Office of the Information and Privacy Commissioner: Annual Report

76 Pages·2002·5.9 MB·English

by  Alberta. Office of the Information and Privacy Commissioner

C-O-
Offlce of the Information and Privacy Commissioner
Alberta
2001 - 2 002 Annual Report
The Purposes of the Freedom of
Information and Protection of Privacy Act
The purposes of the Freedom of I nformation and Protection of P rivacy Act according to Section 2 o f the
Act are:
a) to allow any person a right of access to the records in the custody or under the control of a p ublic
body subject to limited and specific exceptions as set out in the Act,
b) to control the manner in which a p ublic body may collect personal information from individuals, to
control the use that a p ublic body may make of that information and to control the disclosure by a
public body of that information,
c) to allow individuals, subject to limited and specific exceptions as set out in the Act, a right of access to
personal information about themselves that is held by a p ublic body,
d) to allow individuals a right to request corrections to personal information about themselves that is
held by a p ublic body, and
e) to provide for independent reviews of decisions made by public bodies under this Act and the
resolution of complaints under this Act.
The Purposes of the Health Information Act
The purposes of the Health Information Act according to Section 2 o f the Act are:
a) to establish strong and effective mechanisms to protect the privacy of individuals with respect to their
health information and to protect the confidentiality of that information,
b) to enable health information to be shared and accessed, where appropriate, to provide health services
and to manage the health system,
c) to prescribe rules for the collection, use and disclosure of health information, which are to be carried
out in the most limited manner and with the highest degree of anonymity that is p ossible in the
circumstances,
d) to provide individuals with a right of access to health information about themselves, subject to
limited and specific exceptions as set out in this Act,
e) to provide individuals with a right to request correction or amendment of health information about
themselves,
f) to establish strong and effective remedies for contraventions of this Act, and
g) to provide for independent reviews of decisions made by custodians under this Act and the resolution
of complaints under this Act.
Copies of this report are available from:
Office of the Information and Privacy Commissioner
410, 9925 - 1 09 Street
Edmonton, Alberta
T5K 2J8
Tel: (780) 422-6860
Fax: (780) 422-5682
Website: www.oipc.ab.ca
E-mail: [email protected]
’ #4W, 9925- 109 Street
Edmonton, Alberta
O Canada T5K2J8
Office of the Information Tel: (780) 422-6860
Fax: (780) 422-5682
and Privacy Commissioner Internet: generalinfo@oipc. ab. ca
October 31, 2002
Honourable Ken Kowalski
Speaker of the Legislative Assembly
325 Legislature Building
10800 - 9 7 Avenue
Edmonton, Alberta
T5K 2B6
Dear Mr. Speaker:
1 a m pleased to submit to you the Annual Report of the Office of the Information and Privacy
Commissioner, covering the period from April 1, 2001 to March 31, 2002.
This report is submitted under Section 63(1) of the Freedom of Information and Protection of P rivacy Act, R.S.A.
2000, Chapter F-25, and Section 95(1) of the Health Information Act, R.S.A. 2000, Chapter H-5.
Yours truly.
Franklin J. Work, Q.C.
Information and Privacy Commissioner
Digitized by the Internet Archive
in 2017 with funding from
University of Alberta Libraries
https://archive.org/detaiis/officeofinformat2001aibe
Table of Contents
Commissioner's Message 1
Introduction 3
Background 3
Mandate 3
IPC Timeline 4
OIPC Staff 5
Accomplishments 6
Interpretation of Legislation 6
Education and Public Relations 7
Office of the Information and Privacy Commissioner 9
Mediation and Investigation 10
Mediation 10
Investigation 10
Statistics 11
FOIP Act Statistics 2001 - 2 002 12
FOIP Act Summaries: Selected Orders (Released between April 1, 2001 and
March 31, 2002) 33
FOIP Act Summaries: Selected Reviews, Complaints, Investigations, Audits
(April 1, 2001 to March 31, 2002) 36
FOIP ACT Summaries: Advice, Recommendations and Analysis of Issues 39
FOIP Act Privacy Impact Assessments (PIAs) 41
A
n
n
HIA Statistics 2001 - 2 002 43 u
a
l
HIA Summaries: Investigation Reports, Mediation 49

R
e
HIA Privacy Impact Assessments (PIAs) 50 p
o
r
t
Financial Statements 53

2
Auditor's Report 55 0
Statement of Financial Position 56 0
1

Statement of Changes in Net Liabilities 57
-
Statement of Operations 58
2
Statement of Changes in Financial Position 59 0
0
Notes to the Financial Statements 60 2

