Annual Report: 2003-2004

8. No Special Status For Lawyers

Background

A Vancouver immigration lawyer made a request to Citizenship and Immigration Canada (CIC) under the Access to Information Act for information about one of his clients. CIC refused to process the request until a written consent was provided by the client, authorizing disclosure of the client’s personal information to the lawyer. The lawyer obtained his client’s consent (from China); however, CIC rejected the consent because it had not been dated. The lawyer felt that CIC was imposing unnecessary "red tape" and complained about the matter to the Information Commissioner.

Legal Issues

Is a government institution justified in refusing to disclose personal information to the subject’s legal counsel unless the lawyer provides a signed and dated consent from the client? The lawyer argued that lawyers are bound by fiduciary duties to their clients. Consequently, where a lawyer advises in writing that he or she represents an individual, it should be presumed that the lawyer is acting with the client’s authorization. The lawyer pointed out that he is a member of the Quebec Bar and, if he were to falsely claim that he represented a client, he would be subject to sanctions, including revocation of his license to practice law.

For its part, CIC pointed out that, while there is no specific requirement under the Access to Information Act for written consent for disclosure of personal information to a third party, there is a specific requirement for written consent under the Privacy Act. CIC argued that it is reasonable and prudent for it to put the burden on all access requesters seeking personal information about others to provide a current, signed consent for the disclosure.

The commissioner concluded that CIC is under a duty, under both the Privacy Act and the Access to Information Act, to take all reasonable precautions to avoid unauthorized disclosure of personal information. Taking into account the fact that section 10 of the Privacy Regulations requires consents to be in writing, the commissioner concluded that it is reasonable for CIC to insist upon written consents before disclosing personal information to a third party under the Access to Information Act. Similarly, the commissioner concluded that it is reasonable for CIC to ask that consents be dated in order to ensure that consents are current and related to the information which is the subject of the request to which the consent relates.

Finally, the commissioner concluded that these requirements are no less reasonable when the requester is a lawyer. If Parliament had intended to give lawyers a special status in this regard, it could have done so, as it did for members of Parliament, in paragraph 8(2)(g) of the Privacy Act.

While the commissioner did not support the lawyer’s complaint on this ground, he did inform CIC that it had not answered the lawyer’s request properly. Since the lawyer had made a request under the Access to Information Act and paid the $5 fee, he had a right to an answer. It was simply not open to CIC to refuse to answer the request. During the investigation, CIC corrected its error by invoking paragraph 10(1)(b) to refuse to confirm or deny whether or not it held the requested information and indicating that, if such information did exist, it would be exempt from the right of access as personal information under subsection 19(1) of the Access to Information Act.

The lawyer provided written, dated consent from his client and obtained access to the information.

Lessons Learned

Anyone may make a request under the Access to Information Act for personal information about someone else. The receiving institution has an obligation to take reasonable steps to ensure that personal information is not disclosed to someone else without authorization. For this purpose, it is reasonable to ask for a signed and dated consent from the person who is the subject of the requested information.

If no written, dated consent is provided, it is not open to the receiving institution to refuse to process the request. Rather, the proper course is to refuse access based upon subsection 19(1) of the Act and to inform the requester that the institution could not disclose personal information without the signed and dated consent of the subject.