You are on page 1of 15

InvestigationReportF2014IR01

InvestigationintoProjectOperationWarrantExecutionforcompliance withtheFreedomofInformationandProtectionofPrivacyAct

March17,2014
EdmontonPoliceService
InvestigationF6148

TableofContents
Introduction Background Issues 3 4 5

1. IstheinformationatissuepersonalinformationasdefinedintheFOIPAct? 5 2. DidtheEPScomplywithsection38oftheFOIPAct(reasonablesecurity arrangements)? 6 3. WastheEPSauthorizedundertheFOIPActtodisclosepersonalinformation aspartofProjectOWE? 8 4. DidtheEPSdisclosepersonalinformationonlytotheextentnecessary, incompliancewithsection40(4)oftheFOIPAct? 13 FindingsandRecommendations 14

Page|2

Introduction
[1] [2] [3] Stage2beganonApril2,2012.Inthisstage,theEPSpubliclydisclosedinformationidentifying individualswithoutstandingwarrants.ThemediasubsequentlyreportedthattheEPShad publishedinformationthatidentifiedayoungoffenderandthatthepublicationoftheyoung offendersidentitywithoutacourtorderwouldconstituteaviolationoftheYouthCriminalJustice Act(YCJA). TheYCJAisafederalstatutethatprohibitsthedisclosureofinformationaboutyoungoffenderswho areinvolvedinproceedingsundertheYCJA.AlbertasInformationandPrivacyCommissioner(the Commissioner)hasnojurisdictiontoinvestigatewhetheradisclosureofinformationisin contraventionoftheYCJA. TheEPS,however,isapublicbodysubjecttotheFreedomofInformationandProtectionof PrivacyAct(theFOIPActorAct).Undersection53(1)(a)oftheFOIPAct,theCommissionermay conductinvestigationstoensurecompliancewithanyprovisionofthisAct. OnApril4,2012,theCommissionerissuedanewsreleaseannouncingshehaddecidedtoconduct aninvestigationonherownmotionontheProjectOWEinitiative.TheCommissionersaid:
Thepurposeofthisinvestigationistomakesurethisinitiativeisbeingcarriedoutincompliancewith FOIP,andthatconsiderationhasbeengiventotheprotectionofpersonalinformation.

TheEdmontonPoliceService(EPS)launchedProjectOperationWarrantExecution(ProjectOWE)in March2012.ProjectOWEwasinitiallyimplementedintwostages. DuringStage1,whichranfromMarch531,2012,individualswereencouragedtocomeforward andaddresstheiroutstandingwarrants.

[4]

[5]

[6] [7]
Theinvestigationisnotfocusedonthedisclosureofinformationrelatingtoparticularindividuals, howeverifpeoplefeeltheirpersonalinformationwasreleasedunderthisinitiativeincontraventionof FOIP,theycanmakeacomplainttomyofficeandwewillinvestigate.

TheCommissioneralsosaid:

[8] [9] Page|3 obtainanunderstandingofthepurposeandintentoftheProjectOWEcampaign; examinethemanagementofpersonalinformationbytheEPSandthemeasurestakento protectpersonalinformationagainstriskssuchasunauthorizedaccess,collection,useand disclosure;and makerecommendations,ifnecessary,toensurethattheEPSmanagementofpersonal informationunderProjectOWEisinaccordancewiththeprovisionsoftheFOIPAct. TheCommissionerauthorizedmetoinvestigatethismatter.Theobjectivesoftheinvestigation wereto: OurOfficereceivednocomplaintsfromindividualsaboutthedisclosureoftheirinformationbythe EPSunderProjectOWE.

[10] MyinvestigationfoundthattheEPSdidnotmakereasonablesecurityarrangementstoprotect personalinformationasrequiredundersection38oftheFOIPActwhenitimplementedProject OWEin2012.MyinvestigationalsofoundthattheEPShadauthoritytodisclosesome,butnotall, ofthepersonalinformationinProjectOWE.IalsofoundthattheEPSdidnotlimittheextentof personalinformationdisclosedtowhatwasnecessarytocarryoutitspurposesinareasonable manner. [11] Basedonmyfindings,IrecommendthattheEPS: completeandsubmitaPrivacyImpactAssessment(PIA)toourOfficeforreviewpriorto undertakingProjectOWEagainoranynewinitiativeinvolvingthepublicdisclosureofpersonal information; establishapolicyforrequiringPIAswhendesigningmajorprojectsorinitiativesthatinvolvethe collection,useordisclosureofpersonalinformationpriortotheimplementationoftheproject; and developareviewandapprovalprocessthatincludestheEPSFOIPPCoordinator/FOIPPOfficein initiativesorprojectsthatinvolvethecollection,useordisclosureofpersonalinformation.

