thus preventing its use for any other purpose. We are of the view that these are adequate measures to ensure the integrity of the personal information at issue.

Findings

28. Based on the foregoing, we consider this complaint to be not well-founded.

---

Complaint under the Privacy Act (the “Act”)

1. The complainant alleged that the respondent, the Department of National Defence (“DND”), inappropriately disclosed his personal medical information to the Department of Justice (“DOJ”) for the purpose of defending against litigation launched by the complainant against the DND.

Issues

2. Was the disclosure of the complainant’s personal medical information by the DND to the DOJ a contravention of the Act?

Methodology

3. Both the complainant (via his legal counsel) and respondent provided written representations in this matter.

Summary of Investigation

4. The complainant is a member of the Canadian Armed Forces (“CAF”). In May 2017, he issued a Statement of Claim in the Ontario Superior Court against the DND for defamation and Military Police negligence. The Statement of Claim named the Attorney General of Canada as the respondent.^{Footnote 5}
5. In written representations, counsel for the complainant explained that in June 2017, the complainant was notified by his military physician that he had received an email ordering the collection and preservation of records relating to the complainant, a copy of which he shared with the complainant. The email stated:

   The enclosed order for the Collection and Preservation of Documents directs all DND/CAF members to search for, collect and preserve all documents relevant to the enclosed civil litigation [the complainant] v. Canada (Attorney General). Because we have missed the original deadline of 16 June 2017, I ask that you please action as soon as possible but not later than 7 July 2017. Please complete the following actions, which will meet our legal obligations in accordance with this order:

   1. Conduct a search for all documents related to the matters in issue in the legal action, to include (but not limited to):
      • Personnel file and career administration files of [the complainant];
      • Physical and mental health files of [the complainant];
      • Grievance files by or against [the complainant]; professional standards complaints files involving [the complainant];
      • Military Police and [Canadian Forces National Investigative Services] investigation files; all documents and reports; video and/or transcripts and statements of witness interviews; copies of charges; any information in relation to the preliminary inquiry held on 2 August 2016 and decision to drop all charges made on 4 November 2016;
      • Public statements, news releases and internal communications regarding [the complainant]; and
      • Policies, guidelines, and handbooks relating to the matters an issue.

6. The complainant advised his military physician that he strongly objected to the disclosure of his personal medical information. The physician responded that since he did not own the records in question – they belong to the Surgeon General^{Footnote 6} – he had no choice but to comply with the collection and preservation order.
7. During the course of our investigation, the DND provided us with a copy of the order for the Collection and Preservation of Documents, dated 17 May 2017, which originated from the Office of the DND/CAF Legal Advisor.^{Footnote 7} The order states that “DND employees and CAF members who have documents that may be relevant to the action must search for, collect, and preserve all of these documents.”
8. In response to the complainant’s allegation, the DND provided the following representations:
   • In his Statement of Claim, the complainant sought damages in relation to an allegedly negligent investigation conducted by the Canadian Forces National Investigation Service for “pain and suffering, stress, anxiety and health effects including mental distress to him because of the said negligent investigation and defamation.”
   • Rule 30 of Ontario’s Rules of Civil Procedure (“Rules”) defines the scope of documentary discovery in a civil action and imposes an ongoing obligation on a party to produce all relevant information.^{Footnote 8} Failure to disclose or produce a relevant document may result in significant consequences to the party in violation of the Rules.^{Footnote 9}
   • Information relating to the complainant’s physical and mental health was determined relevant to his claim because he is seeking damages in relation to losses that he alleges are medically-related. As a result, the Crown was obliged to undertake the collection and preservation of all relevant documents in possession of the federal government.
   • Personal information regarding the physical and mental health of the complainant were disclosed as instructed by the preservation order/litigation hold dated May 17, 2017. The documents were provided as a legal obligation to the DOJ litigation counsel.
   • Any personal information disclosed to the Attorney General of Canada for use in litigation is kept in a secure database. Access to this database is restricted to a finite group of individuals on a need-to-know basis. Further, the “deemed undertaking” pursuant to the Rules, ensures that disclosed information is only used in relation to the proceeding in respect of which it was originally produced, and for no unrelated or improper purpose.
   • Once the Attorney General of Canada completes its review of the documentation produced in respect of the complainant’s action, it will provide all relevant information to him and his counsel and may return any non-relevant information to the DND.
   • The disclosure was in accordance with paragraph 8(2)(d) of the Act which allows for personal information to be disclosed without consent to the Attorney General of Canada for use in legal proceedings and to meet its legal obligations regarding document disclosure.
9. The complainant is of the view that while it is expected that the DND would disclose certain information to the DOJ for the defence of his claim against the Attorney General of Canada, such a broad request for medical, mental health, and other health records is overbroad, overly intrusive, and a contravention of the Act.
10. More specifically, counsel for the complainant made the following written representations about the disclosure of the complainant’s personal medical information:

    Doctor-Patient confidentiality is the only standard in Canada. The fact that this was completely disregarded in this case is disturbing and demonstrates a reckless approach by the Attorney General and the Canadian Armed Forces to due process and [the complainant’s] privacy rights.

