Best Practices for Administrative Tribunals When Publishing Decisions

Best Practices

Best Practices for Administrative Tribunals When Publishing Decisions

The proceedings of administrative tribunals often involve sensitive issues such as alleged wrongdoings and traumatizing incidents. Personal information/personal health information can be disclosed during such proceedings.

Administrative tribunals may publish decisions or notices of hearings publicly, such as on their websites. This may be because they have a statutory obligation to post decisions. They may also post decisions to help the public understand the tribunal’s role and how it decides cases. Reading decisions is a good way for citizens to better understand their own rights or the operations of the tribunal. Publishing decisions, then, can be an effective way for an administrative tribunal to be open, accountable and transparent. Written decisions that are published may contain personal information/personal health information, which can have implications for those named or referred to in the decision.

Everyone has access to a decision that an administrative tribunal makes public. If a decision contains personally identifying information, the public can take that information out of context. In such cases, individuals may lose control over how their personal information/personal health information is used or where it is shared, such as by the media or on social media. Individuals may also be exposed to harms including identity theft and reputational damage. Administrative tribunals should consider how to minimize such risks when publishing decisions.

Publishing a decision will not be the same for every administrative tribunal, and how the individual tribunal posts its decision may vary depending on the circumstances. These guidelines will help administrative tribunals consider how they publish decisions and how privacy laws may apply.

 

The Open Court Principle and Administrative Tribunals

According to the open court principle, the courts should be open to public scrutiny to ensure the proper administration of justice. The Supreme Court of Canada has clearly articulated the public’s right to access the courts except in certain circumstances, such as if there is a publication ban (Sherman Estate v. Donovan, [2021] SCJ No 25 (QL)).

Administrative tribunals in Saskatchewan include boards, commissions, appeal committees and other administrative bodies. The government creates them to carry out decision-making responsibilities as part of Saskatchewan’s legal system. In so doing, they make decisions that affect the public. They may:

  • Make decisions on individual rights or resolve disputes between parties.
  • Have a regulatory, administrative or policy-making role.
  • Be a quasi-judicial body that carries out its decision-making similar to the courts.

Administrative tribunals differ from courts in that they:

  • May be subject to Saskatchewan’s freedom of information and protection of privacy laws.
  • Often have citizens appear without legal representation and without knowledge of applicable privacy laws.
  • Are not typically dealing with issues where there can be penal consequences.

 

Privacy Laws that May Apply to Administrative Tribunals

To be accountable when publishing a decision or making it public, an administrative tribunal may want to apply the open court principle. While courts are not subject to access and privacy laws, administrative tribunals in Saskatchewan may be subject to one or more of the following access and privacy laws:

  • The Freedom of Information and Protection of Privacy Act (FOIP), which applies to government institutions (e.g., ministries, Crown corporations, government agencies, etc.).
  • The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP), which applies to local authorities (e.g., school boards, libraries, the police, rural municipalities, cities, towns, etc.).
  • The Health Information Protection Act (HIPA), which applies to trustees.

Organizations that fall within the scope of these laws are required to collect, use and disclose personal information/personal health information in accordance with the applicable access and privacy law. An administrative tribunal should know and understand its statutory authority to collect, use and disclose personal information /personal health information.

 

Personal Information

  • Personal information is defined at subsection 24(1) of FOIP and subsection 23(1) of LA FOIP.
  • More broadly, information is considered personal information if it is about an identifiable individual and is personal in nature.
    • “Identifiable” means you can identify the individual from the information, or it is reasonable that you can identify them.
    • “Personal in nature” means belonging to a natural person or affecting their personal rather than professional life.
  • Examples of what could constitute personal information include information about an identifiable individual’s:
    • Race, national or ethnic origin, colour or religious or political beliefs/associations.
    • Age, sex, marital or family status.
    • Educational, financial, employment or criminal history, including criminal records or if a pardon has been given.
    • An identifying number or symbol or other particular that is assigned to the individual.
    • Name, home or business address.
    • Personal views or opinions, except if they are about someone else.

