Privacy Act restrictions on use and disclosure do not apply to publicly available personal information

Complaint under the Privacy Act (the Act)

July 14, 2020

Description

The Canadian Border Service Agency (CBSA) sent a carbon copy of a letter to the complainant’s bondsperson. The letter included representations that the complainant had made about changes in his health status during his time in CBSA detention.  However, as part of his litigation with CBSA, the complainant had included the same medical information in court documents. As a result, under subsection 69(2) of the Privacy Act, the information was publicly available, and therefore section 8 of the Privacy Act was inapplicable.

Report of Findings

Overview

1. The complainant alleged that the respondent, the Canada Border Services Agency (CBSA), contravened the disclosure provisions of the Privacy Act (the Act) when a CBSA employee disclosed the complainant’s personal information in contravention of the Act.
2. Specifically, the alleged contravention was the disclosure of the complainant’s personal medical information to a third party individual. The third party individual was carbon copied by the CBSA on a letter which contained the complainant’s personal information. At the time, the third party individual was the complainant’s bondsperson.
3. The CBSA that the disclosed information was publicly available. The CBSA subsequently submitted that the disclosure of the personal information to the bondsperson was authorized under its operational bulletin on enforcement.
4. Following our review we accept that the information disclosed to the third party was publicly available in Court records and that therefore, as per section 69(2) of the Act, section 8 is inapplicable. As a result, we find the complaint to be not well-founded.

Relevant Facts

5. The complainant’s involvement with the CBSA commenced when he arrived in Canada in 2007. The context of the complainant’s interactions with the CBSA are related to his applications for refugee status or permanent residency status in Canada.
6. Between 2007 and his eventual deportation in 2015, the complainant exhausted available avenues to contest or appeal the decisions of the Immigration and Refugee Board of Canada (IRB) and the CBSA to deny his applications.
7. As a part of this process, the complainant was a party to a number of actions in the Federal Court. All of the Court files associated with these actions remain open to the public in accordance with the “open court” principle. In the Federal Court files, the complainant made specific representations about changes to his health while in the custody of the CBSA.
8. Despite his deportation earlier in 2015 the complainant returned to Canada later in the year at which time he was apprehended and a new deportation order was issued. The complainant was released from custody in early 2016 with conditions, including that a bond must be paid and that he must reside with the bondsperson.
9. By early 2019, the complainant sought to amend the conditions of his bondsperson. As a consequence of this request, the CBSA sent a letter to the IRB which was carbon copied to the complainant and to his bondsperson. Among other details, the letter included the specifics of the changes to the complainant’s health during his time in CBSA detention.

Issues

10. The issues are as follows:
11. Did the CBSA disclose the complainant’s personal information?
12. Was any disclosed information “publicly available”, such that subsection 69(2) of the Act excludes application of sections 7 and 8?
13. If not, was the disclosure permitted under subsection 8(2) of the Act?

Analysis

14. Section 3 of the Act defines personal information as information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing: information relating to race, national or ethnic origin, colour, religion, age, marital status, education, medical, criminal or employment history, financial transactions, identifying numbers, fingerprints, blood type, personal opinions, etc.
15. The CBSA letter includes information related to the medical history of the complainant, and is therefore “personal information” as defined in the Act. This information was disclosed to a third party individual when the CBSA carbon copied the letter to the bondsperson.
16. We therefore conclude that there was a disclosure of the complainant’s personal information.
17. As noted above, the CBSA submits that the personal information disclosed to the third party individual is publicly available. Subsection 69(2) of the Act provides that the restrictions set out in section 8 of the Act does not apply to personal information that is publicly available.
18. The meaning of the term “publicly available” is explored in the 2015 decision of Lukacs v. Canada (Transport, Infrastructure and Communities)^{Footnote 1}. At paragraph 69, the Court interprets this term to mean “available to or accessible by the citizenry at large”.
19. Our review confirmed that the complainant, during the course of his litigation in the Federal Court, included his personal medical information in Court documents. These documents form part of the public record and are accessible to all members of the public.
20. The letter sent by the CBSA, that carbon copied the complainant’s bondsperson, contained the same medical information that was contained in the public Court documents.
21. Ergo, under the authority of the Lukacs decision^{Footnote 2}, it is our view that the complainant’s personal information that was disclosed in the 2019 letter was publicly available. It necessarily follows that section 8 of the Act does not apply pursuant to subsection 69(2) of the Act.

Findings

22. Accordingly, the complaint is not well-founded. The complainant’s personal information was publicly available and therefore the restrictions on disclosure set out in section 8 of the Act does not apply.

Other

23. But for the complainant’s decision to include his personal information in Federal Court records, the decision taken by the CBSA to carbon copy the third party individual on the letter containing the same personal information would have constituted a breach of the Act.
24. the Act states that personal information can only be disclosed with an individual's consent – subsection 8(1) – or in accordance with one of the categories of permitted disclosures outlined in subsection 8(2) of the Act.
25. According to the complainant, he did not explicitly consent to the CBSA sharing his personal information. In its representations, the CBSA does not claim that there was implicit consent to the disclosure of the complainant’s personal information, but submitted that the disclosure was a permitted disclosure.
26. Specifically, the CBSA submitted that the disclosure was authorized under its operational bulletin on enforcement, ENF 8. Under section 8.3, which reads in part: “When a person concerned’s conditions of release from detention have been modified and there is an existing deposit or guarantee, the bondsperson must be notified and agree to the modifications in order for them to continue to be legally bound by the deposit or guarantee”.
27. Following our review, we are not persuaded that the operational bulletin would authorize the disclosure of the complainant’s personal information as contemplated in subsection 8(2) of the Act.
28. While carbon copying the bondsperson on the letter served to notify them of the sought-after modifications to the conditions, in our view notice could have been provided by a separate letter without the medical information at issue which would have allowed the CBSA to meet its obligations while respecting the complainant’s privacy rights.
29. To this end, we are not satisfied that the disclosure would have been permitted under section 8 of the Act, if it had applied. It is solely through the operation of subsection 69(2) of the Act that the complaint is not well-founded.
30. We take this opportunity to remind the CBSA of their obligation to protect the privacy of the public they serve. The privacy rights of individuals are not subject to expedient communications. We encourage the CBSA to exercise restraint in the use and disclosure of personal information even where the personal information is publicly available.
31. But for the complainant’s inclusion of his personal information in publicly available court files, the CBSA would have breached its obligations under the Act.