Background
[12] TheEPSfirstintroducedwarrantexecutioninitiativesintheearly1980s.1In2012,theEPSdecided toimplementProjectOWEaspartofitsViolenceReductionStrategytodealwiththelarge volumeofoutstandingwarrantsinEdmontonandtospecificallytargetthetop100(orso)highest offenders.2 [13] TheEPSsaidithadmorethan16,000outstandingwarrantsintheEdmontonarearangingfrom failurestoremovesnowtomoreseriousoffencessuchasassaults,robbery,andfirearmsoffences. TheEPSdeterminedProjectOWEwasthemostefficientandeffectivemeanstoaddressthelarge numberofoutstandingwarrants. [14] TheEPSsaidtheobjectivesofProjectOWEwereto: [15] DuringStage1ofProjectOWE,whichranfromMarch531,2012,theEPSpublishedinformationon itswebsiteandthroughothermediatoencourageindividualstocomeforwardandaddresstheir outstandingwarrantsbyApril2,2012,orriskthepossibilityofhavingtheirnamesandfaces advertisedpubliclyandpolicevisitingtheirhomeandworkplace.3TheEPSalsostated,people shoulddealwithoutstandingwarrantsbyApril2,2012.Ifpeopledonotcomeforwardtopoliceof holdindividualsaccountablefortheiroffencesandspecificallytargetthoseinvolvingviolence; informthosewithoutstandingwarrantsthatthepublicshelpwouldbeenlistedbyreleasing theirnamesandshowingtheirphotographs;and showthepublicthatthepoliceareremovingthemostdangerousoffendersoffthestreets.

1 2

TheFOIPActwasnotenactedintheearly1980s,andthereforedidnotapplytotheearlyoperationwarrantexecutioninitiatives. TheEPSestablishedtheViolenceReductionStrategyinresponsetothechallengeofaddressingviolentcrimeintheCityof Edmonton. 3 EdmontonPoliceService,copyright2012,WarrantsFrequentlyAskedQuestions,Retrievedon04/04/2012.From http://www.edmontonpolice.ca/News/Warrants/FAQ.aspx

Page|4

theirfreewill,theywillruntheriskofpublicembarrassment.TheEPSwillbeadvertisingthenames ofsomepeoplewhohaveoutstandingwarrantsinlocalnewspapers.4 [16] OnApril2,2012,theEPSimplementedStage2andbeganpublishingpersonalinformationof individualswithoutstandingwarrantsinvariouslocalnewspapersandontheEPSwebsite.For example: onApril2,2012intheEdmontonSun,theEPSpublishedanadvertisementwiththenamesand agesoffiveindividualsundertheheadingDOYOUKNOWTHESEPEOPLE?Aboveeach individualsnamewaseitheraphotographoftheindividualsface,orthewordSOLVED.The advertisementread,Thesepeoplehaveoutstandingcriminalwarrants.Ifyouhaveany informationregardingthewhereaboutsoftheseindividuals,orifoneofthemisYOU,contact yourlocalpolicedivisionorvisit ontheEPSwebsite,thenames,ages,photographs,heightsandweightsofseveralindividuals werepublishedunderthefollowingstatement:Thefollowingisalistofindividualswhohave yettoaddresstheiroutstandingwarrants.Stage1ofProjectOWEaffordedindividualsan opportunitytostepforwardanddealwiththeiroutstandingwarrants.Stage2,which commencedMonday,April2,2012,willseetheEdmontonPoliceServicestepupits enforcementeffortstolocatetheseindividuals,bothinpersonandbyadvertisingthephotos andnamesinvariouspublicationsandonline.5

[17] OnNovember15,2012,theEdmontonJournalreportedthattheEPSlaunchedasubsequentstage ofProjectOWEwhichfocusedonindividualswantedforseriousorviolentoffencesandserious trafficinfractions.6TheEPSsaidnopersonalinformationwaspublishedforthisstageofProject OWE. [18] TheEPSinformedouroffice:


TheaccessanddisclosureofthepersonalinformationforProjectOWEwasnecessaryandreasonable inordertoaddresstheapproximately16,000outstandingwarrants.Theprojectwasconcludedand deemedtobeanincrediblesuccesswithmorethan5,600warrantsbeingexecuted.Whetherornot thisprojectwillbedoneagainhasnotyetbeendecided.

