02 June 2009

Lessons not learned, Part II: health department may have breached privacy law

Unless they’ve got written consent for the disclosure, the province’s health department violated several sections of the province’s Access to Information and Protection of Privacy Act.

A report by independent consultants on the location of a magnetic resonance imaging (MRI) device includes the home address and telephone number of one of the consultants as well as complete curricula vitae of the three consultants.

The original news release directed interested people to contact the department’s communications director for a copy of the report. The release issued Tuesday contained a link to the complete report, with the attached CVs.

The report was received on February 28 and released on June 2, in violation of a supposed government policy requiring reports to be released within 30 days of being received. 

Under section 30 of the Act, government must refuse to disclose personal information unless there is written consent. A similar provision is contained in section 39.

-srbp-

Sectional Update:  The ever eagle-eyed among you noticed that since this document wasn’t released under the access to information bit of the legislation, section 30 doesn’t apply.

Correct.

Section 39 does and that confusion is purely mine in the way the post was quickly written.

The act covers requests for information PLUS privacy protection.  The privacy part containing s. 39 covers what government may do with personal information.  One of the things is not release it without permission.

It all comes out to the same thing.

s.39 of the ATIPPA applies in this case.  Without permission, they weren’t suppose to publish personal information.