Professional Documents
Culture Documents
InvestigationintoProjectOperationWarrantExecutionforcompliance withtheFreedomofInformationandProtectionofPrivacyAct
March17,2014
EdmontonPoliceService
InvestigationF6148
TableofContents
Introduction Background Issues 3 4 5
Page|2
Introduction
[1] [2] [3] Stage2beganonApril2,2012.Inthisstage,theEPSpubliclydisclosedinformationidentifying individualswithoutstandingwarrants.ThemediasubsequentlyreportedthattheEPShad publishedinformationthatidentifiedayoungoffenderandthatthepublicationoftheyoung offendersidentitywithoutacourtorderwouldconstituteaviolationoftheYouthCriminalJustice Act(YCJA). TheYCJAisafederalstatutethatprohibitsthedisclosureofinformationaboutyoungoffenderswho areinvolvedinproceedingsundertheYCJA.AlbertasInformationandPrivacyCommissioner(the Commissioner)hasnojurisdictiontoinvestigatewhetheradisclosureofinformationisin contraventionoftheYCJA. TheEPS,however,isapublicbodysubjecttotheFreedomofInformationandProtectionof PrivacyAct(theFOIPActorAct).Undersection53(1)(a)oftheFOIPAct,theCommissionermay conductinvestigationstoensurecompliancewithanyprovisionofthisAct. OnApril4,2012,theCommissionerissuedanewsreleaseannouncingshehaddecidedtoconduct aninvestigationonherownmotionontheProjectOWEinitiative.TheCommissionersaid:
Thepurposeofthisinvestigationistomakesurethisinitiativeisbeingcarriedoutincompliancewith FOIP,andthatconsiderationhasbeengiventotheprotectionofpersonalinformation.
[4]
[5]
[6] [7]
Theinvestigationisnotfocusedonthedisclosureofinformationrelatingtoparticularindividuals, howeverifpeoplefeeltheirpersonalinformationwasreleasedunderthisinitiativeincontraventionof FOIP,theycanmakeacomplainttomyofficeandwewillinvestigate.
TheCommissioneralsosaid:
[8] [9] Page|3 obtainanunderstandingofthepurposeandintentoftheProjectOWEcampaign; examinethemanagementofpersonalinformationbytheEPSandthemeasurestakento protectpersonalinformationagainstriskssuchasunauthorizedaccess,collection,useand disclosure;and makerecommendations,ifnecessary,toensurethattheEPSmanagementofpersonal informationunderProjectOWEisinaccordancewiththeprovisionsoftheFOIPAct. TheCommissionerauthorizedmetoinvestigatethismatter.Theobjectivesoftheinvestigation wereto: OurOfficereceivednocomplaintsfromindividualsaboutthedisclosureoftheirinformationbythe EPSunderProjectOWE.
[10] MyinvestigationfoundthattheEPSdidnotmakereasonablesecurityarrangementstoprotect personalinformationasrequiredundersection38oftheFOIPActwhenitimplementedProject OWEin2012.MyinvestigationalsofoundthattheEPShadauthoritytodisclosesome,butnotall, ofthepersonalinformationinProjectOWE.IalsofoundthattheEPSdidnotlimittheextentof personalinformationdisclosedtowhatwasnecessarytocarryoutitspurposesinareasonable manner. [11] Basedonmyfindings,IrecommendthattheEPS: completeandsubmitaPrivacyImpactAssessment(PIA)toourOfficeforreviewpriorto undertakingProjectOWEagainoranynewinitiativeinvolvingthepublicdisclosureofpersonal information; establishapolicyforrequiringPIAswhendesigningmajorprojectsorinitiativesthatinvolvethe collection,useordisclosureofpersonalinformationpriortotheimplementationoftheproject; and developareviewandapprovalprocessthatincludestheEPSFOIPPCoordinator/FOIPPOfficein initiativesorprojectsthatinvolvethecollection,useordisclosureofpersonalinformation.
