Protection of personal information and privacy safeguards policy

Protection of personal information and privacy safeguards policy:
The Toronto Police Service racial profiling and racial discrimination inquiry

November 6, 2017

Introduction

1. The Ontario Human Rights Commission (OHRC) recognizes the importance of protection of personal information.
2. To protect human dignity and maintain public trust and confidence in the OHRC as an institution, the OHRC works hard to comply with all relevant laws that relate to the handling of personal information.
3.  As a provincial public institution, the OHRC must abide by the Freedom of Information and Protection of Privacy Act (FIPPA).^[1]
4. The head of the OHRC, the Chief Commissioner, has a duty to take objectively reasonable steps and measures to:

• Ensure the preservation of records in the OHRC’s custody and control;
• Ensure the security of original records; and
• Protect records from inadvertent destruction or damage, “taking into account the nature of the records to be protected”.^[2]

5.  OHRC staff have a duty to exercise due diligence in ensuring that personal information is protected.

The Toronto Police Service racial profiling and racial discrimination inquiry

6. Using its inquiry powers under s. 31 of the Ontario Human Rights Code (the “Code”), the OHRC has commenced an inquiry (the “TPS Inquiry”) in to the potential racial profiling of, and racial discrimination against, Black persons.
7. In connection with the TPS Inquiry, the OHRC has requested documents and information from the Toronto Police Service (TPS), the Toronto Police Service Board (TPSB) and the Special Investigations Unit (SIU).  The information requested may include “personal information” within the definition of FIPPA.  Because the information requested relates to interactions with police, it may also be of a sensitive nature.

Privacy Safeguards

8. The more sensitive the personal information collected, the more stringent the security measures adopted must be in order to mitigate the risk of a privacy breach.^[3]
9. The purpose of this policy is:
   
   1. To identify and explain the privacy safeguards that the OHRC has and/or will have in place in relation to the TPS Inquiry;
   2. To clarify the roles and responsibilities of OHRC staff involved in the TPS Inquiry; and
   3. To demonstrate that the potential privacy implications of the TPS Inquiry have been considered.

I. Administrative Safeguards

a. Data Minimization

10. The first step to protecting the privacy of personal information is to minimize to the extent possible, the personal information that comes into the custody of the OHRC.
11. In securing compliance with the OHRC’s document requests, the OHRC will collaborate with the TPS, TPSB and SIU to ensure that personal, identifying information collected by the OHRC is minimized.
12. If the OHRC is provided with access to personal information, it will at the earliest possible stage, adopt measures to minimize the collection of personal, identifying information.  This can be achieved by the use of templates that do not include an individual’s name or other personal information that would identify them, and by anonymizing the data obtained.
13. The OHRC does not intend to disclose personal information obtained from the TPS, TPSB or SIU through the TPS Inquiry.  The OHRC’s report relating to the TPS Inquiry will not contain personal information that identifies any particular individual. 
14. The OHRC will destroy any personal information as soon as reasonably possible after it is no longer required.

b. Consent

15. Before the OHRC has access to personal information from the TPS, TPSB and SIU, the OHRC will provide notice of collection of personal information on its website.  Individuals who believe that their personal information may be affected will be able to contact the OHRC.  They may also contact the Information and Privacy Commissioner.
16. The OHRC may also obtain personal information through interviews with voluntary participants.  Before conducting an interview, the individual’s consent will be obtained.  To the extent possible, information contained in the inquiry report will be aggregated and/or anonymized.  However, if it is possible that a particular individual could be identified, the individual’s informed consent will be obtained before any personal information is disclosed.

c. Authorized Personnel

17. Access to any personal information obtained through the TPS Inquiry is strictly limited to OHRC staff who are on the Inquiry Team.
18. The Privacy Lead will keep a list of individuals on the Inquiry Team.  No OHRC staff other than the Inquiry Team will have access to personal information.  Inquiry Team members may be added or changed as needed. 

d. Responsibilities of the TPS Inquiry Team

19. The Inquiry Team must comply with all privacy safeguards set out in this Policy.
20. The Inquiry Team must exercise reasonable judgment when handling personal information, depending on the sensitivity of the data, nature of the information and use.
21. The Inquiry Team, as part of exercising privacy due diligence, should identify and address potential privacy concerns in the course of performing their roles in relation to the TPS Inquiry.
22. The Inquiry Team must report a privacy breach or potential privacy breach to the Privacy Lead and Manager as soon as they become aware that a breach or potential breach has occurred.

e. Responsibilities of Non-TPS Inquiry OHRC Staff

23. OHRC staff not on the Inquiry Team must, to the extent possible, avoid encountering TPS Inquiry-related personal information, and must keep any personal information that they may learn in relation to the TPS Inquiry confidential.
24. OHRC staff will consult with the Privacy Lead and the Inquiry Team if they have questions or concerns related to privacy matters.
25. OHRC staff must report a privacy breach or potential privacy breach to the Privacy Lead and Manager as soon as they become aware that a breach or potential breach has occurred.

