The Office of the Information and Privacy Commissioner has found that Wilson Banwell Human Solutions Inc. (Wilson Banwell) contravened the Personal Information Protection Act (PIPA) by disclosing more personal information than was necessary to a complainant’s employer. The investigation also determined Wilson Banwell contravened PIPA by disclosing the complainant’s personal information to a union for purposes that were not reasonable, and to an extent that was not reasonable.
After failing to pass a drug and alcohol test, the complainant was referred to Wilson Banwell, an Employee Assistance Provider (EAP), for a “return to work assessment.” He signed a consent authorizing release of “assessment / treatment summaries” to his employer to facilitate his return to work. The complainant believed Wilson Banwell would limit its report to recommendations arising from the assessment. However, the Wilson Banwell psychologist sent a three-page report to both the complainant’s employer and union. The report provided a summary of the clinical interview the psychologist conducted with the complainant, including details of a previous visit the complainant had made to Wilson Banwell on his own initiative, and some personal information of the complainant’s wife.
The Investigator noted that Wilson Banwell has been diligent in meeting its myriad responsibilities under PIPA. Wilson Banwell clearly recognizes the privacy considerations associated with providing an EAP service and has developed comprehensive and articulate privacy policies addressing collection, use and disclosure of personal information, notification of purpose, consent protocols, and information security. These policies and procedures were clearly communicated to staff in a diligent and thorough manner.
Nonetheless, despite having this framework in place, contraventions of the Act may still occur. Accordingly, the Investigator recommended Wilson Banwell:
- revise its “Release of Information” form to clarify exactly what information will be disclosed to a client’s employer for return to work purposes, and
- remind all staff of Wilson Banwell’s policies respecting written consent, and the requirement to disclose only the least amount of information necessary for reasonable purposes.
Wilson Banwell agreed to implement these recommendations.