Information and Privacy Commissioner Bob Clark released Investigation Report 2000-IR- 007 today. The report concludes an investigation conducted under the Freedom of Information and Protection of Privacy Act (the “FOIP Act”).
The Commissioner had received two complaints against the Grande Yellowhead Regional Division (the “Public Body”) regarding a school’s production of an Image CD-ROM disk, which contained images of students photographed. Specifically, the Complainants questioned:
- Why were parents not informed of the compilation of the Image CD-ROM disk?
- Under what authority did the School disclose their children’s information to a private sector company that was contracted to produce the Image CD-ROM disk?
- What safeguards were effected to protect the information disclosed from potential misuse?
- Is the information contained in the Image CD-ROM disk used in accordance with the provisions set out in the FOIP Act.
The Portfolio Officer assigned to the investigation determined that the School’s collection and use of student photographs were in accordance with the FOIP Act. However, the Portfolio Officer found that parents were not notified of the School’s collection and usage of the student photographs, and reminded the Public Body of its duty to comply with the notification requirements set out under section 33(2) of the FOIP Act.
The Portfolio Officer found that the School’s disclosure of student identification numbers to the company contracted to produce the CD-ROM disk was not necessary and not authorized under the FOIP Act. The Portfolio Officer recommended that the School stop disclosing this information.
The Portfolio Officer also recommended that the School incorporate privacy protection provisions into its contract with the company to protect personal information from unauthorized collection, use and disclosure.
The Public Body agreed to comply with all the investigation’s recommendations.