IPC | Page 4

Is De-identified Information Personal Information?

Now and then, our office receives requests for review where a public body (government institution, local authority or health trustee) denied access pursuant to subsection 29(1) of The Freedom of Information and Protection of Privacy Act (FOIP), or subsection 28(1) of The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) or subsection 27(1) of The Health Information Protection Act (HIPA). Therefore, I thought it may be helpful to explore if de-identified information is personal information.

To qualify as personal information, the information must: 1) be about an identifiable individual; and 2) be personal in nature. Information is about an “identifiable individual” if the individual can be identified from the information (e.g., their name is provided) or if the information, when combined with information otherwise available, could reasonably allow the individual to be identified. To be “personal in nature” requires that the information reveal something personal about the identifiable individual.

One of the most effective ways to protect the privacy of individuals is through strong de-identification. Using proper de-identification techniques and re-identification risk management procedures, remains one of the strongest and most important tools in protecting privacy.

“De-identification” is the general term for the process of removing personal information from a record or data set.

“De-identified information” is information that cannot be used to identify an individual, either directly or indirectly. Information is de-identified if it does not identify an individual, and it is not reasonably foreseeable in the circumstances that the information could be used, either alone or with other information, to identify an individual.

Subsection 2(1)(d) of HIPA defines “de-identified personal health information” as personal health information from which any information that may reasonably be expected to identify an individual has been removed. This is important as subsection 3(2)(a) of HIPA provides that HIPA does not apply to “statistical information or de-identified personal health information.”

The goal is to reduce the risk of re-identification of information once it has been de-identified. The following table shows decreasing probability of re-identification of information:

State	Description

1. Identifiable data	The data have directly identifying variables or sufficient quasi-identifiers that can be used to identify the individual.
2. Potentially de-identified data	Manipulations have been performed on the identifying variables but attempts to disguise the quasi-identifiers may be insufficient. The data may not be fully deidentified, partially exposed, and may represent a re-identification risk.
3. De-identified data	An objective assessment of re-identification risk has been done and it is concluded that all directly identifying variables have been adequately manipulated and quasi-identifiers adequately disguised to ensure an acceptable level of re-identification risk.
4. Aggregate data	These are summary data such as tables or counts, where there are no identifying variables or quasi-identifiers.

For further explanation regarding de-identified information, please refer to our resources available on our website: IPC Guide to FOIP – Chapter 6 and IPC Guide to LA FOIP – Chapter 6.

Public bodies may find the following recent review reports issued by our office helpful on this topic:

IPC Review Report 060-2023 – in this Review Report at paragraph [19], the Commissioner found that the “claim numbers” assigned to individuals by Saskatchewan Government Insurance (SGI) were personal information pursuant to subsection 24(1)(d) of FOIP. However, once the “claim numbers” which were assigned to particular individuals were redacted, any personal health information attached to those numbers, such as reason for doctor appointments, became de-identified information and were releasable.
IPC Review Report 063-2023 – in this matter, the Ministry of Health denied access to a spreadsheet of 18 columns pursuant to subsections 29(1) of FOIP and 27(1) of HIPA. However, the Commissioner found that once a few columns of personal information were redacted pursuant to subsection 29(1) of FOIP, the remaining data in the spreadsheet became sufficiently de-identified, and was releasable.

Hopefully, the above will assist you in successfully de-identifying personal information or personal health information. For any questions, please contact our office at intake@oipc.sk.ca.

How has the Pandemic’s Seismic Shift to Increased Remote Work Affected Privacy?

A recent poll by a global market research and public opinion specialist – IPSOS, revealed that approximately 36% of people who worked from home during the pandemic anticipate a return to their offices on a regular basis in the near future. This means that more than half of paid employees expect a work-from-home environment to be their new normal at least in the short term. For many organizations/institutions, the transitions toward work-from-home structures means employers have had to create additional privacy policies/procedures or amend existing ones. As more work-from-home job options for employees are created, elevated levels of concerns arise regarding safeguards for both client/customer privacy and employee privacy including proper use/storage of client personal information, wider scope of employee monitoring, safety of work devices and safety of internal work communications.

