Employer’s disclosure related to a transgender individual was contrary to the Privacy Act

November 17, 2020

---

Complaint under the Privacy Act (the “Act”)

Description

A government institution contravened the Act when it shared personal information about an employee’s transgender identity with her new manager and colleagues without her consent.

Case Summary

We investigated a complaint against a federal institution by an employee who alleged that her privacy was breached when the institution shared the fact that she is transgender with her supervisor and colleagues despite an explicit expectation of confidentiality.

The disclosure in question relates to a request by the complainant to transfer to another position because she had experienced workplace harassment and discrimination relating to her gender identity.

She asked that the reasons for her transfer not be shared with her new supervisors or coworkers, and her employer assured her that the matter would be dealt with in a discrete and confidential manner, given the sensitive nature of her case.

Nevertheless, when she started in her new position, it was clear to the complainant that her new supervisor and several of her new co-workers were aware she was transgender and knew of the reasons for her transfer.

The institution conducted an internal review of the matter and determined that some of the managers involved in effecting the complainant’s transfer disclosed the reasons for it to several staff members because they thought it necessary  to support her and her new supervisor. The internal review ultimately found that this was done in error, and was not handled in accordance with the institution’s internal policies.

We found that these actions clearly contradicted the explicit expectation of confidentiality assured by the institution.  The institution did not argue that the disclosure was permissible under any exceptions to disclosure under subsection 8(2) of the Act.

Accordingly, we found the complainant’s personal information had been disclosed without consent contrary to section 8(1) of the Act.

In response to this clear privacy breach, the institution stated that it recognized the need for better adherence to policies and procedures, as well as further transgender awareness education. We recommended that the institution act quickly to update its policies and procedures with the goal of preventing a similar future occurrence. The institution responded by creating a new guidance document to support its transgender employees and making it available to staff to better understand their roles and the privacy and confidentiality of transgender employees.

Accordingly, the complaint was well-founded and resolved.