Language selection

OPC Logo Office of the Privacy Commissioner of Canada

Search

DND breached the Privacy Act in disclosing the identity of a workplace violence complainant who had an expectation of confidentiality

May 13, 2022

Complaint under the Privacy Act (the “Act”)

Description

An individual who had made a workplace violence (“WPV”) complaint was troubled upon hearing that their employer, DND, had disclosed their identity and the investigation report concerning their complaint to an investigator tasked with conducting a separate administrative investigation into the individual’s conduct. The allegations about the individual’s conduct arose during the initial WPV investigation. DND has an obligation to address allegations of misconduct. DND argued that the disclosure was necessary for addressing the allegations raised against the individual and that it was permissible under paragraph 8(2)(a) of the Privacy Act. However, our investigation found that a consent form DND provided to the complainant gave a clear impression of a broad commitment to maintain confidentiality of a complainant’s identity except for specific disclosures for the purpose of investigating and resolving the complainant's WPV allegations. Therefore, the disclosure for the purpose of the second investigation was not a “consistent use” under paragraph 8(2)(a), as it was not so directly connected to the original purpose that an individual would reasonably expect it.

Takeaways

  • The test for “consistent use” is that there is a sufficiently direct connection between the original purpose of collection and the proposed use such that an individual would reasonably expect that the information could be used in the manner proposed.
  • It is possible for a disclosure to be helpful, or even critical, for a legitimate government purpose and not meet the test of being a “consistent use” under paragraph 8(2)(a) of the Privacy Act. This may occur where confidentiality restrictions either expressly or implicitly affect an individual’s reasonable expectations.
  • It is therefore important to ensure that (i) explanations of confidentiality restrictions included in policies and communications to individuals take into consideration potential disclosures that could be needed, and (ii) that staff follow such restrictions.
  • This clarity is a key component of protecting the integrity of processes, such as workplace violence investigations, that are necessary to address serious issues such as workplace safety.

Report of findings

Overview

  1. The complainant alleges that the Department of National Defence (“DND”) breached a written commitment it made to keep his identity confidential in connection with a workplace violence (“WPV”) complaint he made. Specifically, he alleges DND shared copies of the resulting workplace violence investigation report (the “report”), including his identity as the WPV complainant, with individuals not listed on a related “consent form to disclose identity” (the “consent form”). In particular, he objected to the sharing of the report with labour relations and a second investigator tasked with conducting a subsequent administrative investigation of allegations against him raised by parties in the course of investigating his own WPV complaint. The complainant indicated the subsequent investigation exonerated him and that no disciplinary measures were ordered against him.
  2. DND does not dispute that internal disclosures of the un-redacted report to individuals not named on the consent form occurred. It submitted that the disclosures were necessary to address the allegations raised against the complainant, that the disclosures were not prohibited by the consent form in question, and that they constituted a “consistent use”.
  3. We examined DND’s compliance with the requirements of the disclosure provisions of Section 8 of the Privacy Act (the “Act”). Paragraph 8(2)(a) permits disclosures without the consent of the individual, where it is for “the purpose for which the information was obtained or for a use consistent with that purpose.” As per jurisprudence, and TBS guidance, “consistent uses” must have a sufficiently direct connection to the original purpose for which the information was originally obtained such that an individual would reasonably expect it to be used in this mannerFootnote 1.
  4. After careful consideration of the facts, we found that the first disclosure of the WPV report to labour relations to be a consistent use. However, we determined that the second disclosure of the WPV report to the investigator was not a consistent use and therefore contravened the Privacy Act.
  5. On January 1, 2021 the Work Place Harassment and Violence Prevention Regulations came into force, replacing the previous “Part XX Violence Prevention in the Work Place” of the Canada Occupational Health and Safety Regulations (“COHSR”)Footnote 2. The regulations now in force include changes to how related personal information must be protected in WPV reports, rendering the consent form in question obsolete. Nonetheless, in our view the underlying issue of a potential disconnect between what an individual is told about how their identity as a WPV complainant may be used or disclosed, and what actually occurs, remains a risk. We therefore recommended corrective action outlined in the report below which DND has committed to implement. On this basis we find the complaint well-founded and conditionally resolved.