From purchase order patterns to credit card information to home addresses, clients’ personal information is collected, used and disseminated by organizations/institutions regularly. Employee records such as payroll information, attendance reports, formal and informal personnel files, resumes, records of web-browsing, discipline notes, sick notes and evaluations also circulate within workspaces as needed.

To protect clients’/customers’ personal information, organizations should require employees to use strong remote access controls such as multi-factor authentication, a Virtual Private Network (VPN) with end-to-end encryption and a secured WiFi. In addition, staff should obtain permission before installing any non-approved software/apps. Though not recommended, if employees are required to use their personal devices for work, employers should remind them of safe privacy practices. Regarding home workspaces, the Information and Privacy Commissioner of Ontario advises employers to remind their staff to set up private workspaces where private information, conversations and meetings can be properly safeguarded. For more tips, see our blog, Working from home.

The Office of the Privacy Commissioner of Canada instructs organizations to consider the privacy rights of its employees when monitoring their work at home. This is important because, if not implemented properly, digital surveillance of employees can lead to heightened stress levels, reduced autonomy and creativity and mental health effects. Regarding safeguarding employee personal information in a work-from-home context, the Information and Privacy Commissioner of Ontario encourages organizations to remind staff that office and security policies also apply in a work-from-home context and staff need to report any security breach incidents immediately.

Furthermore, a longer-term work from home strategy should be created by organizations and include monitoring and evaluating effectiveness of access and privacy in a remote context, an update of corporate files and secure records keeping. As more employers shift toward increased remote work arrangements and use of monitoring technologies in this digital world, the privacy authorities have called on governments to develop or strengthen laws to protect privacy. They have also asked employers to be more transparent and accountable in their workplace monitoring practices.

Access, Privacy, Children and Joint Legal Custodians (updated)

Commissioner Kruzeniski’s blog Who Signs for a Child? (updated) described the rules under The Freedom of Information and Protection of Privacy Act (FOIP), The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP), and The Health Information Protection Act (HIPA) applicable to legal custodians.

The Commissioner explained that subsections 59(d) of FOIP, 49(d) of LA FOIP and 56 of HIPA give a legal custodian the right to sign on behalf of their child. He added that depending on the terms of any applicable court order, agreement, one or both parents could sign for the child.

Since publishing that blog, our office conducted a privacy investigation involving two parents who had signed an Interspousal Agreement which included a provision that they would have joint custody of the children of the marriage. The parents disagreed about whether one of their child’s information should be disclosed to a stepparent.

In Investigation Report 083-2022, the Commissioner found that where two legal custodians, with equal rights and responsibilities under an Interspousal Agreement, disagreed, the wishes of one legal custodian could not prevail over the wishes of the other.

This raised the question “How does the head of a local authority or institution, or trustee manage access to information requests or consents to collection, use or disclosure involving children where their joint legal custodians disagree?”

There is no requirement for a head or trustee to canvass the views of every legal custodian to satisfy themselves that the custodian making a request or signing on behalf of a child is doing so with the agreement of the other. However, where a head or trustee is aware that one of the joint legal custodians does not agree with a request or consent provided by the other, they should not rely on the direction of one legal custodian, only.

When determining whether legal custodians have equal rights and responsibilities, heads and trustees will need to consider subsection 3(1) of The Children’s Law Act, 2020 (CLA) which provides:

3(1) Unless otherwise ordered by the court and subject to subsection (2) and any agreement pursuant to subsection (3), the parents of a child are joint legal decision makers for the child, with equal powers and responsibilities.

If there is a court order or agreement between the parties, the legal rights and responsibilities of the parents will be determined by the applicable order or agreement.

The rights of joint custodial parents were considered in a recent review of an access decision. In the Commissioner’s Review Report 175-2022, a joint custodial parent (Applicant) sought access to their 17-year-old child’s personal health information from eHealth Saskatchewan (eHealth). There was a court order in place which stated that the Applicant and the child’s father had joint custody of their child. Based on a review of the court order, the Commissioner found that the Applicant was the child’s legal custodian. However, unlike the circumstances in Investigation Report 083-2022, in this case, there was no evidence before the Commissioner or eHealth that the child’s father objected to the disclosure of the child’s personal health information. Therefore, the Commissioner found that there was no obligation on eHealth to canvass the views of the child’s father in making its decision on whether to grant the Applicant access to the requested records.

