Complaint
We received a complaint alleging that the Public Body disclosed personal information without authority under the Access to Information and Protection of Privacy Act (ATIPPA).
When the Complainant participated in one of the public body’s proceedings, they were required to give their name and email address along with their comments about the utility’s application. A short time later, the Complainant received a notice from the Public Body advising them that their personal information and comments were now posted on the Public Body’s website as part of the proceedings.
The Complainant claimed they were never advised that their personal information would be disclosed in this manner and felt this might be a violation of the ATIPPA.
Investigation
We investigated whether the Public Body had disclosed the Complainant’s personal information as described, and if so, whether it had complied with the ATIPPA.
Decision
Non-compliant. We found that the Public Body has authority to collect, use, and disclose personal information under the ATIPPA when carrying out its duties under the Yukon Utilities Act. However, we also found that the Public Body had not provided the Complainant with proper notice as required by the ATIPPA.
When collecting personal information, public bodies must provide individuals with a notice that specifies the purpose for the collection, their legal authority to collect the personal information, and provide the contact information of someone at the public body who can answer questions about the collection. At the time of collection, it is also important to advise individuals how their personal information will be used and disclosed so that they can make informed decisions.
So, while the Public Body was authorized to disclose the personal information at issue, the lack of a collection notice meant there was a privacy breach.
Recommendations
Accepted. The Public Body accepted our recommendations to provide a collection notice to participants in all future proceedings and to ensure that personal information in its custody or control is adequately protected through administrative, technical, and physical safeguards.