Background

  1. Believing he had experienced WPV, the complainant submitted a joint WPV complaint along with a colleague to his employer, DND. At the time, the COHSR, a regulation under the Canada Labour Code, contained the prescribed steps for investigating allegations of WPV that were unresolved.
  2. Pursuant to the COHSR, the relevant DND commanding officer appointed a competent person to investigate the complainant’s and his colleague’s allegations of WPV. Section 20.9(3) of the COHSR stated at the time that the employer shall provide the competent person with any relevant information whose disclosure is not prohibited by law and that would not reveal the identity of persons involved without their consent. DND sought the complainant’s consent for this disclosure via a consent form. The complainant signed the form and consented to disclose his identity to all the parties listed on the form for the purposes of investigating and resolving the complaint.
  3. At the end of the investigation the competent person provided DND with his reportFootnote 3. While the report found some of the complainant’s claims to be well founded, it also suggested that the complainant and others may have contributed to a toxic work environment and that there was a strong basis for addressing the matter under occupational health and safety.
  4. The commanding officer shared a copy of the report with a labour relations officer, who DND indicated was asked to assess these allegations and provide the commanding officer with advice about whether to initiate disciplinary processes. The complainant’s name was not redacted in the report. The labour relations officer in turn shared it with her supervisor and a senior labour relations officer.
  5. The commanding officer subsequently decided to commence a separate administrative investigation into whether the complainant engaged in misconduct based on the findings of the WPV report. A copy of the report, which included the complainant’s identity, was then shared with the investigator assigned to conduct the administrative investigation. The investigator ultimately concluded that there was insufficient evidence that the complainant had engaged in misconduct.
  6. In support of his complaint, the complainant provided records that he believed indicated that the WPV report was also shared with a TBS employee. DND denied this and our investigation found no evidence to suggest the report was shared outside DND.

Analysis

  1. As noted above, paragraph 8(2)(a) of the Act permits an institution to disclose personal information, without consent, for “the purpose for which the information was obtained or for a use consistent with that purpose.” For a disclosure to be for a “consistent use” it must have a sufficiently direct connection to the original purpose for which the information was originally obtained such that an individual would reasonably expect it to be used in this mannerFootnote 4.
  2. The complainant contends that DND breached a written commitment it made to keep his identity confidential in connection with his WPV complaint and resulting report when it made the disputed disclosures. In other words, he did not expect them to disclose his identity to parties not listed on the consent form (reproduced in full in Annex A).
  3. The full title of the consent form was “Consent form to disclose identity, Related to an unresolved complaint of Work Place Violence (WPV), Canada Occupational Health and Safety Regulation (COHSR) - Part XX, Canada Labour Code – Part II.” The form goes on to state,

    “In my capacity below as a person involved in an unresolved complaint under Part XX of the COHSR…with the understanding that: it is my choice under subsection 20.9(3) and paragraph 20.9(5)(b) of the COHSR to consent to my identity being disclosed in relation to the above complaint; I am not obligated to give my consent; […] I hereby consent to have my identity disclosed to the following, for the purpose of investigating and resolving the complaint (select all that apply):”