However, it should be noted that the Commissioner found that the child was a mature minor and was capable of exercising their own rights and powers. Therefore, he found that the Applicant did not have the ability to exercise their child’s right of access pursuant to subsection 56(d) of HIPA.

Canadian privacy regulators launch principles for the responsible development and use of generative AI

Federal, provincial and territorial privacy authorities have launched a set of principles to advance the responsible, trustworthy and privacy-protective development and use of generative artificial intelligence (AI) technologies in Canada.

The authorities introduced the principles during an international symposium on privacy and generative AI that was hosted in Ottawa by the Office of the Privacy Commissioner of Canada.

While AI presents potential benefits across many domains and in everyday life, the regulators note that there are also risks and potential harms to privacy, data protection, and other fundamental human rights if these technologies are not properly developed and regulated.

Organizations have a responsibility to ensure that products and services that are using AI comply with existing domestic and international privacy legislation and regulation.

The joint document lays out how key privacy principles apply when developing, providing, or using generative AI models, tools, products and services. These include:

Establishing legal authority for collecting and using personal information, and when relying on consent ensuring that it is valid and meaningful;
Being open and transparent about the way information is used and the privacy risks involved;
Making AI tools explainable to users;
Developing safeguards for the protection of privacy rights; and
Limiting the sharing of personal, sensitive or confidential information.

Developers are also urged to take into consideration the unique impact that these tools can have on vulnerable groups, including children.

The document provides examples of best practices, including implementing “privacy by design” into the development of the tools, and the labelling content created by generative AI.

For more information:

Julie Ursu, Manager of Communication
Telephone: 306-798-2260
Email: jursu@oipc.sk.ca

Privacy Savvy Children and Youth

Various studies on how Canadian children and youth use technology have concluded similar findings. One study found that about 90% of young people aged nine to 11 have at least one social media account. The same study found that about 80% of young people aged nine to 17 have their own smartphone, with many having received their first phone by age 11. Other studies have found that young people spend up to two hours or more online every day.

As children and youth become more tech savvy, though, are they also becoming more privacy savvy? Social media or other internet activity may appear free, but participating almost always comes at a cost to personal privacy.

Any online presence comes with its own set of privacy concerns or risks, regardless of age. For children and youth, however, the risks can be greater. Besides the fact that they may access harmful or inappropriate content, children and youth may also be at risk to their privacy and safety. They may share more online than they intend to or should. They may also use apps that reveal their location, which can lead anyone to knowing exactly where they are. This can make them easy targets for predators or others who mean them harm.

There is also the fact that once you put something online, it is very difficult – sometimes impossible – to remove it or to take it back. This can lead to reputational harm and, if the information you put out is used against you, to heightened feelings of anxiety and depression.

Being privacy savvy means having the practical knowledge needed to make good decisions or judgements about your online privacy. Online privacy means protecting your personal information and knowing what trail of personal information you leave behind. Personal information is anything directly related to your personal life, such as your name, date of birth, home address, telephone number, list of contacts, where you go to school, etc.

Parents can start helping their kids become privacy savvy online by teaching them the fundamentals of internet privacy and what happens to their personal information when they go online. Many online resources for this exist, including the following:

Activity Sheets for Kids – online activity sheets from the Office of the Privacy Commissioner of Canada that help with learning concepts such as creating passwords
Lesson Plans and Activities for K-12 Education – links to resources for school-aged children and youth from the Office of the Information and Privacy Commissioner of Alberta
MediaSmarts Resources for Digital Media Literacy – digital media literacy program for Canadian homes, schools, and communities

Don’t let your kids just be tech savvy – to keep them and their personal information safe, also teach them to be privacy savvy.

Why some reviews and investigations cannot pass go (updated)

If you have ever contacted our office regarding a concern with how an organization (government institution, local authority or trustee) has responded to your access to information request or handled your personal information or personal health information, you would have been told that we are an office of last resort. As the oversight body, we are an appeal body. That means that you first must have made the access request to the appropriate body and waited the requisite period of time, usually 30 calendar days, before bringing your concerns to our attention. The same can be said for privacy complaints, for the most part. But, even once you submit your request/complaint, we don’t immediately open a file as we have to make a decision in terms of if we can proceed.

