Making a Privacy Complaint for Someone Else?
Often, our office is contacted by individuals who are concerned about the inappropriate disclosure of personal information that is not their own. If this is you, then perhaps you are attempting to complain on behalf of a loved one; or you’ve received the personal information of a stranger, and you’re willing to go out of your way to report the matter in hopes of having it rectified.
There are many reasons why our office may determine that it is unable to proceed with privacy concerns that individuals bring to our attention (see “Why some reviews and investigations cannot pass go” for some discussion of these reasons), but, in the aforementioned scenarios, the absence of the affected individual is an immediate obstacle.
That is because your privacy rights under the legislation that our office oversees (The Freedom of Information and Protection of Privacy Act, The Local Authority Freedom of Information and Protection of Privacy Act, and The Health Information Protection Act) extend to the collection, use, and disclosure of your own personal information or personal health information by public bodies and health trustees. As a result, although you can still inquire regarding the process that an affected individual must follow in submitting a privacy complaint, you will probably not be in a position to actually submit a complaint on behalf of anyone else.
If you know someone whose privacy has been breached, you may be in a position to serve as a witness, but they will likely need to make their own complaint, first to the public body or health trustee, and only then, if they are unsatisfied with the response that they receive to that complaint, to our office.
Similarly, if you have received personal information that is not your own, you should first report it to the Privacy Officer of the public body or health trustee from which it originated and allow them an opportunity to rectify the situation before reporting it to the IPC.
That said, any right conferred by FOIP, LA FOIP, or HIPA can be exercised by a surrogate under specific conditions, usually explicit permission from the affected individual. If you wanted to submit a complaint on behalf of a child, for example, you may need to demonstrate through documentation that you are the child’s legal custodian (see FOIP section 59, LA FOIP 49 and HIPA section 56). If any adults were to grant you permission to pursue a privacy complaint on their behalf, this permission would have to be in writing and very specific regarding the powers and scope that it conferred and the time at which it was intended to expire.
From time to time, the Commissioner does become aware of a breach that he chooses to research or investigate on his own initiative. However, these “own motion” investigations are rare and typically relate to breaches involving a large number of affected individuals and/or more expansive, serious, or recurring problems (e.g., misdirected faxes).
So, although you can be of assistance when you learn that someone else’s privacy has been breached, it is usually necessary for the affected individual to exercise their own rights.