    The form then lists (with an option of “yes or no” for each): complainant, respondent (employee or non-employee alleged aggressor), witnesses, competent person, policy health and safety committee, and workplace health and safety committee or health and safety representative. Labour relations or other internal parties are not listed.
  4. DND does not dispute that it shared the WPV report, including the complainant’s identity, internally as alleged. It confirmed that the report was shared internally with labour relations and the investigator appointed to investigate allegations of misconduct against the complainant arising from the WPV report. DND also did not dispute that those parties were not listed on the consent form.
  5. DND confirmed that the consent form in question was the only written material provided to WPV complainants to explain the handling of personal information in the process. This form indicates that the complainant’s identity will be used “for the purpose of investigating and resolving the complaint.” We accept this as being the original purpose for the collection of the complainant’s identity as a WPV complainant.
  6. DND argued that its disclosures did not breach the consent form, as the restrictions on disclosure in the consent form only applied to the release of the complainant’s identity in relation to (i) the parties on the consent form, and (ii) for the purpose of conducting the WPV investigation and facilitating follow-up by the workplace health and safety committee. It argued that the consent form did not preclude sharing the complainant’s identity as the WPV complainant with other parties not listed on the form for the purpose of addressing allegations raised in the course of the investigation with respect to the complainant’s own conduct.
  7. DND noted that the COHSR in place at the time specifically required institutions to obtain WPV complainants’ consent for disclosures to the bodies listed in the form. The COHSR was silent on permissibility of other disclosures. It argued that: “The internal use and disclosure of such information for the purpose of determining the need for, and nature of, disciplinary action is consistent with the reason the information was first collected.” More specifically it explained that in its view, using the complainant’s personal information to assess the need for, and to initiate measures to, address the results of the WPV investigation was permissible under the Act to allow it to mitigate the risk of violence in the workplace.
  8. We acknowledge that DND has a clear obligation to provide a safe, healthy and violence-free workplace for all its staffFootnote 5 and to address allegations of misconduct.
  9. We also accept, after considering DND’s submissions in response to our draft report, that there is a sufficiently direct connection between the initial collection of the complainant’s personal information and the sharing of the WPV report with DND labour relations officers to seek advice as to whether further actions should have been taken in light of the findings of the report. In light of the important role that labour relations officers play as advisors in relation to workplace issues, including violence in the workplace and interpersonal conflicts, we are of the view that it is reasonable to expect that a WPV report may be shared internally with them in order to seek their advice and that this was a consistent use of the WPV report. We note that the COSHR required the employer to take steps to prevent a recurrence of violence in the workplaceFootnote 6. In our view, this would reasonably entail consulting labour relations officials with respect to the report’s findings.
  10. However, we are not convinced by DND’s submissions that the same can be said about the sharing of the WPV report with the investigator charged with investigating allegations of misconduct against the complainant.
  11. The complainant’s personal information contained in the WPV report was collected for the purpose of investigating his complaint that he was the victim of WPV. However, the WPV report was shared with the investigator for a quite distinct purpose – namely, investigating the complainant’s own conduct. We do not think that a complainant to a WPV process would reasonably expect that a WPV report into their complaint would in turn be used as evidence in separate disciplinary proceedings against them.
  12. This view is supported by the strict confidentiality requirements that existed around the WPV investigation process and the resulting report. In particular, the COHSR required the consent of persons involved for their identity to be shared with the competent person (per s. 20.9(3)) and to have their identity included in the report shared with the workplace committee or health and safety representative (ss.20.9(5)(b)). As the Federal Court of Appeal has noted, the purpose of these restrictions was to “to encourage the persons involved to speak to the employer or to the competent person, secure in the knowledge that if they choose to talk, their identity will not be revealed”Footnote 7.
  13. These restrictions were reflected in the information DND provided to the complainant in the consent form he signed. The complainant represented that he understood the consent form he signed to be a clear commitment to confidentiality of his identity as a WPV complainant overall. We acknowledge that the COHSR and consent form did not expressly state that disclosures of the complainant’s identity to other parties, or for purposes other than addressing his own complaint, would not occur. However, in our view, the wording of these restrictions gave a clear impression of a broader commitment to maintain confidentiality of a WPV complainant’s identity in a WPV report outside of the permitted disclosures.
  14. We also note, according to the investigator’s report, that he did not include the WPV report as evidence in his investigation as a result of the complainant’s objections and that he was able to complete his investigation without relying on it. While not determinative, this also suggests that the WPV report was not essential to the investigator’s work such that it was reasonable to expect that he would have access to it.
  15. We are therefore of the view there was not a sufficiently direct connection between the purpose for which the complainant’s personal information was collected, that is, to investigate his WPV allegations, and its subsequent sharing with the investigator for use in disciplinary proceedings against the complainant. We therefore find the disclosure was not for a consistent use and was accordingly not permitted by section 8(2)(a).