 

Personal Health Information

  • Personal health information is defined at subsection 2(1)(m) of HIPA. It is treated as personal information under LA FOIP, unless the local authority is also a trustee under HIPA (e.g., the Saskatchewan Health Authority).
  • HIPA defines personal health information as the following:
    • Information with respect to the physical or mental health of the individual.
    • Information with respect to any health service provided to the individual.
    • Information respecting the donation by the individual of a body part or bodily substance, or information derived from testing or examining a body part or bodily substance.
    • Information collected while providing health services or incidentally to providing health services.
    • Registration information, which includes an individual’s Saskatchewan health number and any other information, such as the individual’s address or phone number, a trustee collects for the purpose of registering the individual for a health service.

 

The Health Information Protection Regulations, 2023, further defines personal health information to include genetic information that includes information about an individual’s genetic test results/testing, the genetic test results of an individual’s family members, and the individual’s family medical history.

Need-to-Know and Data Minimization

If you are an organization that is subject to Saskatchewan’s access and privacy laws, collecting, using, and disclosing personal information/personal health information are always subject to the “need-to-know” and “data minimization” principles. These principles underlie PART IV of FOIP, LA FOIP and HIPA:

  • The “need-to-know” principle is the rule that personal information/personal health information should only be available to those in an organization who have a legitimate need to know that information to deliver the organization’s mandated service. Identifying “need-to-know” requires an organization to consider what data elements it requires and to separate out those that it does not for the identified purpose. Administrative tribunals should also only allow those who have a “need-to-know” to have access to personal information/personal health information.
  • The “data minimization” principle is the rule that organizations should only collect, use and disclose the least amount of personal information/personal health information necessary for the purpose. Disclosure is occasionally mandatory but is most often discretionary, or there is discretion to disclose the least amount of identifying information required for the purpose. When publicly posting decisions, administrative tribunals should take care to disclose only the amount of personal information/personal health information necessary for the purpose.

 

Public Interest Considerations for Disclosure of Personal Information

In Saskatchewan, public interest considerations are found in FOIP, LA FOIP and HIPA. None of these laws has a general public interest override, such as ones found in the privacy laws of other jurisdictions. For example,

  • In HIPA, a public interest override is found in a limited way connected to the disclosure of personal health information for research purpose if the research project is not contrary to the public interest.
  • In FOIP and LA FOIP, public interest overrides are found in relation to the disclosure of third party business information, and to the disclosure of personal information.

This section focuses on public interest overrides found in FOIP and LA FOIP in relation to the disclosure of personal information. In FOIP and LA FOIP, a public interest override applies to the disclosure of personal information:

  • For research or statistical purposes if the head is satisfied the purpose for disclosing supports the public interest and there is no other way to provide it except in an identifying way and if the person receiving it agrees not to subsequently disclose it.
  • For any purpose if the head determines the public interest in disclosure clearly outweighs any resulting invasion of privacy, or if the head determines that disclosure would benefit the individual.

When considering if personal information should be disclosed in the public interest, an administrative tribunal should determine:

  • The types of personal information involved (as defined by FOIP or LA FOIP).
  • If there is an actual public interest.
  • If disclosure would clearly outweigh any invasion of privacy.

Note that a public interest does not automatically exist when the media is involved.

Once identifying the types of personal information involved, an administrative tribunal should consider if there is a public interest. There is a difference between what is “in the public interest” and what is “interesting to the public.” The public interest means the interest of the public or group of individuals and not the interest of only one individual. Public interest is a matter of degree and balance. To determine if there is a public interest, consider the following:

  • Will disclosure contribute to the public understanding or debate/resolution of a matter or issue that concerns the public, or that would concern the public if they knew about it?
  • Will disclosure contribute to the open, transparent functioning of the tribunal?
    • Will disclosure show or support how the tribunal reached its decision?
    • Will disclosure shed light on the tribunal’s activities?
    • What are the factors in favour of disclosure versus not disclosing? What benefits would the tribunal derive?
    • Is there a public interest in not disclosing the information, such as if it would limit democratic participation or prevent witnesses from coming forward?

Lastly, would disclosure clearly outweigh any invasion of privacy. This means that disclosure could have more importance than an individual’s right to privacy. Administrative tribunals should consider the sensitivity of the personal information, what the affected person expects (e.g., did they intend for the information to remain private) and the probability or degree of injury that would result from disclosure. Injury can include physical injury, reputational injury or harm, or financial harm.

