Power to the Privacy Commissioner?

Among the many unknowns about life under Nova Scotia’s new majority Progressive Conservative government is the fate of our access to information system. While it seems unlikely things could get any worse, there is no guarantee they will get better.

Tricia Ralph

Tricia Ralph (CBC photo)

But even as I write, the CBC’s Michael Gorman is reporting that Premier-designate Tim Houston is “poised” to “give Nova Scotia’s privacy officer order-making power,” to which I can only say, “Big if true.”

Nova Scotia is the only province in the country where the privacy commissioner, currently Tricia Ralph, is not an independent officer of the legislature, nor does she have the power to enforce her rulings.

I will admit to harboring a hope that Houston, himself once forced to take the government to court to access information about the Yarmouth ferry, might actually do something about the system if given the chance and it seems he might. He told Gorman:

I know that there’s lots of Nova Scotians that have put in legitimate information requests that have got a lot of pushback, a lot of hurdles.

We’re going to work with the privacy commissioner to make sure that the proper authority is there so that Nova Scotians have access to the information that they rightly should have access to.

Moreover, a review of the province’s freedom of information system, launched by Premier Iain Rankin, will be allowed to continue.

 

Houston v. Nova Scotia

In fact, Tim Houston’s court case receives top billing in this year’s annual report from Ralph, who dedicates a page to “Houston v. Nova Scotia (Minister of Transportation and Infrastructure Renewal).”

As opposition leader, you may recall, Houston wanted to know the management fee being paid by the government to Bay Ferries Limited, the company that operates the Yarmouth ferry, but, as Ralph explains:

The public body refused to disclose the management fee, relying on s. 17 and s. 21 of FOIPOP. Section 17 gives a public body the discretion to refuse to disclose information if doing so could harm the financial or economic interests of a public body or the Government of Nova Scotia. Section 21 requires a public body to refuse to disclose confidential information of a third party.

Houston asked the commissioner to review the TIR’s decision and she recommended the ministry disclose the management fee but as she can make only recommendations — not binding orders — the TIR ignored her ruling. In such cases, applicants have but one recourse: appeal the decision to the Supreme Court of Nova Scotia. Ralph notes it’s “rare” that applicants do so, but Houston  did and the court, although it decided the issues “afresh and independently of the Commissioner’s review report,” reached the same conclusion as the commissioner:

The Court found there was no evidence that the management fee was supplied in confidence and found that the evidence submitted amounted to just the mere possibility of harm. As a result, the criteria required to apply s. 17 or s. 21 were not met and the Court ordered the release of the management fee.

I would like to note here that in 2020-21, public bodies and health custodians accepted just 37.5% of the Commissioner’s recommendations — that’s down from 41% in 2019/20 and well short of the office’s 65% goal for 2020/21. I can only imagine how many of those bodies might have been forced to release the requested information had the applicants had the wherewithal to file “an often costly” court appeal. As Ralph notes:

The fact that public bodies and health custodians are not required to comply with the Commissioner’s recommendations is a significant weakness in our access to information laws…

It is long past time that Nova Scotia catches up with other jurisdictions and provides the Commissioner with the ability to make orders or provides for a hybrid model (like in Newfoundland and Labrador).

 

Informal resolutions

Ralph says her office saw an 18% increase over the previous year in the number of files and complaints they opened in 2020/21 and an 8% increase in their backlog — as of 31 March 2021, the OIPC had 314 review files and 8 privacy complaint files waiting to be assigned to an investigator. (The office is still in the process of resolving some cases opened in 2017.) On the bright side, starting in 2021/2022, the office will be allocated three new positions for a two-year term, which Ralph expects will help them reduce the backlog.

Also on the bright side, the OIPC was able to resolve 91% of reviews informally in 2020/21, up from 75% in 2019/20. The report clarifies that the “informally resolved” category includes “[m]ediation, informal resolution, screened and withdrawn cases” and specifies that:

In 2020/2021, 106 of 117 FOIPOP, MGA and PHIA reviews were resolved informally. 53/60 (88%) government department appeal files were resolved informally and other public
bodies resolved 53/57 (93%) informally.

And while the backlog highlights the lack of resources devoted to the OIPC, it also highlights the steadily increasing use of the system since 2013 — overall utilization is up 539% in seven years:

OIPC Utilization 2013-2021

Source: NS OIPC Annual Report 2020/21

As the report explains:

Requests from public bodies, municipalities and health custodians for consultations, time extensions, late transfer approvals and training, as well as notifications of privacy breaches and other statutory notifications, increased 1299% since 2013. Utilization by the public for the independent review of public body, municipality and health custodian decisions on access to information and privacy matters increased 101% since 2013. Overall, the use of OIPC services has increased more than 539% since 2013. The increased utilization of the OIPC shows no sign of abating.

The report says the OIPC opened 584 new files in 2020/21, including 221 reviews and complaints and 363 files initiated by public bodies, municipalities and health custodians.

 

Privacy breaches

My obsession with FOIPOP being what it is, I don’t always pay enough attention to the privacy protection aspect of the commissioner’s job, but the report explains that in 2019/2020, the OIPC introduced a new measure to track the number of privacy complaints received and set a goal of reducing that number by 20%. Instead, the office saw a 15% increase in the number of privacy complaints it received:

This is a disappointing outcome. On the one hand, it could reflect that more affected individuals are being notified that their privacy has been breached, which is a positive step forward. On the other hand, it nevertheless shows an increase in the number of privacy complaints.

The report also records 755 breaches of personal health information under the PHIA — these are breaches where “the custodian has determined there is no potential for harm or embarrassment to the individual” nor has it notified the individual (section 70 of the Act says notification of the individual in such circumstances is not necessary.)

The commissioner says the office’s chief method for improving the protection of privacy among public bodies and health custodians is to “provide training and information so that those tasked with ensuring compliance with privacy laws understand the rules.”

 

BTW

My 2015 FOIPOP to the CBRM would be included in this year’s statistics, as the review report came down in November 2020. The CBRM tasked Jim Gogan, the lawyer who had handled my initial request, with handling the municipality’s response to the commissioner’s report and he sent me a letter that did not comply with the relevant legislation in two respects: it didn’t inform me of my right to appeal their response to the Supreme Court and it didn’t say whether the municipality was accepting or rejecting the commissioner’s four recommendations. As a result, the CBRM was deemed to have rejected the commissioner’s recommendations.

Which means, according to the OIPC annual report, that my review report was one of nine issued between 1 April 2020 and 31 March 2021. Ralph made a total of 24 recommendations across all nine reports, nine of which were accepted, 15 of which (including the four made to CBRM) were deemed rejected.

Ultimately, though, the municipality did release most of the information to me and it did so without charging me. On the other hand, it didn’t follow the commissioner’s recommendation to conduct a proper search and provide me with documents the commissioner determined were missing from the release package. A situation far less likely to happen, in future, if Houston makes good on his promise to give the commissioner order-making power.