Background
[12] TheEPSfirstintroducedwarrantexecutioninitiativesintheearly1980s.1In2012,theEPSdecided toimplementProjectOWEaspartofitsViolenceReductionStrategytodealwiththelarge volumeofoutstandingwarrantsinEdmontonandtospecificallytargetthetop100(orso)highest offenders.2 [13] TheEPSsaidithadmorethan16,000outstandingwarrantsintheEdmontonarearangingfrom failurestoremovesnowtomoreseriousoffencessuchasassaults,robbery,andfirearmsoffences. TheEPSdeterminedProjectOWEwasthemostefficientandeffectivemeanstoaddressthelarge numberofoutstandingwarrants. [14] TheEPSsaidtheobjectivesofProjectOWEwereto: [15] DuringStage1ofProjectOWE,whichranfromMarch531,2012,theEPSpublishedinformationon itswebsiteandthroughothermediatoencourageindividualstocomeforwardandaddresstheir outstandingwarrantsbyApril2,2012,orriskthepossibilityofhavingtheirnamesandfaces advertisedpubliclyandpolicevisitingtheirhomeandworkplace.3TheEPSalsostated,people shoulddealwithoutstandingwarrantsbyApril2,2012.Ifpeopledonotcomeforwardtopoliceof holdindividualsaccountablefortheiroffencesandspecificallytargetthoseinvolvingviolence; informthosewithoutstandingwarrantsthatthepublicshelpwouldbeenlistedbyreleasing theirnamesandshowingtheirphotographs;and showthepublicthatthepoliceareremovingthemostdangerousoffendersoffthestreets.
1 2
Page|4
theirfreewill,theywillruntheriskofpublicembarrassment.TheEPSwillbeadvertisingthenames ofsomepeoplewhohaveoutstandingwarrantsinlocalnewspapers.4 [16] OnApril2,2012,theEPSimplementedStage2andbeganpublishingpersonalinformationof individualswithoutstandingwarrantsinvariouslocalnewspapersandontheEPSwebsite.For example: onApril2,2012intheEdmontonSun,theEPSpublishedanadvertisementwiththenamesand agesoffiveindividualsundertheheadingDOYOUKNOWTHESEPEOPLE?Aboveeach individualsnamewaseitheraphotographoftheindividualsface,orthewordSOLVED.The advertisementread,Thesepeoplehaveoutstandingcriminalwarrants.Ifyouhaveany informationregardingthewhereaboutsoftheseindividuals,orifoneofthemisYOU,contact yourlocalpolicedivisionorvisit ontheEPSwebsite,thenames,ages,photographs,heightsandweightsofseveralindividuals werepublishedunderthefollowingstatement:Thefollowingisalistofindividualswhohave yettoaddresstheiroutstandingwarrants.Stage1ofProjectOWEaffordedindividualsan opportunitytostepforwardanddealwiththeiroutstandingwarrants.Stage2,which commencedMonday,April2,2012,willseetheEdmontonPoliceServicestepupits enforcementeffortstolocatetheseindividuals,bothinpersonandbyadvertisingthephotos andnamesinvariouspublicationsandonline.5
Issues
1. IstheinformationatissuepersonalInformationasdefinedintheFOIPAct? [19] DuringvariousstagesofProjectOWE,theEPSdisclosedsomeorallofthefollowingpersonal informationofupto170individuals:name,age,photograph,height,weight,andthattheindividual hadanoutstandingwarrant.
4
Page|5
[20] TheFOIPActdefinespersonalinformationasrecordedinformationaboutanidentifiable individual.PersonalinformationundertheFOIPActincludesanindividualsname(section1(n)(i)), age(section1(n)(iii)),physicaldescription(OIPCOrderF2002001,p.107),photograph(OIPCOrder F2002001,p.10),andinformationabouttheindividualscriminalhistory(section1(n)(vii)). [21] IfindthattheinformationdisclosedbytheEPSunderProjectOWEispersonalinformationas definedintheFOIPAct. 2. DidtheEPScomplywithsection38oftheFOIPAct(reasonablesecurityarrangements)? [22] Section38oftheFOIPActstates:
38Theheadofapublicbodymustprotectpersonalinformationbymakingreasonablesecurity arrangementsagainstsuchrisksasunauthorizedaccess,collection,use,disclosureordestruction.