Issues
1. IstheinformationatissuepersonalInformationasdefinedintheFOIPAct? [19] DuringvariousstagesofProjectOWE,theEPSdisclosedsomeorallofthefollowingpersonal informationofupto170individuals:name,age,photograph,height,weight,andthattheindividual hadanoutstandingwarrant.
4

EdmontonPoliceService,copyright2012,WarrantsFrequentlyAskedQuestions,Retrievedon04/04/2012.From http://www.edmontonpolice.ca/News/Warrants/FAQ.aspx 5 EdmontonPoliceService,copyright2012,Project:OperationWarrantExecution,ReducedCrimeandVictimizationCitizenCentered ServiceModelofEfficiencyandEffectiveness,Retrievedon04/04/2012.From http://www.edmontonpolice.ca/CrimeFiles/ProjectOWE.aspx 6 Pruden,JanaG.(Thursday,November15,2012).Blitztargetshundredsofwantedpeopleincity.Threearrestslaunchnewphaseof OperationWarrantExecution.TheEdmontonJournal,pg.A5.

Page|5

[20] TheFOIPActdefinespersonalinformationasrecordedinformationaboutanidentifiable individual.PersonalinformationundertheFOIPActincludesanindividualsname(section1(n)(i)), age(section1(n)(iii)),physicaldescription(OIPCOrderF2002001,p.107),photograph(OIPCOrder F2002001,p.10),andinformationabouttheindividualscriminalhistory(section1(n)(vii)). [21] IfindthattheinformationdisclosedbytheEPSunderProjectOWEispersonalinformationas definedintheFOIPAct. 2. DidtheEPScomplywithsection38oftheFOIPAct(reasonablesecurityarrangements)? [22] Section38oftheFOIPActstates:
38Theheadofapublicbodymustprotectpersonalinformationbymakingreasonablesecurity arrangementsagainstsuchrisksasunauthorizedaccess,collection,use,disclosureordestruction.

[23] Unauthorizedaccesstopersonalinformationincludes: [24] Unauthorizeddisclosuremeansdisclosingpersonalinformationinwaysotherthanthoseallowed undersection40oftheAct(OIPCOrder98002,p.198andInvestigationReportF2012IR01,p.28). MeasurestakenbytheEPStoprotectpersonalinformation [25] TheEPSdescribedtheprocessitundertooktoselectindividualsforProjectOWE.Thefollowingisa summaryofthisprocess: adownloadwasreceivedfromtheCanadianPoliceInformationCentre(CPIC)Operations Alberta/NWT. theEPSCPICWarrantUnit(CWU)sortedtherecordselectronicallytoidentifythecurrent outstandingwarrants.Oncesortedelectronically,amanualprocesswasundertakentoselect individualsforProjectOWE.TheCWUusedthefollowingcriteriatoidentifytheindividualsfor ProjectOWE:seriouscharges(assaults,robbery,firearmsoffences)withanEdmontonaddress intheEdmontonPoliceRecordsOccurrenceSystem(EPROS). oncetheindividualswereidentified,warrantswerecopiedandtheCPICOperatorsconducteda recentaddresscheckinEPROSastodeterminetheindividualswhereabouts.Anadditional namecheckwasthenrequiredthroughCPICtoensurethatthewarrantswerestilloutstanding. theCWUidentified170individualsforProjectOWEandforwardedwarrantinformation packagesfortheseindividualstotheProjectOWEteam.TheProjectOWEteamreviewedthe packagesanddeterminedwhichindividualswouldbepubliclyidentified. accessbythepublic,wherethereisnorighttoaccess; accessbyapublicbodysemployees,ifthoseemployeesdonotneedtoseethepersonal informationinthecourseoftheirduties(OIPCInvestigationReportF2003IR003,pp.3031); situationsinwhichinformationisstoredinanunsecuredmannersuchthatsomeonecanobtain unauthorizedaccess.8

7 8

OrdersandInvestigationReportsmentionedinthisinvestigationreportareavailableonourofficeswebsiteatwww.oipc.ab.ca. SeeOrders98002,p.136andF2009048,p.92).

