Investigation Report: FIPPA & PHIA Collection of Personal and Personal Health Information – Manitoba Conservation and Climate

2023-06-23

Summary

Report with Recommendations & Response to Recommendations 

Provisions under FIPPA: 2, 36(1), 36(2), 37(2), 49. Provisions under PHIA: 2, 13(1), 13(2), 28. 

Our office received complaints from the public about Conservation and Climate’s collection of personal and/or personal health information through its online elicensing system for the sale of various wildlife, fisheries and other outdoor licences and permits. Our office notified the department that we initiated an investigation to determine if the collection of personal and/or personal health information by the elicensing system is compliant with FIPPA and PHIA. The elicensing system is structured as a two-step process: first, a person or business must set up an online “customer account.” Second, a person or business may purchase various licences and permits through their customer account. Both steps of the process require the collection of personal and/or personal health information for distinct purposes. Our investigation found that the department’s elicensing system contravenes FIPPA and PHIA in that it collects more personal and/or personal health information than is reasonably necessary in the first step of the process, the creation of a customer account. We also found that while the department initiated a Privacy Impact Assessment (PIA), it was not completed prior to implementing the elicensing system and the department has not established what information is necessary to set up a customer account or what information is necessary for the distinct and separate action of purchasing different licences or permits. Therefore, our office made five recommendations to the department. In response to receiving the report and the ombudsman’s recommendations, the department accepted the recommendations.

Case 2020-0184