[23] Unauthorizedaccesstopersonalinformationincludes: [24] Unauthorizeddisclosuremeansdisclosingpersonalinformationinwaysotherthanthoseallowed undersection40oftheAct(OIPCOrder98002,p.198andInvestigationReportF2012IR01,p.28). MeasurestakenbytheEPStoprotectpersonalinformation [25] TheEPSdescribedtheprocessitundertooktoselectindividualsforProjectOWE.Thefollowingisa summaryofthisprocess: adownloadwasreceivedfromtheCanadianPoliceInformationCentre(CPIC)Operations Alberta/NWT. theEPSCPICWarrantUnit(CWU)sortedtherecordselectronicallytoidentifythecurrent outstandingwarrants.Oncesortedelectronically,amanualprocesswasundertakentoselect individualsforProjectOWE.TheCWUusedthefollowingcriteriatoidentifytheindividualsfor ProjectOWE:seriouscharges(assaults,robbery,firearmsoffences)withanEdmontonaddress intheEdmontonPoliceRecordsOccurrenceSystem(EPROS). oncetheindividualswereidentified,warrantswerecopiedandtheCPICOperatorsconducteda recentaddresscheckinEPROSastodeterminetheindividualswhereabouts.Anadditional namecheckwasthenrequiredthroughCPICtoensurethatthewarrantswerestilloutstanding. theCWUidentified170individualsforProjectOWEandforwardedwarrantinformation packagesfortheseindividualstotheProjectOWEteam.TheProjectOWEteamreviewedthe packagesanddeterminedwhichindividualswouldbepubliclyidentified. accessbythepublic,wherethereisnorighttoaccess; accessbyapublicbodysemployees,ifthoseemployeesdonotneedtoseethepersonal informationinthecourseoftheirduties(OIPCInvestigationReportF2003IR003,pp.3031); situationsinwhichinformationisstoredinanunsecuredmannersuchthatsomeonecanobtain unauthorizedaccess.8
7 8
OrdersandInvestigationReportsmentionedinthisinvestigationreportareavailableonourofficeswebsiteatwww.oipc.ab.ca. SeeOrders98002,p.136andF2009048,p.92).
Page|6
[26] Aspartofmyinvestigation,theEPSprovidedmewithcopiesoftheirpoliciesandproceduresthat dealgenerallywiththeprotectionofpersonalinformationandcompliancewiththeFOIPAct.These policiesandproceduresaddress(amongotherthings):accesscontrols;securityofinformation, systems,networks,andbuildings;CPICinformation;disposalofinformation;destructionofreports; audits;accessrequests;FOIPrequests;releaseofinformation;accountabilityandcompliance requirements.Inmyview,theEPSgeneralpoliciesandproceduressupportoverallprivacy management. [27] Frommyreviewofthesepoliciesandprocedures,however,Inoted,andtheEPSconfirmed,thatit doesnothaveaspecificpolicythatidentifieswhenaprivacyimpactassessment(PIA)isrequired.A PIAprocessisaduediligenceexerciseinwhichapublicbodyidentifiesandaddressespotential privacyrisksthatmayoccurinthecourseoftheproject.APIAisnotmandatoryundertheFOIPAct, butourOfficehasconsistentlyrecommendedthatPIAsbecompletedformajorprojectsthatinvolve thecollection,useordisclosureofpersonalinformation.9 [28] TheOfficeofthePrivacyCommissionerofCanada,andtheOfficesoftheInformationandPrivacy CommissionersofAlbertaandforBritishColumbiahavepublishedGettingAccountabilityRightwith aPrivacyManagementProgramtoprovideconsistentguidanceforprivatesectororganizationson thekeycomponentsofaprivacymanagementprogram.Thisguidanceisalsorelevantforpublic bodies.ThefollowingexcerptisparticularlyrelevanttotheEPS:
Wehaveseeninstancesoforganizationsofferingnewservicesthatcollect,useordisclosepersonal informationthathavenotbeenthoroughlyvettedfromaprivacyperspective.Properuseofrisk assessmenttoolscanhelppreventproblems.Fixingaprivacyproblemafterthefactcanbecostlyso carefulconsiderationofthepurposesforaparticularinitiative,productorservice,andanassessment thatminimizesanyprivacyimpactsbeforehandisvital. Asaresultsuchassessmentsshouldberequiredthroughouttheorganizationforallnewprojects involvingpersonalinformationandonanynewcollection,useordisclosureofpersonalinformation. Organizationsshoulddevelopaprocessforidentifyingandmitigatingprivacyandsecurityrisks, includingtheuseofprivacyimpactassessmentsandsecuritythreatriskassessments. Organizationsshoulddevelopproceduresforconductingsuchassessments,anddevelopareviewand approvalprocessthatinvolvesthePrivacyOfficer/Officewhendesigningnewinitiatives,servicesor programs.Forlargerorganizations,thePrivacyOfficershouldbeawareofthereviewprocess,and wheretherearehighriskinitiatives,servicesorprograms,thePrivacyOfficeshouldbedirectly involved.10
10
Page|7
[32] TheEPSresponsereinforcesmyviewthattheEPSdidnotconductanassessmentofthelegal authorityandpurposesforeachelementofpersonalinformationdisclosedunderProjectOWEprior tothepublicdisclosures. [33] Asaresult,IfindthattheEPSdidnotfulfillitsobligationundersection38oftheFOIPActtomake reasonablesecurityarrangementstoprotectpersonalinformationwhenitimplementedProject OWE. 3. WastheEPSauthorizedundertheFOIPActtodisclosepersonalinformationaspartofProjectOWE? [34] Asnotedabove,duringthetwostagesofProjectOWE,theEPSdisclosedallorsomeofthe followingpersonalinformationofupto170individuals:name,age,photograph,height,weight,and thattheindividualhadanoutstandingwarrant. [35] TheEPSsaiditdisclosedthepersonalinformationforthepurposeofenlistingthepublicsassistance inaddressingoutstandingwarrants. [36] TheEPSstatesthedisclosureofpersonalinformationforProjectOWEwasauthorizedbythe followingprovisionsoftheFOIPAct:40(1)(b),40(1)(c),40(1)(e),40(1)(k)(i)and40(1)(ee).Ireviewed theapplicationofeachoftheseprovisionsidentifiedbytheEPS. Section40(1)(b)(disclosurenotanunreasonableinvasionofpersonalprivacy) [37] Section40(1)(b)states:
40(1)Apublicbodymaydisclosepersonalinformationonly (b) ifthedisclosurewouldnotbeanunreasonableinvasionofathirdpartyspersonalprivacyunder section17,
Page|8
Section17(2)(disclosurenotanunreasonableinvasionofprivacy) [39] Section17(2)oftheActliststhecircumstancesinwhichthedisclosureofpersonalinformationisnot anunreasonableinvasionofathirdpartysprivacy.Ireviewedsection17(2)andfindthatnoneof theprovisionsundersection17(2)applytothedisclosureofpersonalinformationunderProject OWE. Section17(4)(disclosurepresumedtobeanunreasonableinvasionofprivacy) [40] Section17(4)oftheActliststhecircumstancesinwhichthedisclosureofpersonalinformationis presumedtobeanunreasonableinvasionofprivacy.Ifthedisclosureofpersonalinformationis presumedtobeanunreasonableinvasionofprivacy,thepublicbodymustthenconsiderandweigh allrelevantcircumstancesasrequiredundersection17(5)todeterminewhetheradisclosureisan unreasonableinvasionofathirdpartysprivacy. [41] Ifindthatsections17(4)(b)and17(4)(g)(i)arerelevant.Thesesectionsreadasfollows:
17(4)Adisclosureofpersonalinformationispresumedtobeanunreasonableinvasionofathirdpartys personalprivacyif (b) thepersonalinformationisanidentifiablepartofalawenforcementrecord,excepttotheextent thatthedisclosureisnecessarytodisposeofthelawenforcementmatterortocontinuean investigation (g) thepersonalinformationconsistsofthethirdpartysnamewhen (i) itappearswithotherpersonalinformationaboutthethirdparty
[41] InthecaseofProjectOWE,theEPSdisclosedthatcertainindividualshadoutstandingwarrants;I agreewiththeEPSthatthisinformationisanidentifiablepartofalawenforcementrecordand thataddressingoutstandingwarrantsispartofdispos[ing]ofthelawenforcementmatter. However,underthisprovision,thedisclosuremustbenecessary.EPSprovidednoinformationto demonstratethatthedisclosurewasnecessary.Therefore,thepresumptionofanunreasonable invasionofprivacydoesapplytodisclosuresofpersonalinformationforindividualswith outstandingwarrants. [42] Inaddition,thepresumptionofanunreasonableinvasionofprivacyalsoappliestodisclosuresof personalinformationofthoseindividualswhonolongerhadoutstandingwarrants. Page|9