What do I mean by that? Firstly, we must have jurisdiction. That is, the organization that your request/complaint is directed to qualifies as a government institution, local authority or trustee. Even if it appears this is the case, we also need grounds to proceed. It is much more straightforward in a review if we have grounds as will be evident from the documentation, but the applicant still needs to point out which issues they want us to consider in the review (i.e., fee estimate, manner of access, search, fee waiver, access denied, time extension). So clearly, providing all the necessary documentation is crucial for us to move forward.

With a privacy complaint, if you believe that an organization has breached your privacy, what you bring to us must be specific and convincing. For instance, what personal information or personal health information is involved? On what day/time did the alleged inappropriate or unauthorized collection, use or disclosure of your personal information or personal health information occur? Who was involved? How do you know that this occurred? What proof do you have that would support your assertions?

In either case, if enough information is not provided even after our intake team intervenes, the request/complaint may be dismissed and no formal review or investigation is undertaken by our office. This could happen too if statutory time limits have expired.

If it looks like our office has jurisdiction and sufficient grounds to go forward with a review or investigation, formal notices to the parties are sent indicating that we are proceeding. However, we could still end up discontinuing the review or investigation if we are convinced that the appeal concerns a trivial matter, is frivolous, vexatious, not made in good faith, or for other reasons noted in the legislation. For the most part, the reasons for making an access request(s) or submitting a privacy complaint(s) aren’t relevant, but motives may be considered if actions taken by the submitter of the request/complaint amount to an abuse of process. For example, the following excerpts are taken from our Review Report 225-2015:

Did the Applicant request this review on grounds that are frivolous, vexatious or not in good faith?

[10] Subsections 43(2)(a) and (b) of HIPA provides:

43(2) The commissioner may refuse to conduct a review or may discontinue a review if, in the opinion of the commissioner, the application for review:

(a) is frivolous or vexatious;

(b) is not made in good faith;

…

[11] This provision enables the Commissioner to dismiss or discontinue a review where it appears the access provisions of HIPA are not being utilized appropriately. …

[12] Personal health information is one of the most sensitive forms of personal information. It is collected primarily for reasons connected with patient care and is collected under circumstances of vulnerability and trust. Therefore, denying someone the right of review should only be permitted in the most extreme of circumstances and when there is compelling evidence to do so.

[13] On the other hand, HIPA must not become a weapon for disgruntled individuals to use against a trustee for reasons that have nothing to do with the Act. …

…

[16] Depending on the nature of the case, one factor alone or multiple factors in concert with each other can lead to a finding that a request is an abuse of the right of access. …

…

[62] The rights afforded the public to access under HIPA are accompanied by concomitant responsibilities on the part of Applicants. One of these responsibilities is working in tandem with the trustee to further the purposes of the Act. Actions, on the part of an Applicant that frustrate this approach can be said to be an abuse of this process. Examples include overwhelming a trustee with access requests, not working constructively to resolve issues, making repeated unfounded accusations and being uncooperative or harassing to those who are attempting to assist.

…

[65] In conclusion, considering all that is before me, I find that the Applicant’s review request is vexatious.

[66] I find that the review under consideration has been initiated on vexatious grounds pursuant to subsection 43(2)(a) of HIPA. I therefore discontinue this review…

[Emphasis added]

In the above case, the review was discontinued for the reasons noted, but this not a common outcome. I find in most cases, individuals that come to our office do so in good faith and are eager to cooperate and not surprisingly, those files proceed without complication. So, if unclear at all as to what is required, please contact us.

Privacy in Organizations not Subject to Legislation

I received a call a few days ago from someone who worked in an organization that is not subject to privacy legislation provincially or federally. The question posed to me was what are the organization’s privacy obligations? I first had to say, you are not subject to provincial legislation and so there are really no privacy obligations (in a legislative sense).

I should note that Saskatchewan does have a Privacy Act where one can be sued for an invasion of privacy (see section 2).

I then went on to say that privacy is given a different definition by almost every person and thus, their expectation as to what an organization should do can be varied. My best advice was that the organization’s executives get together and hammer out a privacy policy that would be good for the organization.

