Information and Privacy Commissioner Bob Clark today released Investigation Report 1999-IR-007. The report concludes an investigation conducted under the Freedom of Information and Protection of Privacy Act (the “Act”).
The Complainant is an annual pass member at the Kinsmen Sports Centre, which is owned and operated by the City of Edmonton. In October 1999, the Complainant received a telephone call from an employee of the Kinsmen Sports Centre. During the telephone conversation, the Employee attempted to sell a product and made reference to the Complainant’s medical history.
The Complainant expressed concern that the Employee used information obtained from work to promote a product that the Employee was selling as a private business venture. In addition, the Complainant wanted to ensure that the Kinsmen Sports Centre had appropriate safeguards and measures in place to protect personal information from unauthorized use and disclosure.
The investigation found that the use of the Complainant’s information for the Employee’s personal business is not for the purpose that the information was collected and is therefore, not in accordance with section 37(1)(a) of the Act. As the Complainant did not consent to this use, the Employee’s use of the Complainant’s personal information is not authorized under section 37(1)(b) of the Act.
The investigation concludes that the Complainant’s privacy was breached. The City of Edmonton acknowledged the Employee’s use of the Complainant’s personal information is inappropriate. The City of Edmonton advised that this is an isolated case, and it is addressing the Employee’s actions through the employee relation process.
The investigation also recommended that the City of Edmonton undertake initiatives to strengthen the protection of personal information, including:
- Restricting the collection of personal information to only that which is necessary;
- Notifying individuals the purpose of collecting the information, the legal authority for collection, and providing a contact person who can answer any questions regarding collection;
- Updating the City’s Code of Ethics to reflect the responsibilities and requirements of the Act;
- Developing policies or procedures regarding confidentiality or restrictions on disclosure of information obtained by civic employees in the performance of their duties;
- Developing material to inform and educate civic employees of the requirements of the FOIP Act;
- Incorporating privacy considerations in all future enhancements and modifications to the computerized database; and
- Establishing a retention schedule for the information in its computerized database.
The City of Edmonton advised it has accepted the recommendations of the investigation, and is proceeding with compliance.