Investigation Report 276-2025
INVESTIGATION REPORT 276-2025
Saskatchewan Workers’ Compensation Board
August 28, 2026
Summary: The Complainant alleged that a privacy breach occurred during a telephone call with an Inquiry Line Operator at the Saskatchewan Workers’ Compensation Board (WCB Operator). The Complainant initiated an investigation by the Office of the Saskatchewan Information and Privacy Commissioner (OIPC). The Commissioner found that a privacy breach did not occur. However, the Commissioner recommended that, within 30 days of the issuance of this Investigation Report, WCB should send a reminder to all WCB Operators to follow Authority for Disclosure (PRO 24/2024) and to refuse to provide information over the telephone if insufficient detail is not provided by a caller to verify identity.
I BACKGROUND
[1] On September 17, 2025, the Complainant forwarded to the Office of the Saskatchewan Information and Privacy Commissioner (OIPC) an audio recording of a telephone call earlier that day with a Saskatchewan Workers’ Compensation Board Inquiry Line Operator (WCB Operator). The Complainant objected to the fact that the WCB Operator somehow knew the Complainant’s full name. The Complainant wished the call to be “private” and had only used their first name. The Complainant believed a privacy breach had occurred.
[2] On September 18, 2025, this office informed the Complainant that the first procedural step should be the submission of a written complaint to the WCB privacy office.
[3] Between October 20, 2025 and November 7, 2025, this office worked with the Complainant to clarify the nature of the complaint. On November 7, 2025, the Complainant provided consent for OIPC to contact WCB. Subsequently, on December 18, 2025, OIPC spoke with the WCB privacy office.
[4] Between March 25, 2026, and April 22, 2026, OIPC again worked with the Complainant to gather further clarity with respect to the complaint.
[5] On May 22, 2026, OIPC notified WCB and the Complainant that this office would undertake an investigation. On June 19, 2026, WCB provided a submission to OIPC. The Complainant did not provide a submission.
II DISCUSSION OF THE ISSUES
1. Jurisdiction
[6] WCB qualifies as a “government institution” pursuant to section 2(1)(d)(ii) of The Freedom of Information and Protection of Privacy Act (FOIP)[1] and section 3 and PART I of the Appendix of The Freedom of Information and Protection of Privacy Regulations (FOIP Regulations).[2] As FOIP is engaged, OIPC has jurisdiction to conduct this investigation under PART IV of FOIP.
2. The allegation of a privacy breach
[7] On September 17, 2025, the Complainant provided OIPC with a recording of a telephone call between the Complainant and the WCB Operator. This recording served as the sole evidence behind the Complainant’s allegation of a privacy breach. The call is transcribed below:[3]
WCB Operator: Workers’ Compensation Board, good morning.
(0:00:22)
Complainant: Good morning, I was hoping to speak to one of the board secretaries.
(0:00:24)
WCB Operator: A board secretary?
(0:00:31)
Complainant: Yes.
(0:00:34)
WCB Operator: Okay, what’s the claim number?
(0:00:35)
Complainant: This would be a private matter between me and them.
(0:00:37)
WCB Operator: This is what?
(0:00:40)
Complainant: A private matter?
(0:00:41)
WCB Operator: Okay, so you don’t want to provide me a name so I can let him know
(0:00:43) who’s calling?
Complainant: The name would be [Complainant’s first name].
(0:00:49)
WCB Operator: [Complainant’s first and last name], is it?
(0:00:53)
Complainant: And right there, you just breached the confidentiality.
(0:00:55)
WCB Operator: Well, I’m just guessing because….
(0:00:58)
Complainant: You might want to report this over to the privacy bodies.
(0:01:01)
WCB Operator: [Complainant’s first and last name], so what board member,
(0:01:04) [Complainant’s first name], are you looking for?
Complainant: You can transfer this over to the privacy party now.
(0:01:07)
WCB Operator: Privacy party?
(0:01:10)
Complainant: Yeah, you just breached my privacy.