Section17(4)(g)(i)(disclosureofanindividualsnameinconjunctionwithotherpersonalinformation) [43] Section17(4)(g)(i)oftheFOIPActstatesthatadisclosureofpersonalinformationispresumedtobe anunreasonableinvasionofathirdpartysprivacyifthedisclosureconsistsoftheindividualsname whenitappearswithotherpersonalinformationabouttheindividual. [44] Asnotedabove,duringthetwostagesofProjectOWE,theEPSdisclosedallorsomeofthe followingpersonalinformationofupto170individuals:name,age,photograph,height,weight,and thattheindividualhadanoutstandingwarrant.Ithereforefindthedisclosureofthepersonal informationispresumedtobeanunreasonableinvasionofprivacypursuanttosection17(4)(g)(i). Section17(5)(requirementtoconsiderallrelevantcircumstances) [45] InOrderF2007028,formerCommissionerFrankWorksaid:
[para15]Wheninformationfallsunderoneoftheprovisionsinsection17(4)oftheAct,disclosureof thepersonalinformationispresumedtobeanunreasonableinvasionofathirdpartyspersonal privacyHowever,asnotedabove,section17(4)createsapresumptiononly.APublicBodymustthen considerthefactorsundersection17(5),asthesefactorsmayoutweighapresumption
[46] Section17(5)states:
17(5)Indeterminingundersubsections(1)and(4)whetheradisclosureofpersonalinformation constitutesanunreasonableinvasionofathirdpartyspersonalprivacy,theheadofapublicbodymust consideralltherelevantcircumstances,includingwhether (a) thedisclosureisdesirableforthepurposeofsubjectingtheactivitiesoftheGovernmentofAlberta orapublicbodytopublicscrutiny, (b) thedisclosureislikelytopromotepublichealthandsafetyortheprotectionoftheenvironment, (c) thepersonalinformationisrelevanttoafairdeterminationoftheapplicantsrights, (d) thedisclosurewillassistinresearchingorvalidatingtheclaims,disputesorgrievancesofaboriginal people, (e) thethirdpartywillbeexposedunfairlytofinancialorotherharm, (f) thepersonalinformationhasbeensuppliedinconfidence, (g) thepersonalinformationislikelytobeinaccurateorunreliable, (h) thedisclosuremayunfairlydamagethereputationofanypersonreferredtointherecord requestedbytheapplicant,and (i) thepersonalinformationwasoriginallyprovidedbytheapplicant.[myemphasis]
[48] WithrespecttotherelevantcircumstancesconsideredbytheEPSindecidingtodisclosepersonal informationthroughProjectOWE,theEPSsaid[i]ndividualsinthesecircumstancesdonothavea reasonableexpectationofprivacyinordertoevadearrest.Inmyopinion,thisisabroadstatement thatprovidesnoinformationastowhatrelevantcircumstancestheEPSconsideredasrequired undersection17(5). [49] IfindthattheEPScouldnotrelyonsection40(1)(b)sincetheEPShasnotdemonstratedhowthe disclosureswouldnotbeanunreasonableinvasionofprivacy. Section40(1)(c)(disclosureforthepurposeforwhichinformationwascollectedoraconsistentuse) [50] Section40(1)(c)oftheActpermitspublicbodiestodisclosepersonalinformationforthepurpose forwhichtheinformationwascollectedorcompiledorforauseconsistentwiththatpurpose.The sectionreadsasfollows:
40(1)Apublicbodymaydisclosepersonalinformationonly (c) forthepurposeforwhichtheinformationwascollectedorcompiledorforauseconsistentwith thatpurpose,
[51] TheEPSsaidthedisclosureisauthorizedbysection40(1)(c)because:
theinformationobtainedthroughCPICwascollectedforalawenforcementpurpose.Usingthat informationforthelawenforcementpurposeofexecutingwarrantsisconsistentwiththatpurpose.