Salary and Benefits Disclosure 64
Appendix 65
;%y
-a ^i);>.|
m ■■ ■
Wfc'*. •
Br.:;^!,
'
V

m .■kWtv^ f-i■fiti,-f;'l ■r t'■ ■* .v .;, * „
' ■'fill.' ‘ * ’ ' * **"*t:‘
pi" I«<;', ijm
,w-
tfi
^.rr:
m
■i®r 0
■ ■..,> f ■ ^'■wp * '
Hn
:^. ti
-
my s^;*W L«.,*J»..l' ? - '• -; *J, ■ii
*=,-
; “S'- ^
C ' -I
il
ii • /• X *T ip i ^l lrw«4* » w llMl^ffK d
. Vm'h^,i m
Commissioner's Message
This is my inaugural Annual Report as This is a measured and reasonable response to
Information and Privacy Commissioner for the security needs. Information which would render
Province of Alberta. I w ant to take this our Province vulnerable to attack should not be
opportunity to talk about some of the things that accessible, and, in the clearest of cases, limited
I t hink are most important in this job. personal information should be available for
specific security purposes.
Public bodies must give access to information
because it is the right thing to do. The public What I s ee happening in our schools is of
expects a h igh degree of openness and concern. In many schools there are surveillance
accountability from governments. The right to cameras. Students are required to have and
criticize government in an informed way is present ID cards. Drug-sniffing dogs are routinely
fundamental to a d emocratic state. But there are brought in to check lockers. Schools in another
practical reason for access to information as well. province may subject student athletes, as young
Innovation, creativity, change and reform all as 13, to random drug testing. We want our
require information. If we cannot learn from our schools and our children to be safe. Individually
experiences, including our mistakes, we will be each one of these measures may seem to have
doomed to relive them. When the Freedom of some logic. But the cumulative effect is to create
miniature surveillance states in our schools. Is
Information and Protection of Privacy Act first came
into force, the cost of providing access was a this necessary? Are our schools hot beds of crime
concern to some public bodies. In the ensuing and anarchy? Are there sufficiently real and grave
years, many public bodies have come to realize threats to justify this surveillance? Or do we do it
that proper information management, that is, because we can? What does it tell our children?
knowing what your information assets are, where That they do not have the morals and strength of
they are and how to access them, is a character to conduct themselves honourably?
fundamental business practice for any That they should get used to being watched and
organization. This is the Information Age. inspected at all times? That our schools, and the
world, are so unsafe that all these measures are
Protection of privacy presents a g reater challenge. necessary?
First, privacy is a very fluid, hard to define
concept. It is the right to be left alone, to think, Alberta is one of a f ew provinces that have a
to dream, to create, to assert our individual specific health information law. This is important
control over our affairs. It is also an indication of because there is a t remendous amount of pressure
respect for and trust of other human beings, a to use health information, not only to provide
trust that has been shaken by terrorist attacks and better health care to the individual, but also for
crime. Technology and our quest for security research and to make the health care system more
militate strongly against privacy. However, efficient and sustainable. The Health Information
despite our desire for ever greater security, Act seeks to strike a b alance between the sanctity
according to Statistics Canada, the rate of violent of our health information and the need to use the
crime has decreased every year since 1997. We information to treat us, keep us well, and sustain
must not allow our desire for a risk free world to our health care system. But here again, the
drive us to turn our society into a p rison. existence of, for example, an electronic patient
record, as valuable as that will be to many people,
At the same time, I a m not blind to the need to
means that each of us will relinquish some degree
protect our society from harm. For example, the of direct control over our health information. The
Office of the Information and Privacy
Health Information Act sets the rules and
Commissioner has worked closely with the
empowers my Office to deal effectively with
Government of Alberta on the Security
complaints and concerns.
Management Statutes Amendment Act (Bill 31).
Personal information, in digital form, can easily I h ave a sense of optimism as I b egin my term as
be transmitted, linked, combined, matched and Commissioner. Alberta has good legislation in the
mined. In some cases this may be to our benefit, Freedom of Information and Protection of Privacy Act
■ 2 ■ as in the case of an electronic patient record. But and the Health Information Act. Most public
the potential for abuse, the potential for our bodies have shown a commitment to the
information to be disclosed to the wrong person legislation and its implementation. Serious
or used for the wrong purpose, is g reat. The consideration should now be given to legislating
potential for incorrect information to become fair information practices in the private sector in
part of some permanent record, of which we are Alberta. The Office of the Information and
unaware, increases as our information populates Privacy Commissioner has an outstanding staff
more and more databases. The potential for harm who work with public bodies to develop
becomes even greater as our genetic information programs and policies which foster openness and
becomes collected, used and disclosed. respect the privacy of Albertans. I i ntend to
continue that process. I a m not so naive as to
I w ant to mention the Information Access and
r
e think that I w ill see eye-to-eye with public bodies
Protection of Privacy (lAPP) program at the
n on every issue however. I w ill advocate access to
Univeorsity of Alberta. Seeded with money from
i information and protection of privacy wherever
the sGovernment of Alberta and the Office of the possible. Where I c annot bring about change, I
s
Infoirmation and Privacy Commissioner, this will at least be able to make public bodies and
prommgram is the first of its kind in Canada. With Albertans aware of the issues.
the o recent support of the Federal Information
C
Commissioner, this program positions the
University of Alberta to be a national leader and
innovator in the areas of access to information
and protection of privacy. It will be a l asting