(0:01:12)
WCB Operator: Did I?
(0:01:14)
Complainant: Yeah, I just told you it was a private matter, and you still proceeded
(0:01:15) to…
WCB Operator: I’m just doing my job here, [redacted], that’s all. Let’s see, I have a
(0:01:20) number here. [WCB Director’s last name] told me I can give you this number here for [WCB Director’s first name]…okay [WCB Director’s first and last name] there [they are], [WCB Director’s first and last name] okay, write this number down, I’m not going to transfer your call but you can call [them] directly…
Complainant: No, this call would be, uh, I can transfer it over to privacy after you
(0:01:53) get the phone number.
WCB Operator: What is your number so I can have them call you?
(0:01:57)
Complainant: Alright, we’re going to scratch it, you can just transfer me over to
(0:02:02) privacy party then.
WCB Operator: I’m not going to transfer you to privacy party, I’m just following my
(0:02:05) boss’ orders.
Complainant: Alright, which name would I be giving the privacy officer then?
(0:02:10)
WCB Operator: Doesn’t matter. Do you want me to have [them]…
(0:02:14)
Complainant: You’re not identifying yourself?
(0:02:16)
WCB Operator: I’ve identified myself many times.
(0:02:17)
Complainant: And now you’re the first to being aggressive.
(0:02:22)
WCB Operator: So I’m not being aggressive, I’m just trying to help you out. Do you
(0:02:24) want to help me out to help you out or not?
Complainant: You just breached my privacy. I just told you it’s a private call and
(0:02:31) you’re scared of this that you still look me up.
WCB Operator: Okay…there’s…I didn’t look you up at all, actually. So, do you
(0:02:36) want to continue this conversation or do you want me to disconnect the call? I have a number here for you if you want to call? And this is from [WCB Director’s first and last name], [they are] an assistant director of operations here. I have [their] instructions right in front of me. Would you like to write these numbers down?
Complainant: You just told me you’re not giving me the number.
(0:02:57)
WCB Operator: I told you I’ll give you the number if you want it, but you said you
(0:02:58) don’t want it. And then I asked, what’s your number?
Complainant: I’ve recorded this complete conversation.
(0:03:03)
WCB Operator: Okay, are we going to continue this or do you want me to hang up
(0:03:06) the phone?
Complainant: And you’re just the first to being aggressive.
(0:03:10)
[8] The Complainant alleges that having only given a first name at the commencement of the call, the WCB Operator violated their privacy by somehow discerning the Complainant’s true identity and stating the full name. What remains unknown is the means by which the WCB Operator was able to ascertain the Complainant’s full name. Perhaps the WCB Operator was familiar with the Complainant’s voice from many past calls. This is an available inference from the transcript of the call. Perhaps the WCB Operator was instructed by a superior with respect to this very individual – another available inference from the transcript of the call. Regardless, the “how” remains unknown and is irrelevant in terms of understanding the essence of the complaint. The Complainant believed that their privacy was breached and, in this respect, offered the only evidence we have which is the call transcript where the WCB Operator uttered the Complainant’s first and last name during the call. The Complainant wished to remain unidentified and wished the call to be directed discretely to a WCB “board secretary.” The Complainant alleged a privacy breach because the WCB Operator should not have ascertained the Complainant’s identity. The Complainant explained the nature of the breach to this office:
I sent a record not that long ago from wcb and my call. you can here [them] using my phone number to get into my account information when I was going to have a private convocation with a receptionist of a director. I even told them it was a private call. They even do same thing when trying to speak to private office there.