Page|6

[26] Aspartofmyinvestigation,theEPSprovidedmewithcopiesoftheirpoliciesandproceduresthat dealgenerallywiththeprotectionofpersonalinformationandcompliancewiththeFOIPAct.These policiesandproceduresaddress(amongotherthings):accesscontrols;securityofinformation, systems,networks,andbuildings;CPICinformation;disposalofinformation;destructionofreports; audits;accessrequests;FOIPrequests;releaseofinformation;accountabilityandcompliance requirements.Inmyview,theEPSgeneralpoliciesandproceduressupportoverallprivacy management. [27] Frommyreviewofthesepoliciesandprocedures,however,Inoted,andtheEPSconfirmed,thatit doesnothaveaspecificpolicythatidentifieswhenaprivacyimpactassessment(PIA)isrequired.A PIAprocessisaduediligenceexerciseinwhichapublicbodyidentifiesandaddressespotential privacyrisksthatmayoccurinthecourseoftheproject.APIAisnotmandatoryundertheFOIPAct, butourOfficehasconsistentlyrecommendedthatPIAsbecompletedformajorprojectsthatinvolve thecollection,useordisclosureofpersonalinformation.9 [28] TheOfficeofthePrivacyCommissionerofCanada,andtheOfficesoftheInformationandPrivacy CommissionersofAlbertaandforBritishColumbiahavepublishedGettingAccountabilityRightwith aPrivacyManagementProgramtoprovideconsistentguidanceforprivatesectororganizationson thekeycomponentsofaprivacymanagementprogram.Thisguidanceisalsorelevantforpublic bodies.ThefollowingexcerptisparticularlyrelevanttotheEPS:
Wehaveseeninstancesoforganizationsofferingnewservicesthatcollect,useordisclosepersonal informationthathavenotbeenthoroughlyvettedfromaprivacyperspective.Properuseofrisk assessmenttoolscanhelppreventproblems.Fixingaprivacyproblemafterthefactcanbecostlyso carefulconsiderationofthepurposesforaparticularinitiative,productorservice,andanassessment thatminimizesanyprivacyimpactsbeforehandisvital. Asaresultsuchassessmentsshouldberequiredthroughouttheorganizationforallnewprojects involvingpersonalinformationandonanynewcollection,useordisclosureofpersonalinformation. Organizationsshoulddevelopaprocessforidentifyingandmitigatingprivacyandsecurityrisks, includingtheuseofprivacyimpactassessmentsandsecuritythreatriskassessments. Organizationsshoulddevelopproceduresforconductingsuchassessments,anddevelopareviewand approvalprocessthatinvolvesthePrivacyOfficer/Officewhendesigningnewinitiatives,servicesor programs.Forlargerorganizations,thePrivacyOfficershouldbeawareofthereviewprocess,and wheretherearehighriskinitiatives,servicesorprograms,thePrivacyOfficeshouldbedirectly involved.10

[29] InreviewingtheprocessundertakentodesignandimplementProjectOWE,Ifindlittleorno assessmentwasmadebytheEPSastotheirobligationstoprotectpersonalinformationasrequired undersection38oftheFOIPAct.Ifoundnothingtodemonstratethatpriortoimplementationthere wasanassessmentofthelegalauthorityandpurposesforeachelementofpersonalinformationto bedisclosedundertheinitiative.Inaddition,Ifoundnothingtodemonstrateconsultationwith,or involvementof,theEPSFOIPPCoordinator/FOIPPOfficepriortotheimplementationofProject OWEorthepublicdisclosureofpersonalinformation.

10

http://www.oipc.ab.ca/pages/PIAs/Description.aspx OfficeofthePrivacyCommissionerofCanadaandOfficesoftheInformationandPrivacyCommissionersofAlbertaandBritish Columbia.GettingAccountabilityRightwithaPrivacyManagementProgram.April2012.Page12.Retrievedfrom http://www.oipc.ab.ca/Content_Files/Files/Publications/Accountability_Doc_April_2012.pdf

Page|7

[30] Furthermore,theEPSalsodisclosedthename(firstandsurname)andageofindividualswhono longerhadoutstandingwarrants.Informationabouttheseindividualswaspubliclypublishedunder thewordSolved. [31] IwasinformedbytheEPSthatthereleaseoftheseindividualsnamesunderthewordSolvedon April2,2012wasnotthepreferredapproachand:


Therecommendationforanysimilarprojectsinthefuturewillbetonotreleasepersonalinformation ofindividualsunlessthereisanoutstandingwarrantorotherlawenforcementreasonforthe disclosure.

[32] TheEPSresponsereinforcesmyviewthattheEPSdidnotconductanassessmentofthelegal authorityandpurposesforeachelementofpersonalinformationdisclosedunderProjectOWEprior tothepublicdisclosures. [33] Asaresult,IfindthattheEPSdidnotfulfillitsobligationundersection38oftheFOIPActtomake reasonablesecurityarrangementstoprotectpersonalinformationwhenitimplementedProject OWE. 3. WastheEPSauthorizedundertheFOIPActtodisclosepersonalinformationaspartofProjectOWE? [34] Asnotedabove,duringthetwostagesofProjectOWE,theEPSdisclosedallorsomeofthe followingpersonalinformationofupto170individuals:name,age,photograph,height,weight,and thattheindividualhadanoutstandingwarrant. [35] TheEPSsaiditdisclosedthepersonalinformationforthepurposeofenlistingthepublicsassistance inaddressingoutstandingwarrants. [36] TheEPSstatesthedisclosureofpersonalinformationforProjectOWEwasauthorizedbythe followingprovisionsoftheFOIPAct:40(1)(b),40(1)(c),40(1)(e),40(1)(k)(i)and40(1)(ee).Ireviewed theapplicationofeachoftheseprovisionsidentifiedbytheEPS. Section40(1)(b)(disclosurenotanunreasonableinvasionofpersonalprivacy) [37] Section40(1)(b)states:
40(1)Apublicbodymaydisclosepersonalinformationonly (b) ifthedisclosurewouldnotbeanunreasonableinvasionofathirdpartyspersonalprivacyunder section17,

[38] Undersection40(1)(b),apublicbodymaydisclosepersonalinformationifthedisclosurewouldnot beanunreasonableinvasionofathirdpartyspersonalprivacyundersection17oftheAct.In determiningwhetheradisclosureofpersonalinformationwouldbeanunreasonableinvasionofa thirdpartysprivacy,apublicbodymustconsidersections17(2),17(4)and17(5)oftheFOIPAct.

