Annual Report: 2003-2004

2. Policy Versus The Law

Background

An individual made two requests under the Access to Information Act to the Department of the Solicitor General (SGC) for records concerning two other people. The access requester enclosed with the request a consent form signed by the other persons, authorizing the government to disclose information about them to the requester.

SGC refused to process and answer the access requests. It returned the requests with this explanation: "It is the policy of this department that individuals wishing to have access to their personal information should submit their own requests under the Privacy Act." The department not only refused to answer the access requests, it failed to inform the requester of his right to make a complaint to the Information Commissioner. However, the requester was aware of his right and complained to the commissioner.

Legal Issues

There is, under the Privacy Act, a mechanism for individuals to make requests for access to information about themselves. Does the existence of that mechanism mean that requests for personal information must be made under the Privacy Act, or may such requests also be made under the Access to Information Act? Is it required that individuals apply for access to information about them, or may they give consent for someone else to apply for them? These were the issues raised by this complaint.

In defense of its refusal to process and answer these two access requests, the department argued that there was some doubt as to the legitimacy of the consents. It argued that this doubt was an acceptable reason to insist that the individuals, who allegedly gave consent, submit their own requests under the Privacy Act. The department insisted on its right to refuse to process these access requests in order to protect the privacy of the individuals whose information had been requested.

The commissioner concluded that there is no requirement that requests for access to personal information must be made under the Privacy Act or that they must be made by the person to whom the information relates. He found that, should individuals wish to request access to personal information about themselves or about someone else, they also have a right to do so under the Access to Information Act upon payment of the associated fees (there are no fees for requests made under the Privacy Act). If the request is for information about someone else, disclosure may only be made under the Access Act if:

1. there is consent from the person to whom the requested information relates;
2. the information is publicly available; or
3. disclosure of the information without consent is authorized by section 8 of  the Privacy Act (for example, to serve the best interests of the person to whom the information relates, to serve the public interest, to enable a member of Parliament to help the person, for a use consistent with the purpose for which the information was compiled).

The commissioner concluded that, if a department decides that a consent is not valid (presumably after taking representations from the requester and, if necessary, verifying directly with the person to whom the information relates), the proper course of action is to refuse disclosure, pursuant to the personal information exemption in the Access Act (section 19), and to inform the requester of his or her right of complaint to the Information Commissioner.

The SGC accepted the obligation to answer the requests. It sent letters to the person whose information was requested, seeking confirmation of their consents and conducted searches for relevant records. In the end, no records relevant to the requests were located, and the requester was so informed.

Lessons Learned

If an access request is properly made (i.e. it meets the clarity requirement of section 6 and is accompanied by the five dollar fee) then there is a mandatory, legal obligation on government institutions to answer the request (section 7), to answer within specific deadlines (sections 7 and 9), to give reasons for refusal of access (section 10), and give written notice of the right of complaint to the Information Commissioner (section 10).

Privacy concerns (for example, whether or not a consent to disclose personal information is valid) never justify a refusal to fulfill the above-described obligations. Such concerns, if they have some merit after reasonable inquiry by the government institution, may, of course, justify a refusal to disclose personal information, which refusal may then be the subject of a complaint to the Information Commissioner.