le gacy for the people of Alberta and Canada.
y
c
a
v
i
r
P

n
o
i
dt
na
am
r
o
f
n
I

e
h
t

e
fc
oi
f
f
O
Introduction
Mandate
Background
The Alberta Freedom of I nformation and Protection Under the Acts, the Commissioner is responsible
of P rivacy (FOIP) Act received Royal Assent on for performing a b road range of functions.
Section 53 of the FOIP Act and Section 84 of the
June 1, 1994, although most of the Act did not ■ 3 ■
come into force until October 1, 1995. The Health HIA set out a number of these responsibilities:
Information Act (HIA) was passed by the Alberta ■ Informing Albertans about the FOIP Act
Legislature in 1999 and came into force on and HIA.
April 25, 2001. Franklin]. Work, Q.C., was
■ Reviewing the access to information decisions
appointed as the province's second Information of public bodies under the FOIP Act.
and Privacy Commissioner in 2002.
■ Reviewing the access to information decisions
With the implementation of the Health of custodians under HIA.
Information Act (FllA), the OIPC hired two Flealth ■ Investigating how public bodies and
Portfolio Officers, a C ompliance Officer, and a
custodians collect, use and disclose personal
Health Intake Officer. In 2002, due to the information and health information to make
impending increase in caseloads created by the
sure that an individual's privacy is being
HIA, the Commissioner delegated his order-
making authority to an Adjudicator as authorized protected.
■ Conducting investigations of public bodies to
under Section 61(1) of the FOIP Act. Additionally,
ensure compliance with the FOIP Act.
an Assistant Portfolio Officer and an Inquiries
■ Conducting investigations of custodians to
Clerk were added in 2001 - 2 002. The staffing
strategy of OIPC has been to hire individuals with ensure compliance with the HIA.
adaptable skills and extensive experience in areas ■ Hearing comments from the public about how
that are particularly relevant to access and the Acts are being administered.
privacy issues. In so doing, the organization has ■ Researching anything affecting the
created a b road base of knowledge, which can be
achievement of the FOIP Act and HIA's
drawn upon in order to enforce the Acts and
assist Albertans with any concerns they have in purposes.
■ Commenting on the privacy and information
this area.
implications of proposed legislation and
programs.
■ Informing custodians and the heads of public
bodies when applicants have not been A
n
adequately served under the Acts. n
u
■ Giving advice and recommendations about the a
l
Acts to heads of public bodies and custodians.

■ Authorizing the collection of personal R
e
information from sources other than the p
o
individual the information is about. r
t

■ Comment on the implications for access to
2
health information or for protection of health 0
0
information of privacy impact assessments 1
submitted to the Commissioner.

-

2
0
0
2
IPC Timeline
The objectives of the Office for 2001 were to: The objectives of the Office for 2002 are to:
■ continue to work with public bodies to ■ redesign the OIPC website to reflect the
■ 4 ■ incorporate FOIP into their daily business imnacnlduastieo;n of the HIA under the OlPC's
routine;
■ work with custodians to ensure they are ■ create a P rivacy Impact Assessment (PIA)
compliant with the Health Information Act, registry on the OIPC website;
particularly with requests to access health ■ create a R esearch Ethics Reviews registry on
information and privacy impact assessments the OIPC website;
(PlAs) related to electronic medical records
■ continue to assist custodians on being
systems;
compliant with the Health Information Act;
■ work with the six designated research ethics
m promote custodians use of PlAs to examine the
review boards in the province to inform and
protection of privacy and security in proposed
r educate them on their obligations and
e systems and practices involving health
n Arcets;p onsibilities under the Health Information information;
o
i ■ inform and educate Albertans on their access
s■ continue to comment on and monitor the use
s and privacy rights under the Health Information
i of surveillance technology by public bodies
m Act and the Freedom of Information and
m and encourage privacy impact assessments Protection of P rivacy Act;
o before implementation;
C ■ continue to work with public bodies to
■ increase awareness of the Office of the
incorporate FOIP into their daily business
routine;
Information and Privacy Commissioner and
promote Albertans' knowledge of access to
information and privacy rights; ■ prepare and present the OlPC's submission to
the Special Select FOIP Act Review Committee;
y■ encourage public bodies to conduct PlAs prior
c
a to implementation of initiatives involving ■ comment on, provincial and federal
v
i personal information; government initiatives affecting Albertans'
Pr access and privacy rights.

n
o
’ '
ad
nn
Ta
.
o
f
n
l

e
h
t

e
fc
io
f
f
O