Page|8

Section17(2)(disclosurenotanunreasonableinvasionofprivacy) [39] Section17(2)oftheActliststhecircumstancesinwhichthedisclosureofpersonalinformationisnot anunreasonableinvasionofathirdpartysprivacy.Ireviewedsection17(2)andfindthatnoneof theprovisionsundersection17(2)applytothedisclosureofpersonalinformationunderProject OWE. Section17(4)(disclosurepresumedtobeanunreasonableinvasionofprivacy) [40] Section17(4)oftheActliststhecircumstancesinwhichthedisclosureofpersonalinformationis presumedtobeanunreasonableinvasionofprivacy.Ifthedisclosureofpersonalinformationis presumedtobeanunreasonableinvasionofprivacy,thepublicbodymustthenconsiderandweigh allrelevantcircumstancesasrequiredundersection17(5)todeterminewhetheradisclosureisan unreasonableinvasionofathirdpartysprivacy. [41] Ifindthatsections17(4)(b)and17(4)(g)(i)arerelevant.Thesesectionsreadasfollows:
17(4)Adisclosureofpersonalinformationispresumedtobeanunreasonableinvasionofathirdpartys personalprivacyif (b) thepersonalinformationisanidentifiablepartofalawenforcementrecord,excepttotheextent thatthedisclosureisnecessarytodisposeofthelawenforcementmatterortocontinuean investigation (g) thepersonalinformationconsistsofthethirdpartysnamewhen (i) itappearswithotherpersonalinformationaboutthethirdparty

[39] Undersection17(4)(b),adisclosureofpersonalinformationispresumedtobeanunreasonable invasionofathirdpartysprivacyifthepersonalinformationisanidentifiablepartofalaw enforcementrecord,exceptifthedisclosureisnecessarytodisposeofthelawenforcementmatter ortocontinueaninvestigation. [40] Onthisissue,theEPSstated:


thedisclosurewasnotanunreasonableinvasionofpersonalprivacy.Warrantsarejudicial authorizationstoarrestpeopletobringthembeforethecriminaljusticesystem.Individualsinthese circumstancesdonothaveareasonableexpectationofprivacyinordertoevadearrest.TheFOIPPAct isnotintendedtoaidfugitivesfromthejusticesystem

[41] InthecaseofProjectOWE,theEPSdisclosedthatcertainindividualshadoutstandingwarrants;I agreewiththeEPSthatthisinformationisanidentifiablepartofalawenforcementrecordand thataddressingoutstandingwarrantsispartofdispos[ing]ofthelawenforcementmatter. However,underthisprovision,thedisclosuremustbenecessary.EPSprovidednoinformationto demonstratethatthedisclosurewasnecessary.Therefore,thepresumptionofanunreasonable invasionofprivacydoesapplytodisclosuresofpersonalinformationforindividualswith outstandingwarrants. [42] Inaddition,thepresumptionofanunreasonableinvasionofprivacyalsoappliestodisclosuresof personalinformationofthoseindividualswhonolongerhadoutstandingwarrants. Page|9

Section17(4)(g)(i)(disclosureofanindividualsnameinconjunctionwithotherpersonalinformation) [43] Section17(4)(g)(i)oftheFOIPActstatesthatadisclosureofpersonalinformationispresumedtobe anunreasonableinvasionofathirdpartysprivacyifthedisclosureconsistsoftheindividualsname whenitappearswithotherpersonalinformationabouttheindividual. [44] Asnotedabove,duringthetwostagesofProjectOWE,theEPSdisclosedallorsomeofthe followingpersonalinformationofupto170individuals:name,age,photograph,height,weight,and thattheindividualhadanoutstandingwarrant.Ithereforefindthedisclosureofthepersonal informationispresumedtobeanunreasonableinvasionofprivacypursuanttosection17(4)(g)(i). Section17(5)(requirementtoconsiderallrelevantcircumstances) [45] InOrderF2007028,formerCommissionerFrankWorksaid:
[para15]Wheninformationfallsunderoneoftheprovisionsinsection17(4)oftheAct,disclosureof thepersonalinformationispresumedtobeanunreasonableinvasionofathirdpartyspersonal privacyHowever,asnotedabove,section17(4)createsapresumptiononly.APublicBodymustthen considerthefactorsundersection17(5),asthesefactorsmayoutweighapresumption