[52] TheEPSissayingsection40(1)(c)appliessincetheinformationwascollectedforlawenforcement purposesandthedisclosuresthroughProjectOWEwerealsoforlawenforcementpurposes. [53] Ifindthatthedisclosureofpersonalinformationinordertoexecutewarrantsisforthepurposefor whichtheinformationwascollected.Assuch,section40(1)(c)authorizedthedisclosureofpersonal informationofindividualswithoutstandingwarrants.However,section40(1)(c)didnotauthorize thedisclosureofpersonalinformationofindividualswhonolongerhadoutstandingwarrants. Section40(1)(e)(disclosuretocomplywithanenactment) [54] Section40(1)(e)oftheActallowsapublicbodytodisclosepersonalinformationforthepurposeof complyingwithanenactmentofAlbertaorCanada.
40(1)Apublicbodymaydisclosepersonalinformationonly (e) forthepurposeofcomplyingwithanenactmentofAlbertaorCanadaorwithatreaty,arrangement oragreementmadeunderanenactmentofAlbertaorCanada,
Page|11
(ii) toencourageandassistthecommunityinpreventingcrime, (iii) toencourageandfosteracooperativerelationshipbetweenthepoliceserviceandthe membersofthecommunity,and (iv) toapprehendpersonswhomaylawfullybetakenintocustody, and (b) toexecuteallwarrantsandperformallrelateddutiesandservices. (2)ApoliceofficerhasjurisdictionthroughoutAlberta
[56] Iagreethatsection38ofthePoliceActplacesadutyoneverypoliceofficertoexecutewarrants. However,IcouldnotfindadirectrelationshipbetweencomplyingwiththePoliceActanddisclosing theindividualsinformationtothepublic.Inotherwords,thedisclosurescannotbesaidtobefor thepurposeofcomplyingwiththePoliceAct,becausesection38ofthePoliceActdoesnotrequire theEPStopubliclydiscloseinformationthroughProjectOWE. [57] Assuch,Ifindthatsection40(1)(e)didnotauthorizetheEPSdisclosureofpersonalinformation throughProjectOWE. Section40(1)(k)(i)(disclosuretocollectafineordebt)
40(1)Apublicbodymaydisclosepersonalinformationonly (k) forthepurposeof (i) collectingafineordebtowingbyanindividualtotheGovernmentofAlbertaortoapublicbody, ortoanassigneeofeitherofthem,
[58] Undersection40(1)(k)(i),apublicbodymaydisclosepersonalinformationforthepurposeof collectingafineordebtowingbyanindividualtotheGovernmentofAlbertaorapublicbody,orto anassigneeofeitherofthem. [59] TheEPSsaidsection40(1)(k)(i)wouldpermitthedisclosurebecause,somewarrantshaveafine associatedtothemandwarrantexecutionresultsincollectingthosefines. [60] Inmyview,thedisclosuresforthepurposeofcollectingafinemayhavemeritforindividualswith outstandingwarrants.However,theEPSsaidsomewarrantshavefinesassociatedtothem;in otherwords,notallindividualswhoseinformationwasdisclosedhadfinesordebtsowing.TheEPS didnotconfirmwhetherallindividualswhoseinformationwasdisclosedhadfinesordebtsowing. Furthermore,section40(1)(k)(i)wouldnotauthorizedisclosuresofpersonalinformationwherethe individualsnolongerhadoutstandingwarrants. [61] Ifindthatsection40(1)(k)(i)oftheFOIPActauthorizedthedisclosureofpersonalinformationfor thoseindividualswithoutstandingwarrantsthathadfinesassociatedwiththem. Section40(1)(ee)(disclosuretoavertorminimizeharmorimminentdanger) [62] Atthetimeofthedisclosuresin2012,section40(1)(ee)read: Page|12
[65] Consequently,theEPSneededtodemonstratehowtheindividualswhoseinformationwasdisclosed presentedanimminentdangertothehealthorsafetyofsomeoneelseandhowthedisclosureof theseindividualsinformationwouldavertorminimizethedanger.Thegeneralstatementbythe EPSthatviolentoffendersevadingthejusticesystemposes(sic)dangertothesafetyofthecitizens oftheCityofEdmontonandProjectOWEminimizedsomeofthosedangersdoesnotmeetthe requirementofsection40(1)(ee)oftheAct. [66] Furthermore,asnotedearlierinthisreport,theEdmontonJournalreportedonNovember15,2012 thattheEPSlaunchedasubsequentstageofProjectOWEwhichfocusedonindividualswantedfor seriousorviolentoffencesandserioustrafficinfractions.However,theEPSdidnotpubliclyrelease theseindividualspersonalinformation.IftheEPSdidnotrelyonsection40(1)(ee)todisclosethe personalinformationofindividualswantedforseriousorviolentoffencesandserioustraffic infractionsthenitisunclearhowtheEPScouldrelyonsection40(1)(ee)forthedisclosuresinApril 2012. [67] Assuch,Ifindsection40(1)(ee)didnotauthorizethedisclosureofpersonalinformationforthe purposeofProjectOWE. 4. DidtheEPSdisclosepersonalinformationonlytotheextentnecessary,incompliancewithsection40(4) oftheFOIPAct?