If an administrative tribunal posts a decision to satisfy the public interest, it should consider what amount of personal information it is authorized to post and what is necessary to satisfy this interest.

Recommended Best Practices for Posting Decisions

Administrative tribunals should always identify their statutory authority to post any personal information/personal health information when publicly posting decisions.

  • If there is no statutory requirement to publicly post decisions or to disclose personal information/personal health information, then administrative tribunals should consider not doing so.
  • If there is statutory authority to publicly disclose personal information/personal health information, then administrative tribunals should assess whether the disclosure is necessary. This includes identifying if there is a public interest in disclosure because it will inform or protect the public on an issue or serve to deter future misconduct. It also necessitates considering if doing so outweighs any invasion of privacy that would result, including harms or risks, to identified or identifiable individuals (e.g., identity theft, reputational risk).
Ways to Limit Disclosure of Personal Information/Personal Health Information

Whether an administrative tribunal has a statutory requirement or some other reason to consider posting a decision publicly, the following are ways to limit disclosure of personal information/personal health information when such information is not necessary to further the tribunal’s decision or mandate.

  • Determine what personal information/personal health information may or may not be necessary to support the written decision. Consider not posting names and other identifying details if not required or if not relevant to support the decision.
  • Tips to de-identify personal information/personal health information when posting, include:
    • Using pseudonyms or initials.
    • Keeping personal information/personal health information in a separate index or report provided only to the parties involved.
    • Excluding birth dates or ages.
    • Excluding the specific dates of events.
    • Excluding details such as workplace or address or use general descriptions instead. Consider that it may be easier to identify an individual in a small town of 500 people versus a city of 200,000.
    • Excluding sensitive information or unique details/circumstances that may easily lead to identifying someone, or that may embarrass or cause someone to be harmed in some way.
    • Excluding details that could lend to identity theft, such as bank details, driver’s license numbers or social insurance numbers.
    • Excluding details such as the names of businesses, health care organizations/facilities, etc.
    • Excluding marital status, sexual orientation, national origin, criminal status or history, medical status or history unless these are relevant or necessary details to include.
  • Consider writing decisions in a de-identified manner from the start to the extent that this is possible.
  • Consider the accuracy of the information.
  • Consider the roles individuals in a decision play (e.g., family members, witnesses) and if they need to be identifiable or not in a decision that is posted.
  • Consider using technologies (“robot exclusion protocols”) that limit the indexing of search results by well-known search engines, such as Google.

An administrative tribunal should always advise participants ahead of time what personal information/ personal health information may need to be disclosed or posted, and how the tribunal will handle or treat this type of information. Advise participants how or if personal information/personal health information will be posted or published. Also advise participants what recourse an individual may have if they do not agree with how personal information/personal health information will be posted or their ability to make a submission in this regard.

Policies, Procedures and Training

Tribunals may want to hire a privacy officer or engage a privacy expert who has knowledge of applicable access and privacy laws. Such experts can help develop policies and procedures that guide decision-making, and who also provide training.

Policies and procedures (or guidelines) should be publicly available, so citizens are aware of how the tribunal makes decisions on handling personal information/personal health information and publishing decisions. Policies and procedures should cover:

  • The tribunal’s legal authority.
  • The types of personal information/personal health information the tribunal may need to disclose in given circumstances.
  • The types of personal information/personal health information the tribunal regularly deals with.
  • How the tribunal will protect personal information/personal health information and what methods it will use to do so (e.g., using pseudonyms or aliases, masking, not including certain types of data or details, etc.).
  • How citizens will be informed of a tribunal’s decision-making processes and any recourse citizens may have if they do not agree with how information will be posted.
  • How and where the tribunal will post its decisions.
  • How tribunal members are expected to manage personal information/personal health information and the obligations they have to protect personal information/personal health information under Saskatchewan’s privacy laws.
  • Training requirements for tribunal members that includes obligations members have to protect personal information/personal health information.

Related Resources

For related resources, see:

 

Contact Information

If you have any questions regarding this guidance document, please contact the IPC at:

306-787-8350 | toll free 1-877-748-2298

503 – 1801 Hamilton Street | Regina SK S4P 4B4

intake@oipc.sk.ca |  www.oipc.sk.ca  |  @SaskIPC  |  Linkedin

 

 

 

 

Back to Resource Directory

Was this page helpful?