[46] Section17(5)states:
17(5)Indeterminingundersubsections(1)and(4)whetheradisclosureofpersonalinformation constitutesanunreasonableinvasionofathirdpartyspersonalprivacy,theheadofapublicbodymust consideralltherelevantcircumstances,includingwhether (a) thedisclosureisdesirableforthepurposeofsubjectingtheactivitiesoftheGovernmentofAlberta orapublicbodytopublicscrutiny, (b) thedisclosureislikelytopromotepublichealthandsafetyortheprotectionoftheenvironment, (c) thepersonalinformationisrelevanttoafairdeterminationoftheapplicantsrights, (d) thedisclosurewillassistinresearchingorvalidatingtheclaims,disputesorgrievancesofaboriginal people, (e) thethirdpartywillbeexposedunfairlytofinancialorotherharm, (f) thepersonalinformationhasbeensuppliedinconfidence, (g) thepersonalinformationislikelytobeinaccurateorunreliable, (h) thedisclosuremayunfairlydamagethereputationofanypersonreferredtointherecord requestedbytheapplicant,and (i) thepersonalinformationwasoriginallyprovidedbytheapplicant.[myemphasis]

[47] Section17(5)setsoutanonexhaustivelistofcircumstances.Someofthecircumstancesweighin favorofdisclosureandsomeweighagainstdisclosure.Section17(5)mayrebutsomeofthe presumptionsthatariseundersection17(4)oftheAct. Page|10

[48] WithrespecttotherelevantcircumstancesconsideredbytheEPSindecidingtodisclosepersonal informationthroughProjectOWE,theEPSsaid[i]ndividualsinthesecircumstancesdonothavea reasonableexpectationofprivacyinordertoevadearrest.Inmyopinion,thisisabroadstatement thatprovidesnoinformationastowhatrelevantcircumstancestheEPSconsideredasrequired undersection17(5). [49] IfindthattheEPScouldnotrelyonsection40(1)(b)sincetheEPShasnotdemonstratedhowthe disclosureswouldnotbeanunreasonableinvasionofprivacy. Section40(1)(c)(disclosureforthepurposeforwhichinformationwascollectedoraconsistentuse) [50] Section40(1)(c)oftheActpermitspublicbodiestodisclosepersonalinformationforthepurpose forwhichtheinformationwascollectedorcompiledorforauseconsistentwiththatpurpose.The sectionreadsasfollows:
40(1)Apublicbodymaydisclosepersonalinformationonly (c) forthepurposeforwhichtheinformationwascollectedorcompiledorforauseconsistentwith thatpurpose,

[51] TheEPSsaidthedisclosureisauthorizedbysection40(1)(c)because:
theinformationobtainedthroughCPICwascollectedforalawenforcementpurpose.Usingthat informationforthelawenforcementpurposeofexecutingwarrantsisconsistentwiththatpurpose.

[52] TheEPSissayingsection40(1)(c)appliessincetheinformationwascollectedforlawenforcement purposesandthedisclosuresthroughProjectOWEwerealsoforlawenforcementpurposes. [53] Ifindthatthedisclosureofpersonalinformationinordertoexecutewarrantsisforthepurposefor whichtheinformationwascollected.Assuch,section40(1)(c)authorizedthedisclosureofpersonal informationofindividualswithoutstandingwarrants.However,section40(1)(c)didnotauthorize thedisclosureofpersonalinformationofindividualswhonolongerhadoutstandingwarrants. Section40(1)(e)(disclosuretocomplywithanenactment) [54] Section40(1)(e)oftheActallowsapublicbodytodisclosepersonalinformationforthepurposeof complyingwithanenactmentofAlbertaorCanada.
40(1)Apublicbodymaydisclosepersonalinformationonly (e) forthepurposeofcomplyingwithanenactmentofAlbertaorCanadaorwithatreaty,arrangement oragreementmadeunderanenactmentofAlbertaorCanada,

[55] TheEPSstatesthedisclosuresunderProjectOWEwereforthepurposeofcomplyingwithsection 38ofthePoliceAct.Section38ofthePoliceActreads:


38(1)Everypoliceofficerisapeaceofficerandhastheauthority,responsibilityandduty (a) toperformalldutiesthatarenecessary (i) tocarryoutthepoliceofficersfunctionsasapeaceofficer,

Page|11

(ii) toencourageandassistthecommunityinpreventingcrime, (iii) toencourageandfosteracooperativerelationshipbetweenthepoliceserviceandthe membersofthecommunity,and (iv) toapprehendpersonswhomaylawfullybetakenintocustody, and (b) toexecuteallwarrantsandperformallrelateddutiesandservices. (2)ApoliceofficerhasjurisdictionthroughoutAlberta