40(4)Apublicbodymaydisclosepersonalinformationonlytotheextentnecessarytoenablethepublic bodytocarryoutthepurposesdescribedinsubsections(1),(2)and(3)inareasonablemanner.
[69] Isaidearlierthat,inmyview,section40(1)(c)oftheFOIPActauthorizedtheEPStodisclose personalinformationaboutindividualswithoutstandingwarrantsandsection40(1)(k)(i)authorized theEPStodisclosepersonalinformationaboutindividualsthathadfinesassociatedwiththeir outstandingwarrants.However,undersection40(4),theEPSmustensureitlimitsthedisclosureof personalinformationtotheextentnecessarytocarryoutthepurposesinareasonablemanner. [70] InreviewingthevariousstagesofProjectOWE,Inotedthattheextentofpersonalinformation disclosedwasinconsistent.Forexample,thepersonalinformationthatappearedinnewspaper advertisementsincludedname,ageandphotograph.InformationthatwasdisclosedontheEPS websiteincludedname,age,photographandalsoheightandweight.Nopersonalinformationwas disclosedduringthethirdstageofProjectOWEthatwaslaunchedinNovember2012,andwhich targetedindividualswantedforseriousorviolentoffencesandserioustrafficinfractions. [71] TheEPSdidnotprovideanyexplanationforwhythedisclosureofspecificpersonalinformation elementswasnecessary.Furthermore,theinconsistencyinpersonalinformationdisclosuresat variousstagesofProjectOWEindicatesthattheEPSdidnotlimititsdisclosureofpersonal informationtotheextentnecessarytoenableittocarryoutitspurposesinareasonablemanner, therebycontraveningsection40(4)oftheAct.
FindingsandRecommendations
[72] Thefindingsfrommyinvestigationareasfollows: theEPSdidnotfulfillitsobligationundersection38oftheFOIPActtomakereasonablesecurity arrangementstoprotectpersonalinformationwhenitimplementedProjectOWE. section40(1)(c)authorizedtheEPStodisclosepersonalinformationforthoseindividualswho hadoutstandingwarrants. section40(1)(k)(i)oftheFOIPActauthorizedtheEPStodisclosepersonalinformationforthose individualswithoutstandingwarrantsthathadfinesassociatedwiththem. eventhoughauthorizedtodisclosesomepersonalinformationofindividualswithoutstanding warrants,theEPSdidnotlimititsdisclosureofpersonalinformationtotheextentnecessaryto enableittocarryoutitspurposesinareasonablemanner,therebycontraveningsection40(4) oftheAct. theEPSdisclosedpersonalinformationincontraventionofsection40(1)oftheFOIPActwhenit disclosedpersonalinformationofindividualswhonolongerhadoutstandingwarrants.
11
OfficeoftheInformationandPrivacyCommissionerofAlberta.PrivacyImpactAssessmentRequirements.Retrievedfrom http://www.oipc.ab.ca/Content_Files/Files/PIAs/PIA_Requirements_2010.pdf
Page|14
Page|15