Complaint
An individual filed a complaint with our office because their name, place of residence, and details about their recent conviction under an Act was posted on social media by the Public Body. The complainant requested the Public Body remove or amend the post, but it declined.
Investigation
We learned that the Public Body thought it could disclose the complainant’s information because it is publicly available in the court registry. Upon review, we found that information held in a court registry is not “publicly available information” nor is it a “public registry” as defined under the ATIPPA. As such, the Public Body’s rationale for disclosing personal information was not compliant with the ATIPPA.
Decision
Noncompliant. The Public Body claimed that its mandate gave it authority to collect and use the personal information relating to the complainant’s conviction and fine. We acknowledged the Public Body likely had authority to collect and use the information, however, we remained unclear on its authority to disclose the personal information to social media.
Recommendations
Accepted. The Public Body agreed to remove all personal information from the social media post, as well as in similar earlier posts. If it resumes posting personal information about convictions online, it must undertake a review of this practice to ensure it is compliant with the ATIPPA including its authority to collect, use, and disclose personal information for this purpose, providing appropriate notice to individuals, and adherence to the limitation principles. The Public Body must also develop a policy with respect to posting information online that includes what information it is authorized to post and develop written procedures to reflect the policy.