[56] Iagreethatsection38ofthePoliceActplacesadutyoneverypoliceofficertoexecutewarrants. However,IcouldnotfindadirectrelationshipbetweencomplyingwiththePoliceActanddisclosing theindividualsinformationtothepublic.Inotherwords,thedisclosurescannotbesaidtobefor thepurposeofcomplyingwiththePoliceAct,becausesection38ofthePoliceActdoesnotrequire theEPStopubliclydiscloseinformationthroughProjectOWE. [57] Assuch,Ifindthatsection40(1)(e)didnotauthorizetheEPSdisclosureofpersonalinformation throughProjectOWE. Section40(1)(k)(i)(disclosuretocollectafineordebt)
40(1)Apublicbodymaydisclosepersonalinformationonly (k) forthepurposeof (i) collectingafineordebtowingbyanindividualtotheGovernmentofAlbertaortoapublicbody, ortoanassigneeofeitherofthem,

[58] Undersection40(1)(k)(i),apublicbodymaydisclosepersonalinformationforthepurposeof collectingafineordebtowingbyanindividualtotheGovernmentofAlbertaorapublicbody,orto anassigneeofeitherofthem. [59] TheEPSsaidsection40(1)(k)(i)wouldpermitthedisclosurebecause,somewarrantshaveafine associatedtothemandwarrantexecutionresultsincollectingthosefines. [60] Inmyview,thedisclosuresforthepurposeofcollectingafinemayhavemeritforindividualswith outstandingwarrants.However,theEPSsaidsomewarrantshavefinesassociatedtothem;in otherwords,notallindividualswhoseinformationwasdisclosedhadfinesordebtsowing.TheEPS didnotconfirmwhetherallindividualswhoseinformationwasdisclosedhadfinesordebtsowing. Furthermore,section40(1)(k)(i)wouldnotauthorizedisclosuresofpersonalinformationwherethe individualsnolongerhadoutstandingwarrants. [61] Ifindthatsection40(1)(k)(i)oftheFOIPActauthorizedthedisclosureofpersonalinformationfor thoseindividualswithoutstandingwarrantsthathadfinesassociatedwiththem. Section40(1)(ee)(disclosuretoavertorminimizeharmorimminentdanger) [62] Atthetimeofthedisclosuresin2012,section40(1)(ee)read: Page|12

40(1)Apublicbodymaydisclosepersonalinformationonly (ee) iftheheadofthepublicbodybelieves,onreasonablegrounds,thatthedisclosurewillavertor minimizeanimminentdangertothehealthorsafetyofanyperson,

[63] Forsection40(1)(ee)toauthorizethedisclosureofpersonalinformation,thefollowing requirementsmustbemet:theheadofthepublicbodymustbelieve,onreasonablegrounds,that thereisanimminentdangertosomeone,andthatthedisclosurewillavertorminimizethatdanger. [64] InOrderF201201,theAdjudicatorsaid:


[para39]inorderforsection40(1)(ee)oftheActtoapplyinagivencase,theheadofapublicbody mustbelieve,onreasonablegrounds,thatadangerorrisktothephysicalorpsychologicalhealthor safetyofothersispresent,orwillbepresentintherelativelynearfutureimminentisarelative term [para40]Finally,forapublicbodytohavetheauthoritytodisclosepersonalinformationundersection 40(1)(ee)oftheAct,itsheadmustbelieve,onreasonablegrounds,thatthedisclosurewillavertor minimizeanimminentdangertothehealthorsafetyofanyperson.Inotherwords,thedisclosureto theparticularpersonorbodymustservethepurposeofavertingorminimizingtheimminentdanger. Theremustbealinkbetweendisclosingthepersonalinformationandavertingorminimizingthe danger

[65] Consequently,theEPSneededtodemonstratehowtheindividualswhoseinformationwasdisclosed presentedanimminentdangertothehealthorsafetyofsomeoneelseandhowthedisclosureof theseindividualsinformationwouldavertorminimizethedanger.Thegeneralstatementbythe EPSthatviolentoffendersevadingthejusticesystemposes(sic)dangertothesafetyofthecitizens oftheCityofEdmontonandProjectOWEminimizedsomeofthosedangersdoesnotmeetthe requirementofsection40(1)(ee)oftheAct. [66] Furthermore,asnotedearlierinthisreport,theEdmontonJournalreportedonNovember15,2012 thattheEPSlaunchedasubsequentstageofProjectOWEwhichfocusedonindividualswantedfor seriousorviolentoffencesandserioustrafficinfractions.However,theEPSdidnotpubliclyrelease theseindividualspersonalinformation.IftheEPSdidnotrelyonsection40(1)(ee)todisclosethe personalinformationofindividualswantedforseriousorviolentoffencesandserioustraffic infractionsthenitisunclearhowtheEPScouldrelyonsection40(1)(ee)forthedisclosuresinApril 2012. [67] Assuch,Ifindsection40(1)(ee)didnotauthorizethedisclosureofpersonalinformationforthe purposeofProjectOWE. 4. DidtheEPSdisclosepersonalinformationonlytotheextentnecessary,incompliancewithsection40(4) oftheFOIPAct?
40(4)Apublicbodymaydisclosepersonalinformationonlytotheextentnecessarytoenablethepublic bodytocarryoutthepurposesdescribedinsubsections(1),(2)and(3)inareasonablemanner.

