BACKGROUND
PAPER TO NEWS RELEASE OF APRIL 3, 2003:
Recommendations
made by the Ombudsman in 2001
In 2001, the Ombudsman
made recommendations concerning four files that were opened in 2000.
Three files were under The Freedom of Information and Protection
of Privacy Act (FIPPA) and one was under The Personal Health
Information Act (PHIA). Two cases pertained to access requests
and two concerned alleged breaches of privacy. There was an additional
PHIA file, opened in 2001, where recommendations were made in 2001;
however, that file was closed in 2002 and will be addressed in the
2002 Annual Report.
Manitoba Conservation [Cases 2000-056 and 2000-057]
There were two
related complaints under FIPPA alleging a breach of privacy with respect
to collection, use and disclosure of personal information.
The complainants
had written letters to the Minister to express concerns on a matter.
They alleged that a breach of their privacy resulted from their letters,
containing their personal information, being used by various employees
within the Department and being disclosed to third parties.
We found that
the Department provided minimal notice concerning the purpose for
collecting the personal information contained in the complaint letters,
as the complainants were not informed how the information would be
used or that it would be disclosed. It was determined that the Department
was authorized to use the personal information within the Department.
Nevertheless, the Department had not considered whether it was necessary
for the employees to use all of the information in the letters. Compliance
with the Act requires that only the minimum amount of personal information
be used to accomplish the purpose. We concluded that the Department
was not authorized to disclose the letters to third parties.
Accordingly, we
recommended that the Department (1) develop procedures for conducting
internal reviews of complaints from the public ensuring that these
are compliant with the notice, use and disclosure provisions of FIPPA,
(2) notify the third parties to whom the information was disclosed
that the disclosures were made in error and take reasonable measures
to ensure that no copies of the complaint letters were retained by
the third parties, and (3) send a letter of apology to the complainants
for the breach of privacy resulting from the disclosure of their personal
information contained in their letters.
The Department
advised our Office that it intended to comply with all requirements
of the Act relating to collection, use and disclosure.
Manitoba Hydro [Case 2000-103]
This complaint
concerned a refusal of access under FIPPA.
The applicant
made an application for access to records and requested that any fees
for access be waived. Access was granted to some information with
the majority of records being withheld.
We determined
that the public body had not substantively reviewed the records to
which it denied access and had not responded to the request for a
fee waiver. Recommendations were made for the public body to provide
the applicant with (1) a response to the access request that complies
with FIPPA and is based on substantive review of the responsive records,
(2) a fee estimate, and (3) a decision on the applicant’s request
for a fee waiver.
The public body
indicated that it accepted the recommendations. Issues arising from
this case are the subjects of files still under investigation by our
Office.
Physician [Case 2000-110]
This complaint
related to a refusal of access to part of the records requested under
PHIA.
An individual
who had requested access to her complete medical file from a physician
was granted access to part of the file in question. The physician
had apparently withheld six to ten pages of records. Subsequently,
the physician destroyed boxes of files, including the remaining six
to ten pages coming under the individual’s access request.
As a result, we
reviewed issues relating to the legislative requirements to have a
written security policy and procedures for the retention and destruction
of records. Three recommendations were made relating to sound recordkeeping
practices to ensure compliance with the legislation.
The physician
indicated his acceptance of the recommendations.