[9] The first step in a privacy breach investigation is to determine whether personal information is at issue. Section 24(1) of FOIP provides a non-exhaustive list of the type of information that qualifies as personal information. Personal information is information that is about an identifiable individual, and that is personal in nature. Information is about an identifiable individual if the individual can be identified from the information itself. Information is personal in nature if the information reveals something personal about the identifiable individual.[4]
[10] Without a doubt, the Complainant’s full name in connection with the certainty that the Complainant had previously engaged with WCB, constitutes the Complainant’s personal information, pursuant to sections 24(1)(k)(i) and (ii) of FOIP, which state:
24(1) Subject to subsections (1.1) and (2), “personal information” means personal information about an identifiable individual that is recorded in any form, and includes:
…
(k) the name of the individual where:
(i) it appears with other personal information that relates to the individual; or
(ii) the disclosure of the name itself would reveal personal information about the individual.
[11] Having concluded that personal information was at issue, OIPC must now evaluate whether the WCB Operator “used” the personal information of the Complainant in violation of FOIP.
[12] The “collection” of personal information means to bring together, assemble, accumulate, or obtain personal information from any source, by any means.[5] In the present case, a “collection” occurred when the Complainant volunteered their first name. Section 25 of FOIP provides:
Purpose of information
25 No government institution shall collect personal information unless the information is collected for a purpose that relates to an existing or proposed program or activity of the government institution.
[13] A strict interpretation of section 25 of FOIP reveals that the “collection” by WCB was authorized, because it directly related to the purpose of addressing the Complainant’s call. This information was required out of a necessity for the WCB Operator to assist the Complainant and direct the call.
[14] The “use” of personal information by a government institution includes the sharing of personal information in such a way that it remains under the control of the government institution.[6] This office has also historically established that to “use” personal information under FOIP includes reference to personal information by the government institution that has possession or control of the information. The definition of “use” does not include disclosure of the personal information to another entity.[7]
[15] At this point in the analysis, section 28 of FOIP is relevant:
Use of personal information
28 No government institution shall use personal information under its control without the consent, given in the prescribed manner, of the individual to whom the information relates, except:
(a) for the purpose for which the information was obtained or compiled, or for a use that is consistent with that purpose; or
(b) for a purpose for which the information may be disclosed to the government institution pursuant to subsection 29(2).
[Emphasis added]
[16] The Complainant maintains that no consent was provided for the use of the personal information in this case. The Complainant is misinformed because an authorized use of personal information does not require consent. The WCB was completely authorized to use the Complainant’s personal information in the way that it did in order to direct the Complainant’s call.
[17] The WCB submitted that the WCB Operator in this matter followed WCB practice and procedure:
A review of the recording and subsequent discussions with the Operator confirm that they asked the Complainant’s full name to verify the Complainant’s identity. This was done to follow prior instructions by providing contact information for the Assistant Director of Claims. … These instructions were based on the Complainant repeatedly contacting multiple WCB staff and departments with various concerns about the administration of [their] injury claim.
[18] WCB asserted in its submission that the authority to collect and use personal information is established by The Workers’ Compensation Act, 2013 (WCA).[8] Specifically, WCB claimed that section 44 of the WCA imbued the government institution with the authority to collect the name of a worker who seeks claims for compensation. Section 44 of the WCA states:
44(1) Subject to section 46, no compensation is payable to a worker or worker’s dependent unless:
(a) except in the case of the death of the worker, the worker serves notice of the worker’s injury to the worker’s employer and the board as soon as possible after sustaining that injury and before the worker has voluntarily left the worker’s employment; and
(b) the claim for compensation is made within six months after:
(i) the date the worker sustained the injury; or
(ii) in the case of death, the date of death.
(2) A notice required pursuant to subsection (1) must:
(a) state:
(i) the name and address of the worker;
(ii) the cause of the injury; and
(iii) the place where the injury happened; and
(b) include any proofs of the claim that the board may require.
[19] It is undisputed that, at the material time, the Complainant was an existing WCB claimant. Based on representations provided by WCB, and in material forwarded to our office by the Complainant, it is also undisputed that the Complainant had a history of making repeated and heated calls to WCB employees. The WCB Operator had been directed to verify the Complainant’s first and last name so that the call could be directed to a specific employee at WCB who was familiar with the Complainant’s file.