[68] Section40(4)requiresthatapublicbodydisclosepersonalinformationonlytotheextentnecessary tocarryoutanauthorizedpurposeinareasonablemanner. Page|13

[69] Isaidearlierthat,inmyview,section40(1)(c)oftheFOIPActauthorizedtheEPStodisclose personalinformationaboutindividualswithoutstandingwarrantsandsection40(1)(k)(i)authorized theEPStodisclosepersonalinformationaboutindividualsthathadfinesassociatedwiththeir outstandingwarrants.However,undersection40(4),theEPSmustensureitlimitsthedisclosureof personalinformationtotheextentnecessarytocarryoutthepurposesinareasonablemanner. [70] InreviewingthevariousstagesofProjectOWE,Inotedthattheextentofpersonalinformation disclosedwasinconsistent.Forexample,thepersonalinformationthatappearedinnewspaper advertisementsincludedname,ageandphotograph.InformationthatwasdisclosedontheEPS websiteincludedname,age,photographandalsoheightandweight.Nopersonalinformationwas disclosedduringthethirdstageofProjectOWEthatwaslaunchedinNovember2012,andwhich targetedindividualswantedforseriousorviolentoffencesandserioustrafficinfractions. [71] TheEPSdidnotprovideanyexplanationforwhythedisclosureofspecificpersonalinformation elementswasnecessary.Furthermore,theinconsistencyinpersonalinformationdisclosuresat variousstagesofProjectOWEindicatesthattheEPSdidnotlimititsdisclosureofpersonal informationtotheextentnecessarytoenableittocarryoutitspurposesinareasonablemanner, therebycontraveningsection40(4)oftheAct.

FindingsandRecommendations
[72] Thefindingsfrommyinvestigationareasfollows: theEPSdidnotfulfillitsobligationundersection38oftheFOIPActtomakereasonablesecurity arrangementstoprotectpersonalinformationwhenitimplementedProjectOWE. section40(1)(c)authorizedtheEPStodisclosepersonalinformationforthoseindividualswho hadoutstandingwarrants. section40(1)(k)(i)oftheFOIPActauthorizedtheEPStodisclosepersonalinformationforthose individualswithoutstandingwarrantsthathadfinesassociatedwiththem. eventhoughauthorizedtodisclosesomepersonalinformationofindividualswithoutstanding warrants,theEPSdidnotlimititsdisclosureofpersonalinformationtotheextentnecessaryto enableittocarryoutitspurposesinareasonablemanner,therebycontraveningsection40(4) oftheAct. theEPSdisclosedpersonalinformationincontraventionofsection40(1)oftheFOIPActwhenit disclosedpersonalinformationofindividualswhonolongerhadoutstandingwarrants.

[73] Basedonmyfindings,IrecommendthattheEPS: completeandsubmitaPIAtoourOfficepriortoundertakingProjectOWEagainoranynew initiativeinvolvingthepublicdisclosureofpersonalinformation.Amongotherthings,thePIA shouldincludethelegalauthorityandpurposesforeachelementofpersonalinformationtobe disclosedfortheproject,andshouldidentifytheprivacyrisksandmitigationmeasuresforthe project.IsuggestthattheEPSrefertothisofficespublication,PrivacyImpactAssessment RequirementsasaguidelinetowritethePIA. 11

11

OfficeoftheInformationandPrivacyCommissionerofAlberta.PrivacyImpactAssessmentRequirements.Retrievedfrom http://www.oipc.ab.ca/Content_Files/Files/PIAs/PIA_Requirements_2010.pdf

Page|14

establishapolicyforrequiringprivacyimpactassessmentswhendesigningmajorprojectsor initiativesthatinvolvethecollection,useordisclosureofpersonalinformationpriortothe implementationoftheproject. developareviewandapprovalprocessthatincludestheEPSFOIPPCoordinator/FOIPPOfficeon initiativesorprojectsthatinvolvesthecollection,useordisclosureofpersonalinformation.

[74] UpontheEPSacceptanceoftheserecommendations,IbelievetheriskstoprivacyforProjectOWE andothersimilarprojectsandinitiativeswillbeaddressed. VeronicaChodak SeniorInformationandPrivacyManager

Page|15