Does an organization have to develop such a policy? No, but if people are raising privacy questions, the organization needs to have one.

I tried to suggest things that might go into such a policy:

Rules relating to distribution of membership lists.
Rules related to posting names of the executive on the organization’s website.
Rules relating to providing people with email, telephone numbers and addresses.

I indicated caution around emails, telephone numbers and addresses should be exercised and should be disclosed only on a need-to-know basis and only if it is safe and appropriate to do so. It is quite possible someone involved in the organization is separated from a former partner who is abusive or violent. Accidently indicting where the person lives could be dangerous for that person.

Suggesting drafting a policy is daunting and I wanted to suggest where the person might find a good sample. I could not. So, after the telephone call I was able to find a couple of samples. First you might want to look at the Canadian Standards Association, model code for the Protection of Personal Information. Here are some sample privacy policies listed in no preferred order:

Canadian Cancer Society – https://cancer.ca/en/privacy-policy

St. John’s Ambulance – https://www.sja.ca/en/privacy-policy

Big Brothers Big Sisters of Regina https://bbbsregina.ca/privacy-statement/

Canadian Blood Services – https://www.blood.ca/en/mystory/privacy-policy

Remember, developing a policy is a good start, but a policy has to be tailored to the needs and expectations of the organization. Also once drafted it needs to be widely circulated and accepted by executive and staff that it is a good policy and will be followed. That policy should be posted on the organization’s website. A good privacy policy can lead towards developing a culture of privacy in the organization.

Who is “Fake Ron”? (updated)

I have just become aware that staff had received another email from me asking for some gift cards in a rush because I was in a meeting. Previously, staff in my office had also received an email from me, but it wasn’t from me. They dubbed it, “Fake Ron.” Apparently, I wanted the recipient of the email to do me a favor. This fake email attempting to use my name is a good reminder to me and the staff of my office that there are many people out there dreaming up schemes to lead or mislead us into doing something.

I recently saw an article headline that said, organization breaches are in many instances caused by human error. The 2022 Horizon report on data breaches found that hackers tend to exploit human error to get initial access, particularly through the use of phishing scams.

Sometimes we very innocently click on a link, which results in some malware slipping into our system. So, the “Fake Ron” email has been a good reminder here to be always vigilant and watching for the thing that does not feel right or is too good to be true.

This has caused our office to test our vigilance and readiness – just like we have fire drills. I recommend every organization do the same.

How Does our Office Keep you Anonymous?

The Commissioner publicly posts review and investigation reports regarding a variety of matters involving applicants and complainants. As much as possible, our office tries to conceal their identities. Our office also recognizes that there are times when it is warranted to conceal the identity of someone other than an applicant or a complainant.

De-identification is the process of editing or removing personal information from a record. De-identification reduces the likelihood that a person will be identified or made known. Information is de-identified if: 1) a person’s identity is not revealed; or 2) if it is not reasonably foreseeable that information, either alone or in combination with other information, could reveal a person’s identity.

Personal information is either directly identifying (e.g., name, home address or telephone number) or indirectly identifying (e.g., use of descriptors such as gender, race, postal code, or profession). While direct identifiers openly disclose or make it easier to conclude an identity, indirect identifiers, given their nature and circumstances, can also lead to openly identifying someone. For example, disclosing that a matter involves a male doctor in a town of 1,000 people can more openly reveal his identity than if he was a male doctor in a city of 200,000 people – it’s in the details.

Obviously, the process of de-identifying information involves removing names, but it may also mean removing or editing information that allows readers to draw linkages to an identity. The following are some ways in which our office attempts to reduce such linkages in reports:

We mostly use the third-person plural “they”, which traditionally refers to groups of two or more people. Grammar purists may not agree with using the plural form “they” when discussing a singular person, but the use of “they” can be used when who you are referring to isn’t important or isn’t the focus. Using the term “they” in our reports then allows us to pull focus away from who is being discussed, thereby reducing the likelihood that a person can be identified.
We try to edit names of communities, organizations, etc., if such information can be combined with other information to lead to a person’s identity. This is sometimes the case in situations involving well-known events or events of a sensitive nature that occur in a certain place. Or, in the case of the male doctor above, where saying he is from Grenfell can more directly identify him than if he practiced in Saskatoon.
We sometimes remove sensitive information or details if a matter is well known or highly publicized, or if that information has the potential to cause embarrassment for someone or to re-traumatize them. For example, rather than state the type of offence committed against someone, we may just state that there was an offence committed.