[20] In these circumstances, the WCB Operator’s attempt to verify the Complainant’s identity was reasonable. It was necessary to verify the Complainant’s identity to ensure an appropriate response from those who were familiar with the concerns connected to the claim file. OIPC has previously established that collecting personal information in order to verify an identity is authorized by section 25 of FOIP.[9] There was no privacy breach on these facts.
[21] WCB relies upon Authority for Disclosure (PRO 24/2024). This policy properly requires staff to verify the identity of the person on the telephone and offers options should a caller wish to remain anonymous. The procedure states:
When staff are unsure of the identity of a person on the telephone, information should not be provided. Instead, one of the following alternatives should be used:
-
- Call back to a number already on the claim or employer account,
- Email the requested information to an address already on the claim or employer account,
- Fax the requested information to a number already on the claim or employer account, or
- The caller should be advised to make their request in writing.
[Emphasis added]
[22] We have found no privacy breach on this set of facts. But we note that the above procedure was not observed. Had the WCB Operator followed the above policy, the call would have been immediately terminated because the caller was unwilling to offer any information with respect to the nature of the call.
[23] We note the importance of this policy because to engage with a party that refuses to disclose their identity can lead to a privacy breach even when the employee of the government institution makes good faith efforts to assist. The Office of the Privacy Commissioner of Canada (OPC) offered an opinion on a set of facts where a complainant called her bank and wished to remain anonymous. The bank employee who responded to the call noted the caller’s name and phone number from the bank display. The bank employee accessed the caller’s bank account without consent in the course of giving an opinion. This was found to constitute a privacy breach because of the unauthorized use of the complainant’s bank account during the course of the telephone call:[10]
…It was clear, by the nature of her question and the fact that she did not intentionally identify herself … Had she called regarding a specific issue related to her account, the act of calling could be construed as implied consent, and once she was properly identified, her account could have been accessed. As it stood, however, her identity was not verified, and her question, even by the bank’s own admission, was a general one – one which the Commissioner thought would not likely merit accessing the account. In the Commissioner’s view, if the representative called up the account for the purpose of providing good customer service, she should have extended that service by seeking the complainant’s consent before accessing the account…
[24] It is crucial that WCB ensure that all WCB Operators are aware of its procedures for verification of identity. This includes refusing to provide information over the telephone if insufficient detail is not provided by a caller. Those who engage in the services of WCB must bear a reasonable level of responsibility to engage in good faith when engaging in discussions with respect to their file.
III FINDINGS
[25] OIPC has jurisdiction to conduct this investigation under PART IV of FOIP.
[26] Personal information was involved pursuant to sections 24(1)(k)(i) and (ii) of FOIP.
[27] No privacy breach under FOIP occurred in this set of facts.
IV RECOMMENDATION
[28] Within 30 days of the issuance of this Investigation Report, WCB should send a reminder to all WCB Operators to follow Authority for Disclosure (PRO 24/2024) and to refuse to provide information over the telephone if insufficient detail is not provided by a caller to verify identity.
Dated at Regina, in the Province of Saskatchewan, this 28th day of August, 2026.
Grace Hession David
Saskatchewan Information and Privacy Commissioner
[1] The Freedom of Information and Protection of Privacy Act, S.S., 1990-91 c F-22.01, as amended.
[2] The Freedom of Information and Protection of Privacy Regulations, RRS c F-22.01, Reg 1, (effective April 1, 1992) as amended.
[3] The use of square brackets in this Investigation Report are amendments by OIPC to preserve the identity of the Complainant and other individuals.
[4] OIPC Investigation Report 099-2025 at paragraph [11].
[5] OIPC Investigation Report 303-2025 at paragraph [45].
[6] Ibid.
[7] OIPC Investigation Report 015-2025 at paragraph [36].
[8] The Workers’ Compensation Act, 2013, SS 2013, c W-17.11, as amended.
[9] OIPC Investigation Report 074-2020 at paragraph [25].