f. Responsibilities of the TPS Inquiry Lead for Privacy Matters

26. At this time, the TPS Inquiry Lead for Privacy Matters (“Privacy Lead”) is: 

Sunil Gurmukh, Counsel,
Legal Services and Inquiries
Ontario Human Rights Commission
180 Dundas Street West, 9th Floor
Toronto, Ontario M7A 2G5
Telephone: (416) 314-4519
Email: Sunil.Gurmukh@ohrc.on.ca

27. The Privacy Lead will act as the main person of contact for public citizens and internal or external staff who have a TPS Inquiry privacy question or concern.
28. The Privacy Lead will brief the Inquiry Team on the privacy-related requirements of FIPPA and the contents of this Policy.
29. The Privacy Lead will frequently monitor and report on compliance with this Policy to ensure that safeguards have been implemented and that privacy due diligence continues to be applied throughout the TPS Inquiry’s lifecycle.

g. Acknowledgement

30. Before having access to any personal information obtained through the TPS Inquiry, all Inquiry Team members, whether internal or external to the OHRC, must voluntarily sign the acknowledgement (Appendix ‘A’ hereto), which requires that they:

• Read this Policy and understand the privacy safeguards herein;
• Keep any personal information in a secure location at all times;
• Ensure that no personal information is used or disclosed unless necessary and proper in the discharge of the OHRC’s functions; and
• Ensure that no personal information is used or disclosed in a form in which the individual to whom it relates can be identified, without prior informed consent of the individual to whom the information relates.

h. The Retained Expert

31. An expert (the “Retained Expert”) and graduate student (“Student”) have been engaged to assist with the analysis of the TPS Inquiry data.  A confidentiality agreement has been executed with both the Retained Expert and Student.
32. To the extent that the Retained Expert and Student have access to personal information, they must under no circumstances disclose any personal information to anyone other than the Inquiry Team.
33. The Retained Expert and Student shall not disclose or otherwise provide access to non-personal information and data obtained through the TPS Inquiry, other than for the defined research purposes.
34. The Retained Expert and Student will implement safeguards and protocols consistent with this Policy and will consult with the Inquiry Team on any additional safeguards that may be required.

II. Physical Safeguards

a. Access Card

35. An access card is required to enter the OHRC office.
36. Staff must not permit unauthorized or uninvited people to enter into the OHRC office space.
37. Staff will notify security of suspicious activity in the OHRC vicinity.

b. Office 

38. As much as possible, Inquiry Team will turn their computer monitors off, sleep their computers or change screens to prevent others from seeing personal information on the screen.
39. Hard copy documents or files containing personal information must be kept in a central office/room that can be locked when unattended. When possible, Inquiry Team should use a clean desk policy whereby personal information is kept out of sight, ideally, locked in a drawer or filing cabinet.
40. When discussing TPS Inquiry matters, Inquiry Team staff will close the door during their meetings to ensure that others do not overhear personal information.
41. The Inquiry Team will take all reasonable steps to ensure that third parties who may attend the OHRC office (invited guests, maintenance staff or cleaning staff) do not have access to personal information.  

c. Hard Copy

42. Hard copies of collected TPS Inquiry materials, including any personal information, must be stored in a secure location, ideally raised off the floor to prevent flood damage and in a fire-resistant space.
43. When not in use, hard copies of collected TPS Inquiry materials, including any personal information, must be locked in filing cabinets.

d. Printing

44. The Inquiry Team should refrain from printing and photocopying any personal information.
45. The Inquiry Team must not leave a document containing personal information on the printer.  If printing, staff should use Secure Print so that personal information does not print until the staff member goes to the printer to retrieve it.

III. Electronic Safeguards

a. OHRC Computers

46. OHRC computers are password protected. The passwords automatically expire every 45 days.
47. The Windows firewall is enabled on all OHRC computers. The computers use McAfee software to protect them from virus and malware threats.
48. When working on TPS Inquiry materials, staff must not use a personal or non-OHRC computer.

b. OHRC Laptops

49. OHRC laptops are password protected. The passwords automatically expire every 45 days.
50. The Windows firewall is enabled on all OHRC laptops. The laptops use McAfee software to protect them from virus and malware threats.
51. The hard drive of every OHRC laptop is encrypted. In the event that a laptop is misplaced or lost, a finder should be unable to access the secure information.
52. The Retained Expert and Student will be provided with an OHRC laptop as an electronic safeguard.

c. Email

53. The Inquiry Team will not use their personal emails for any TPS Inquiry work.
54. No personal information shall be communicated or transmitted by email.

d. Fax

55. No personal information shall be faxed anywhere.

e. Off-Site

56. If Inquiry Team members must work off-site, then they will use a Virtual Private Network (VPN) service.
57. The Inquiry Team shall not remove any personal information from the TPS Inquiry data from the OHRC premises.

f. Storage

58. Electronic information obtained during the TPS Inquiry will be stored in a shared folder, accessible only by members of the Inquiry Team.

g. Text

59. The Inquiry Team will not use instant messaging tools to discuss TPS Inquiry material.

Conclusion

Protection of personal information is an ongoing responsibility. This policy was adopted at an early stage of the TPS Inquiry and will be re-assessed on an ongoing basis.