These are just a few ways in which we may bring anonymity to our reports, particularly for applicants and complainants. You will see in our reports, though, that at times we leave in identifying information such as names of public employees or civil servants. Such information is not typically considered personal information or personally identifying if it’s used in a professional or business context. We may remove such information, however, if leaving it in could lead to the identity of an applicant or complainant, or if we determine it is not relevant to the matter.

Determining which information to exclude from a report can be very subjective. The process requires us to balance all the factors and circumstances of a matter while ensuring that we do not mispresent any facts. It’s part of our office’s responsibility to protect a person’s identity when warranted while at the same time being factual and unbiased. The last thing our office wants to do, though, is inadvertently disclose an identity that should remain anonymous, and so we err on the side of caution.

Research: post pandemic (updated)

As I listen to the news, my head keeps telling me there will be many opportunities and much interest in researching many and varied aspects of this world pandemic. I expect there will also be interest on the part of Saskatchewan researchers.

The law is VERY CLEAR that researchers can ask public bodies for de-identified information. Each public body has to decide how much information it will provide; that is a policy decision. Those public bodies under privacy legislation are allowed to provide de-identified information.

What is de-identified information? It is the information without your or my name, address, or any unique identifier such as the individual’s Social Insurance Number (SIN) or Health Services Number (HSN). For example, subsection 3(2)(a) of The Health Information Protection Act (HIPA) states that it does not apply to statistical information or de-identified personal health information that cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified. A public body can provide all the information that does not identify you or me.

If the health trustee or the researcher has the consent of the individuals to use their personal health information, then that is the best way to go. In many cases, that won’t be possible. Either the health trustee did not obtain consent to research or there are thousands and thousands of records and getting consent would not be possible.

If research is being done in such a way that it requires information from two sources and the name, SIN or HSN are sought to connect the information of an individual; that presents a challenge. The Data Matching Agreements Act is not yet proclaimed. Nonetheless, The Freedom of Information and Protection of Privacy Act (FOIP), The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) and HIPA have always authorized use and disclosure of personal information or personal health information for legitimate research purposes in the public interest. The best-case scenario, and for research at the population level, de-identified data should be used and should suffice for those purposes.

However, those same laws provide for the use of identifiable data when appropriate, but I must emphasize the need for written agreements to ensure that data is protected. This rigour is necessary to ensure data is used from one or multiple sources that what is provided is used as intended and protected throughout the process.

I note section 29 of HIPA, requires all research projects where personal health information is used or disclosed by a trustee, must be approved by a research ethics committee that has been approved by the Saskatchewan Minister of Health. If a research ethics committee is small and nimble it should never be a barrier to good research.

I have heard that some say “privacy” is a barrier to research. I do not believe or accept that point of view. That is why I wrote this blog to show that good research can continue and the barriers to obtaining the data should be minimal. If public bodies are citing “privacy” as the problem, they are giving the wrong reason and it just might be they don’t want to provide the information or to cooperate. Privacy is not the barrier.

Is De-identified Information Personal Information?

Is De-identified Information Personal Information?

Was this page helpful?

How has the Pandemic’s Seismic Shift to Increased Remote Work Affected Privacy?

Was this page helpful?

Access, Privacy, Children and Joint Legal Custodians (updated)

Was this page helpful?

Canadian privacy regulators launch principles for the responsible development and use of generative AI

Was this page helpful?

Privacy Savvy Children and Youth

Was this page helpful?

Why some reviews and investigations cannot pass go (updated)

Was this page helpful?

Privacy in Organizations not Subject to Legislation

Was this page helpful?

Who is “Fake Ron”? (updated)

Was this page helpful?

How Does our Office Keep you Anonymous?

Was this page helpful?

Research: post pandemic (updated)

Was this page helpful?

Google Translate Disclaimer