    Members of the Canadian Armed Forces should be afforded the same basic rights of every Canadian citizen, and litigation does not cause a waiver of these rights. As this case clearly demonstrates, not only were [the complainant’s] rights disregarded during this process, but so were [his physician’s] who was compelled to disclose medical records under implied threat of disciplinary action (failure to follow orders).

Application

11. In making our determination, we considered sections 3 and 8 of the Act.
12. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
13. The information at issue is clearly the complainant’s personal information, since it includes information related to both his medical and employment history.
14. The Act states that personal information can only be disclosed with an individual’s consent – subsection 8(1) – or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.
15. The DND takes the position that the disclosure of the complainant’s personal information to the DOJ for the purposes of defending against litigation was consistent with paragraph 8(2)(d) of the Act, which allows to the disclosure without consent of the individual to whom the information relates.

Analysis

16. The wording of paragraph 8(2)(d) of the Act allows for very broad interpretation. In our view, a government institution’s role under paragraph 8(2)(d) is to ensure that the objective criteria outlined in that paragraph are met before disclosing personal information without consent. Those criteria are: A) the disclosure must be to the Attorney General of Canada; and B) the disclosure must be for the use in legal proceedings involving either the Crown in right of Canada or the Government of Canada. Once these two conditions are met, the government institution is authorized to disclose personal information without consent.
17. In this case, the complainant filed a civil claim against the DND in the Ontario Superior Court. The Statement of Claim named the Attorney General of Canada as the respondent. The Attorney General of Canada is also the Minister of Justice and head of the DOJ. Therefore, the disclosure of the complainant’s personal information to the DOJ meets the first condition set out in paragraph 8(2)(d).
18. Having named the Attorney General of Canada in his statement of claim, the disclosure of the complainant’s personal information was for the use in legal proceedings involving the Government of Canada (i.e., defending against the complainant’s claim) and appears to have been directly relevant to the complainant’s legal claim. Therefore, the disclosure of the complainant’s personal information to the DOJ also meets the second condition set out in paragraph 8(2)(d).
19. Understandably, the complainant is concerned with the fact that information relating to his physical and mental health is particularly sensitive personal information. We agree with that the information at issue in this matter is particularly sensitive personal information. However, the Act makes no distinction between different types of personal information or the sensitivity of those types of information. Therefore, our analysis with respect to compliance with the Act is based strictly on the wording found in the relevant provision.
20. With respect to the issue raised by the complainant’s counsel regarding doctor-patient confidentiality, it should be noted that Canadian law does not recognize a general privilege over the relationship between doctors and their patients, notwithstanding the fact that the relationship is subject to confidentiality. Instead, the existence of such a privilege must be established on a case-by-case basis.^{Footnote 10},^{Footnote 11}
21. We note that our Office has dealt with similar matters in the past relating to the disclosure of personal medical information by government departments for the purposes of defending against litigation and that our interpretation that such disclosures are consistent with paragraph 8(2)(d) where the two conditions described above have been met was upheld by the Federal Court of Canada in Sauvé v. Canada (Attorney General), 2016 FC 401 (see particularly paragraphs 126-128 of that decision).
22. Although DND did not reference paragraph 8(2)(c) of the Act in its representations, we are of the view that the disclosure of the complainant’s personal information to the DOJ was also consistent with this provision, which states:

    8(2) Subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed

    3. for the purpose of complying with a subpoena or warrant issued or order made by a court, person or body with jurisdiction to compel the production of information or for the purpose of complying with rules of court relating to the production of information [emphasis added].

23. With respect to safeguarding the complainant’s personal information, we also note that the information in question was disclosed to the DOJ, which has the same obligations as the DND to use, disclosure, retain, and dispose of the complainant’s personal information in a manner consistent with the Act. With respect to the security of the complainant’s personal information, the DND submitted that the DOJ has advised that the information is kept in a restricted and secure database and is also subject to the deemed undertaking rule, thus preventing its use for any other purpose. We are of the view that these are adequate measures to ensure the integrity of the personal information at issue.

Findings

24. Based on the foregoing, we consider this complaint to be not well-founded.