Privacy Guidelines for Administrative Tribunals on the Online Publication of Decisions

Developed April 2015

Introduction

Administrative tribunals are using the Internet more frequently as an efficient and effective tool to communicate their decisions to the public. Online publication of decisions can be a useful means to accomplish the goals of openness, accountability and transparency. It can also increase the public’s knowledge about the work of the tribunal and how it has decided prior cases.

Administrative tribunals, as public bodies, are subject to the protection of privacy requirements under Manitoba’s Freedom of Information and Protection of Privacy Act (FIPPA) and Personal Health Information Act (PHIA). In many cases, a tribunal can accomplish the goals of openness, accountability and transparency and comply with FIPPA and PHIA through the publication of decisions that do not contain personally identifying information.

Publishing tribunal decisions online makes those decisions widely available. As a result, any personal information of parties or witnesses contained in the decisions becomes available to unlimited persons to use in unlimited and unforeseen ways, which can be harmful to individuals.

It is important that the content of tribunal decisions published on the Internet reflect the reality that once a decision is posted online, anyone can take an individual’s information and use it out of context for a variety of purposes. When decisions contain personally identifying information, those individuals lose control over their information and can be exposed to harm to their reputation, discriminatory practices, identity theft, fraud and data mining. A real concern is that individuals may be reluctant to participate in a tribunal proceeding due to concerns about the loss of their privacy.

Given the diversity of tribunals and their enabling legislation, there cannot be a one-size-fits-all approach to the publication of decisions online. These guidelines outline factors to consider when publishing decisions online.

Consider Relevant Legislation as well as Public Interest in Disclosure

Administrative tribunals should assess whether their enabling legislation regulates what personal information, if any, may or must be included in decisions. Another consideration is whether the enabling legislation provides for public disclosure of decisions.

Even where there is statutory authority to publicly disclose personally identifying information in decisions, tribunals should assess whether it is necessary or appropriate to make the disclosure. This involves considering whether there is a clearly identified public interest for the disclosure, such as to protect the public from fraud, harm or professional misconduct, or whether disclosure would promote deterrence.

Consideration should be given to the sensitivity, accuracy and level of detail of the personally identifying information. A determination should be made on a case-by-case basis about whether the disclosure of personally identifying information about each party and witness is necessary or appropriate to satisfy the public interest in disclosure.

FIPPA and PHIA set out requirements for the protection of privacy of personal and personal health information. The acts restrict the disclosure of personal information and personal health information, as follows:

• personal and personal health information can only be disclosed where there is legislative authority under FIPPA and PHIA; these acts permit disclosure when another act requires or authorizes such disclosure
• every disclosure of personal and personal health information must be limited to the minimum amount of information necessary to accomplish the purpose for which the information is disclosed
• PHIA further restricts disclosure to the extent the recipient needs to know the personal health information

Develop Decision-Writing Policies

If an administrative tribunal decides to post its decisions online, creating policies for decision writing can be extremely useful for ensuring that personally identifiable information is not inadvertently disclosed. If the tribunal has legislative authority to publicly disclose personal or personal health information, having a policy can assist in limiting such disclosure to the minimum amount necessary.

Tribunals should consider preparing all decisions, whether disclosed online or only to parties, with a view to eliminating the inclusion of information that is unnecessary and is not essential to an understanding of the decision or the decision-making process. Developing policies can assist members to minimize, anonymize or remove information that identifies individuals.

Other policy considerations are whether all decisions should be published or only leading cases and whether decisions that cannot be sufficiently anonymized should be published online.

A key consideration is the format of the decisions published online, specifically whether to publish:

• the full text of decisions that have been written in a manner that does not identify individuals or limits the personally identifying information (for example, the personal information could be in a separate index that is provided only to the parties),
• decisions that have the personally identifying information redacted from the original version, or
• a summary of the decision.

How a Tribunal can Limit Disclosure of Personal Information

A decision-writing policy should include practices to minimize, anonymize or remove personal and personal health information about individuals from decisions posted online.

In the policy, consideration should be given to not including the following information in decisions:

• actual names or initials (use pseudonyms or randomized initials)
• an individual’s age or date of birth
• information about marital and family status, sexual orientation, medical history, criminal history or national origin unless it is truly relevant to the decision of the tribunal
• an individual’s residential address
• an individual’s workplace name or location
• the names of health-care facilities
• the names or locations of health-care providers
• social insurance numbers, driver’s license numbers or Personal Health Identification Numbers (PHIN)
• financial account numbers or bank details
• specific dates of events involving an individual unless they are truly relevant to the decision of the tribunal
• names of communities

Caution: Do not rely only on the routine redaction of obvious identifiers such as names, addresses and name of facility or community because there can be situations in which the other details in the decision could result in the individuals being identifiable. It’s important to consider the whole picture – not just the small pieces of information. Situations may arise where there is a mosaic effect, where pieces of information on their own do not constitute personally identifiable information, but when combined together may result in the identification of the individual.

How to Ensure Transparency Through Notice to Individuals

Transparency about the specific policies, statutes and regulations that govern the tribunal’s information-handling rules can enhance trust about the tribunal’s privacy practices.

As a starting point, tribunals should inform parties about their responsibilities to include only the personal and personal health information that is necessary to advise the tribunal about the dispute and relevant issues in any filed documents. This will assist the tribunal in limiting the collection of personal and personal health information to the minimum amount necessary to accomplish the purpose for which the information is collected.

Tribunals must provide notice, in accordance with FIPPA and PHIA, to individuals from whom personal information or personal health information is being collected, so they understand how their information will be used and disclosed. The acts require that certain elements of information be provided in the notice to individuals.

Tribunals can reduce the risk of misunderstandings or privacy-related conflicts concerning what information will be disclosed online by informing individuals of the tribunal’s policy and practices regarding online publication of decisions. Individuals should be advised of the following:

• the type of information that is generally made available to the public via the Internet
• how decisions will be published online
• whether personal identifiers will be included in decisions published on the Internet
• what procedures are available for parties and witnesses to make submissions about the electronic disclosure of personally identifying information of particular concern

How a Tribunal can use Technology to Minimize Privacy Risks

Tribunals can increase privacy protection by using “web robot exclusion protocols” as a way to exclude online tribunal content in results generated from most random Internet searches.

Web robots or Internet bots (also known as web crawlers or spiders) are software programs that traverse the Internet automatically. Search engines such as Google use them to index web content.

A “web robot exclusion protocol” is a recognized convention or standard that informs the robot about which areas of a website to exclude from the indexing process. Web robots deployed by well-known search engine companies may respect exclusion protocols, while other companies or individuals may deploy web robots that do not respect exclusion protocols. The exclusion protocol does not guarantee that a web robot will comply with the request to leave the web content unindexed. Use of an exclusion protocol will, however, minimize the likelihood that indexing will occur.

Acknowledgments

These guidelines are based on the Office of the Privacy Commissioner of Canada’s 2010 document, Electronic Disclosure of Personal Information in the Decisions of Administrative Tribunals, which was produced after consultations with provincial and territorial privacy oversight offices, as well as the 2011 Balancing Privacy and Openness: Guidelines on the Electronic Publication of Decisions of Administrative Tribunals by the Office of the Information and Privacy Commissioner for British Columbia.

April 2015