Recommendations

  1. As noted above, effective January 1, 2021 the Work Place Harassment and Violence Prevention Regulations (“WPHVPR”) came into effect, replacing the previous Part XX Violence Prevention in the Work Place in the COHS regulations. The regulations now require that any report at the conclusion of WPV investigation not reveal, directly or indirectly, the identity of persons who are involved in an occurrence. Nonetheless, in our view the underlying issue of a potential disconnect between what an individual is told about how their identity as a WPV complainant may be used or disclosed, and what actually occurs remains a risk. This is a particular concern given the sensitivity of the personal information involved in the context of a WPV process. We therefore recommended that:
    1. DND ensure that going forward, any disclosures of personal information made as a “consistent use” in the context of a WPV process do not fall outside of a participant’s reasonable expectations of the process, based on information provided to participants by DND; and
    2. within nine months, DND review and make modifications to any products or tools used by staff, or provided to participants, in a WPV process, to ensure recommendation a) is implemented consistently.
  2. DND accepted our recommendations and committed to submit products and tools to the OPC for review prior to finalization, within nine months of the issuance of this report. In this context, we consider the complaint to be well-founded and conditionally resolved.
  3. We also encouraged DND to comply with sub-section 6.2.9 of the TBS Directive on Privacy Practices, which requires that individuals whose personal information is collected directly be notified, at the time of collection, of “any uses or disclosures that are consistent with the original purpose.” In the case of notices for participants in WPV complaint processes, this should include informing participants of how the results of the process may be used, as well as how and when their identity may be disclosed.
  4. In addition, while not examined in this investigation, we reminded DND of the obligation, under paragraph 11(1)(a)(iv)Footnote 8 of the Act, to include, in respect of each Personal Information Bank (“PIB”), statement of consistent uses. Further, we remind DND of the related obligations under sub-section 9(4)Footnote 9, to notify the OPC in instances where a use or disclosure is made for a consistent use that is not listed in the PIB, and to add it to the statement of consistent uses in the next iteration of the PIB.
  5. DND also committed to adding any consistent uses that may arise in the context of a WPHVPR process to the statement of consistent uses in the next iteration of the relevant PIB.

Annex A

Consent form to disclose identity

Related to an unresolved complaint of Work Place Violence (WPV)

Canada Occupational Health and Safety Regulation (COHSR) - Part XX

Canada Labour Code – Part II

In my capacity below as a person involved in an unresolved complaint under Part XX of the COHSR (select one),

Complainant

Respondent (Employee or non-employee alleged aggressor)

Witness

with the understanding that:

  • it is my choice under subsection 20.9(3) and paragraph 20.9(5)(b) of the COHSR, to consent to my identity being disclosed in relation to the above complaint;
  • I am not obligated to give consent; and,
  • withholding my consent does not
    • relieve the employer from any of their obligations under Part XX of the COSHR,
    • relieve me of any obligations I may have as an employee under paragraph 126.(1)(e) of Part II of the Canada Labour Code to cooperate with any person carrying out a duty imposed by the Code, and,
    • guarantee that my identity may not become known to one or more of the following.

I hereby consent to have my identity disclosed to the following, for the purpose of investigating and resolving the complaint (select all that apply):

Complainant

Yes

No

Respondent (Employee or non-employee alleged aggressor)

Yes

No

Witnesses

Yes

No

Competent person

Yes

No

Policy Health and Safety Committee

Yes

No

Workplace Health and Safety Committee or Health and Safety representative

Yes

No

Signature

Date

Name

Date modified: