HomeMy WebLinkAbout2010-2318.Myciak et al.15-12-29 DecisionCrown Employees
Grievance Settlement
Board
Suite 600
180 Dundas St. West
Toronto, Ontario M5G 1Z8
Tel. (416) 326-1388
Fax (416) 326-1396
Commission de
règlement des griefs
des employés de la
Couronne
Bureau 600
180, rue Dundas Ouest
Toronto (Ontario) M5G 1Z8
Tél. : (416) 326-1388
Téléc. : (416) 326-1396
GSB#2010-2318
UNION#2010-0252-0010
IN THE MATTER OF AN ARBITRATION
Under
THE CROWN EMPLOYEES COLLECTIVE BARGAINING ACT
Before
THE GRIEVANCE SETTLEMENT BOARD
BETWEEN
Ontario Public Service Employees Union
(Myciak et al) Union
- and -
The Crown in Right of Ontario
(Ministry of Community Safety and Correctional Services) Employer
BEFORE Felicity D. Briggs Vice-Chair
FOR THE UNION Christopher Bryden
Ryder Wright Blair & Homes LLP
Counsel
FOR THE EMPLOYER Jonathan Rabinovitch
Treasury Board Secretariat
Labour Practice Group
Counsel
HEARING July 13 and September 21, 2015
- 2 -
Decision
[1] On November 29, 2011 Eugene Myciak and a number of other members of staff
at the Niagara Detention Centre filed a grievance that said:
I/we grieve the Employer is in violation of, but not limited to,
Preamble, Article 2 (management rights) of the Collective
Agreement and any other Act, Regulation or Policy pertaining to
privacy. The Employer is also in violation of the Personal Health
Information Protection Act, and the Freedom of Information and
Protection of Privacy Act. The Employer electronically posted
sensitive information of a private and confidential nature on the “P”
(public) drive of the institution’s computer network, regarding
employee WSIB claims. The Union requests disclosure of all
affected staff under Article 22.14.5 (Grievance Procedure).
[2] By way of remedy the grievors requested amongst other things, a “thorough
investigation by an independent agency outside of the Corrections Division” and
financial compensation for those affected.
[3] It was ultimately agreed by the parties that this matter should be determined
under Article 22.16 and therefore this decision is without precedent or prejudice.
The parties also suggested that a short decision would suffice with a “bottom
line”.
[4] The parties entered a partial agreed statement of fact. It is useful to set out these
facts in total in order to provide not only a summary of what occurred but also a
summary of the position of the parties regarding this alleged breach. The agreed
facts regarding the circumstances that gave rise to the filing of this grievance
were:
a) These proceedings arise from a group grievance filed by Correctional
Officers and other staff members working at the Niagara Detention
Centre (NDC).
b) In and around July 2010, the Union alleges that it came to the attention
of several staff members that a folder on the institution’s “P” intranet
drive contained compensation materials and WSIB forms and other
information on NDC employees.
- 3 -
c) The Union takes the position that access to the folder was unrestricted
and accessible to staff members at NDC.
d) Shelly Morrish-Paradis, a Cook III contacted Tizanna Testana, the
Office Manager, as well as Tom Dykstra, then Acting Deputy
Superintendent of Administration to advise them of the situation. This
occurred on July 10 or July 15, 2010.
e) The Employer takes the position that, immediately upon being advised
of the situation, Ms. Testana did check the drives and determined that
the folder in question was secured and that access was password
authorized. The Union is holding the Employer to the strict proof of this
assertion.
f) The Union takes the position that, over the month of July, 2010,
numerous employees spoke to then Local President Eugene Myciak
and expressed concern and outrage regarding the accessibility of their
private information on the public P drive. The Employer is holding the
Union to the strict proof of these assertions.
g) Mr. Myciak looked into the matter, and sent an email to DS Dykstra on
Civic Holiday Monday, August 2. For ease of reference, Mr. Myciak’s
email is produced below:
As Local President it has been brought to my attention that there
are a total of 482 files in 24 folders (of which 310 files are personal
WSIB reports of numerous officers, managers, kitchen and health
care staff) on the “P” or public drive, which is accessible to all
employees in the facility.
Included in this list are the WSIB monthly reports from 1998
through to 2008; 9 letters to WSIB concerning various staff
members dating back several years; the institution phone list.
Of the 319 WSIB forms: they are held in 12 folders and cover the
period of time 1999 to 2010 inclusive, many of which include Social
Insurance Numbers amongst other personal information.
This main folder, labeled WSIB on the public drive, was created
Tuesday October 27, 2009 at 10:36:50 am and contains 482 files,
24 folders, is 57.7 MB in size and consumes 58.6MB of disk space
and is marked ‘Read Only’.
A number of staff brought this to my attention and all of them have
expressed outrage at what they perceive to be a breach of their
privacy.
Presently I am considering the options available to these affected
members and will advise them accordingly.
- 4 -
I trust that these files will be preserved for whatever outcome that
may demand their disclosure, but that they will become
inaccessible to all employees as soon as possible.
h) In response to the email, the Employer looked into the matter and
access to the folder was restricted Tuesday August 3, 2010. The
Employer then issued letters to all former and current employees who
had files on the drive and took steps to inform the Information and
Privacy Commissioner. The Union holds the Employer to the strict
proof of establishing what steps, if any, the Employer in fact took to
advise the Information and Privacy Commissioner.
i) On August 15, 2010, Mr. Myciak emailed then Superintendent Barry
McDonnell enquiring as to whether he can or should be contacting
individuals who were no longer with the Ministry but whose private
information may have been disclosed on the “P” drive. Mr. Myciak
noted that he was “unsure as to the standing of these individuals with
respect to FIPPA”.
j) Further emails between Mr. Myciak and Mr. McDonnell (and other
members of administration) followed on August 16, and 26 – 30, 2010.
k) In early August, 2010, a CISU investigator was appointed to look into
the posting of the impugned information on the P drive. The CISU
Report was finalized on or around December 15, 2010.
l) The CISU investigation determined that, as a result of the Ministry’s
and the Institution’s IT and record-storage practices, it would not be
possible to recover the required information, nor would it be possible to
identify precisely when the information was transferred nor who did it,
or why.
m) The CISU Investigator also noted that since the “files were located on
a public [sic] accessible area, anyone with access to that area could
have accessed modified, moved or copied the files contained in the
WSIB folder”. The Union takes the position that, as Mr. Myciak noted in
his email referenced above, the folders and documents were also
marked as “read-only”, meaning that they could not in fact be
accessed, modified or moved as the CISU concluded.
n) On April 26, 2011, the CISU provided an addendum to its report dated
December 15, 2010, as a result of the back-up server tapes for NDC
becoming located. The addendum noted that as part of its analysis it
“attempted to compare the before and after state of the servers, but
since an image of the new server was not taken following the refresh
this was not possible, making it difficult to ascertain whether the
permissions were changed during the refresh process or sometime
after”. As a result, the CISU determined that a conclusion as to when
- 5 -
the alteration of the permissions occurred cannot be established” and
that the file should be closed. The Union takes issue with the CISU’s
assertion that a conclusion could not be reached, as the CISU noted
that it would be “difficult” to determine when the permissions were
changed, not that it was impossible or could not be performed.
o) The Union takes the position that numerous members were extremely
upset and discouraged about the disclosure of their WSIB information
on the P drive. Several of those members will testify in this matter as
representative witnesses to support the Union’s claim for damages on
behalf of the grievors.
p) In June 2011, the Employer circulated a memo to all Regional
Directors titled “Safeguarding Personnel Information”.
[5] In addition to the agreed statement of fact, three witnesses testified. Mr. Myciak,
Ms. Morrish-Paradis and Ms. Testana.
[6] Mr. Myciak testified that he first heard of the breach in July of 2010 from a fellow
Correctional Officer who referred him to Ms. Morrish-Paradis. When he spoke
with her she was upset and told him that her WSIB information and file was
available on the P drive. Ms. Morrish-Paradis told him that she had complained
to her manager who “told her it was not a big deal”. The same or following day
Mr. Myciak went to a computer in the workplace and found the WSIB information
“on all the employees” on the P drive.
[7] Mr. Myciak wrote an email to the Superintendent “probably another week or ten
days later” on August 2, 2010. He stated that he informed management on the
Friday before the long weekend and it was dealt with on the following Tuesday,
that is, the day after a holiday weekend. He testified that during this time he was
approached by many of his coworkers about the breach. He stated that he
became concerned that employees would suffer harassment as the result of their
health information becoming known in the workplace; because they could suffer
identity theft; and because employees’ Social Insurance Numbers were revealed.
[8] In cross examination Mr. Myciak conceded that he spoke with one manager on
the Monday of the holiday weekend and then wrote his email at the end of that
- 6 -
day, not the Friday before the long weekend. He also agreed that the matter was
dealt with the following day. He accepted the suggestion that to his knowledge
no one had suffered identity theft, no one had any private information used
inappropriately and no one suffered any harassment or financial harm.
[9] Ms. Morrish-Paradis testified that she thought the information was available on
the computer on July 10th but she was not sure and had no documentation to
assist her recall. Another employee told her about the information being
available on the computer. She then checked a computer and found her own
WSIB information on the P drive. During the course of her evidence she
admitted to being “computer illiterate” at the time. After finding her information on
the P drive she complained to Ms. Testana, her manager, who told her she would
look into it. Later that same day Ms. Morrish-Paradis spoke again with Ms.
Testana who told her that the information could only be obtained with a
password. Ms. Morrish-Paradis took issue with that assertion because when she
attempted to find her own information again she could still access the
information. Ms. Morrish-Paradis testified that during this later discussion she
thought that Ms. Testana found the information accessible without a password.
She also said in her evidence that she was of the view that Ms. Testana thought
that the entire situation was “no big deal”.
[10] Ms. Morrish-Paradis said that the information was available for well over a week.
She checked the computer later and found she could still access the files. She
later complained to Mr. Drykstra and Mr. Myciak.
[11] She testified that she felt violated because her personal information was “out
there” for all to see. She conceded in cross examination that she did not
experience any harassment but was quick to say that this was perhaps because
staff were very conscientious about not accessing information that was not
needed in the course of one’s duties in accordance with Ministry policy. She said
it was known that such activity could bring about a suspension or termination of
employment.
- 7 -
[12] Ms. Testana testified that on July 15, 2010, when Ms. Morrish-Paradis first spoke
with her about this matter she stopped what she was doing and immediately
conducted a search on the P drive. She undertook her own investigation using
various search strings and could not find any documents with Ms. Morrish-
Paradis’ name that were improperly secured.
[13] Ms. Testana testified that she took Ms. Morrish-Paradis’ complaint seriously
because if any of her own documents had been accessible she would have been
very upset. She spent the rest of the day attempting to find a breach and
rechecked the situation from time to time over the following few days but found
no instance when WSIB files were accessible without a password.
[14] Ms. Testana notified the Superintendent and Deputies of the breach and was told
to continue her search and keep management updated. She was not involved
further in this matter.
[15] The parties set out their positions briefly in the agreed statement of fact
document. Those submissions were elaborated further at the hearing but are well
summarized as follows:
THE PARTIES’ RESPECTIVE POSITIONS IN BRIEF
• The Union takes the position that the disclosure or posting of
employees’ private medical information on the institution’s P drive
gives rise to a breach of the Collective Agreement, including Article
9 and 41, as well as a violation of PHIPPA, including but not limited
to ss. 29 and 31; the WSIA, including but not limited to section
37(4), 59(6), and 181(3), and; FIPPA, including but not limited to ss.
41, 42 and s. 4 of Regulation 460.
• The Union takes the further position that the availability and
accessibility of the grievors’ SIN and other personal information as
outlined above constitutes a violation of FIPPA, including but not
limited to section 41, 42 and s. 4 of Regulation 460.
- 8 -
• The Union will be taking the further position that the Employer’s
failure to adequately investigate this matter and address its causes
constitutes a violation of Articles 2, 9 and 41.
• The Union will be seeking the following remedies:
o - A declaration that the Employer has breached the
Collective Agreement
o - A declaration that the Employer has violated FIPPA,
PHIPPA, and the WSIA.
o - An award of general damages for each grievor in
respect of the Employer’s violation of the Collective
Agreement and/or statutory provisions cited above
• On a without prejudice basis, the Employer will not argue that the
Board has no jurisdiction to make findings or award damages
pursuant to FIPPA, PHIPPA, and the WSIA in this particular matter.
This is in relation solely to this matter and is without precedent or
prejudice to any other matter between the parties.
• The Employer takes the position that there has been no breach of
any Collective Agreement article. Further, PHIPPA does not apply
to the employer, as the employer is not a health information
custodian under s. 3 of PHIPPA, nor is it a recipient pursuant to ss.
7 and 49. FIPPA does not apply as the documents at issue fall
within FIPPA’s exception for labour and employment related
matters under s. 65(6). In the alternative, in the event that the
Board finds that the Employer has breached the Collective
Agreement, FIPPA, PHIPPA, or the WSIA, the Employer states that
awarding damages would not be appropriate in the circumstances,
and in any event the Employer holds the Union to strict proof with
regard to proving any alleged damages suffered by its grievors.
[16] Much case law was provided by both parties. Although I will not provide a list of
the jurisprudence provided I assure the parties that it was reviewed in total.
Some was of little assistance, but the majority was helpful.
[17] Turning first to exactly what occurred at NDC in the summer of 2010, I am of the
view that there was a breach of employee WSIB information that lasted for a
matter of days and not for a few weeks as suggested by Mr. Myciak.
- 9 -
[18] Ms. Testana’s notes indicate that Ms. Morrish-Paradis approached her on July
15, 2010 and I accept that date. I also accept that Ms. Testana attempted to
ascertain whether there was a breach and found none. Ms. Testana’s facility
with computers was not challenged by the Union and she testified that she
undertook a fairly extensive review that failed to show a breach of confidential
information being universally accessible on the P drive.
[19] I am of the view that the totality of the evidence revealed that there was a breach
either just before or during the August long weekend of 2010. Mr. Myciak testified
that most of the employees that he worked with complained to him about the
breach and were “outraged”. I find it highly unlikely that – given his membership
outrage and concern - he then waited almost two weeks to report this breach to
management. I also note that the report of the CISU ultimately found that the
breach “probably” took place between July 15, and August 2, 2010.
[20] It is not as apparent how it was that Ms. Morrish-Paradis could access her
information during this time. The Employer proposed during oral submissions that
Ms. Morrish-Paradis must have been looking at her own information on the Y
drive. This may be the case, however this suggestion was never put to her in her
evidence and she specifically said that she accessed the P drive. While she
admitted that she was not totally facile with a computer, she certainly appeared
to understand what the P drive was and how it was accessed.
[21] It is possible that there were two breaches of this information, one occurring in
mid July and the second on the August long weekend. But for the purposes of
these grievances, it does not make a meaningful difference.
[22] The Employer was notified in writing by the Union of the accessibility of this
information during the early evening on Monday August 2, 2010. Within less
than two hours the Deputy Superintendent responded to Mr. Myciak saying that
the matter would be his first priority the following morning. The information was
- 10 -
removed from the P drive within twenty-four hours. Once the Employer had
received a written complaint about this leak of information it moved quickly.
[23] I am of the view that the Employer then took all appropriate steps. In an email
exchange between Mr. Myciak and the Superintendent on August 16, 2010 it was
noted that “this matter is the subject of a CISU investigation.”
[24] In an August 26 & 27, 2010 email exchange between Mr. Myciak and the
Superintendent it was stated that the “Employer is in the process of contacting all
current and former staff to advise them of this breach” and “the Information
Privacy Commissioner’s Office has been contacted and briefed.”
[25] The documents provided to this Board revealed that the Employer notified
affected employees of the “matter involving the inappropriate storage of
electronic personal information in relation to Workplace Safety Insurance Board
(WSIB) claims…”. It reported the breach to the Privacy Commissioner of Ontario,
the Office of the Chief Information and Privacy Officer, and the Ministry’s
Freedom of Information and Protection of Privacy Office. Finally it requested the
Correctional Services Investigation Unit to conduct “a comprehensive
investigation into the circumstances of this incident.”
[26] The CISU could not determine who was responsible for the breach. In summary
it found:
It is highly likely, in this particular case, a copy of the file WSIB was
made and placed on the P-drive of the NDC server by an individual
that had access privileges to restricted files which would include a
number of administrative employees. This probably occurred
between July 15, 2010 and August 2, 2010. The reason for this
action, mistake or otherwise, cannot be determined nor can an
individual be identified.
- 11 -
[27] In an addendum to its findings the CISU findings stated:
As part of the analysis process we attempted to compare the before
and after state of the servers, but since an image of the new server
was not taken following the refresh this was not possible, making it
difficult to ascertain whether the permissions were changed during
the refresh process or sometime after.
[28] Following these reports, the Privacy Commissioner wrote to an individual who
had complained and stated the following in part:
On May 3, 2011 I received a report from MCSCS with respect to
this privacy breach. The report included details of their investigation
and their conclusion that MCSCS was unable to determine how the
breach occurred, or who was responsible for it and the report also
explained that as a result of this incident, the Niagara Detention
Centre Superintendent has committed to ensuring that their shared
drive is monitored on a regular basis to confirm that all information
stored on the shared drive continues to have appropriate security
and permission. Lastly the report advised that the MCSCS’s
Correctional and Investigation Security Unit (CISU) Inspector had
recommended that this investigation be closed and that
recommendation had been accepted.
After reviewing MCSCS’s report, I am satisfied with steps taken by
MCSCS to deal with this matter and as a result this complaint file
has now been closed.
[29] The Employer urged that given that the Privacy Commissioner was “satisfied” so
too should this Board. I understand that view, but that is not the end of the
matter. Just because there was a thorough investigation and the breach was
terminated, does not mean that there was not a violation of the Collective
Agreement and various statues in the first instance and the Union is entitled to
have the grievance determined.
[30] It is important to recall that the Union did not allege bad faith or malice. It did not
take exception to the Employer’s characterization of this as an inadvertent
- 12 -
breach. Where the disparity arose is regarding the consequences of such a
breach.
[31] The parties agreed that this decision is without prejudice or precedent and should
be relatively short. While I appreciate that request, I am of the view that it would
be helpful to the parties to understand the reasoning for the ultimate disposition
of this matter.
[32] The Union alleged a violation of Articles 9 and 41 of the Collective Agreement.
Article 9.01 states:
The Employer shall continue to make reasonable provisions for the
safety and health of its employees during the hours of their
employment. It is agreed that both the Employer and the Union
shall co-operate to the fullest extent possible in the prevention of
accidents and in the reasonable promotion of safety and health of
all employees.
[33] I appreciate the Union’s view that the accessibility of personal and health
information of those employees with WSIB files to any and all who cared to sign
into a computer at NDC during one or two periods between July to August period
in 2010 constituted something short of “reasonable provisions for health and
safety” of those employees. It might be observed that putting files containing
information that is highly sensitive regarding health and other personal data on a
public drive even though secured was ill advised in the first instance. The
Employer would remind this Board that the information was generally secured
and not accessible to those without the proper authority. However, the fact of
this grievance reveals that there were exceptions to that general security.
Indeed, the Ministry itself determined within a year to remove “sensitive
personnel information” from the P drive “in support of continuing efforts to
safeguard” the information.
- 13 -
[34] In Re The Crown in Right of Ontario (Ministry of Community & Social Services &
OPSEU (MacLean, More & Union Grievance) GSB#3155/92 (Barrett) the Union
alleged that Article 9 of the Collective Agreement was violated when the
addresses of staff were actively being sought by a young offender and the
Employer took insufficient steps to ensure the grievors’ confidential information.
In upholding the grievance the Board found that the Employer had no
confidentiality policy at the time and failed to teach staff to ensure that the young
offenders could not access private information regarding staff. The Board stated
at page 10:
…..Bargaining unit and contract employees were careless with
private staff information because they were simply not aware
through training or direction of the potential harm that could result.
What was needed, and was finally provided, was direction from
above; but the barn door was not closed until the proverbial horse
had bolted. ……
Employer counsel further argues that the job of a correctional
officer is one that has inherent risks in it and those risks are
voluntarily assumed by the correctional officers. That is true, but
only to the extent of unavoidable risks, not risks that can be
avoided through foresight and planning.
[35] The Union urged that this case has application to the case at hand because while
this Employer had policies in place, it had placed personal employee information
on its P drive. The Employer argued that there was nothing inappropriate about
that information being on the P drive and the fact that it was accessible to any
and all who cared to look was an unfortunate and inadvertent mistake. The
Union accepted that the breach of confidentiality was inadvertent as does this
Board. I think it obvious that the risk of a breach was completely avoidable had
the Employer not placed this information on the P drive in the first instance. This
breach of confidential information was, as considered by Vice Chair Barrett in the
above cited case “foreseeable and avoidable” in my view. However, for reasons
found below, I do not need to make a finding of a violation of Article 9.1 of the
Collective Agreement.
- 14 -
[36] I find that there has been no breach of Article 41 of the Collective Agreement.
This provision sets out various terms regarding the coverage, benefits, payment
and absences but does not address the treatment of personal information of
employees receiving WSIB.
[37] As seen from the Agreed Statement of Facts, the Union also alleged a breach of
the WSIA, the Personal Health Information Protection Act, the Human Rights
Code of Ontario, the Workplace Safety and Insurance Act and the Freedom of
Information and Protection of Privacy Act.
[38] The Employer urged that PHIPA does not apply to the dispute before this Board
as the Employer is not a “health information custodian.” I agree with that
contention. As was noted in Re Revera Long Term Care Inc. & CUPE, Local
2564 (2014), 246 L.A.C. (4th) 340 (Goodfellow), “PHIPA is aimed at health care
providers, not Employers.”
[39] The Employer was prepared, on a without prejudice basis, to concede that this
Board has the jurisdiction to make findings under or award damages as the result
of FIPPA. I appreciate the Employer’s concession in that regard. Like others
before me, I accept that FIPPA is an employment related statute and the
substantive rights and obligations found therein are implicit in this collective
agreement.
[40] In considering this matter I was much guided by the case law provided by the
parties. In Re Government of Alberta (supra), Arbitrator Sims was asked to
determine whether damages should flow as the result of a breach of privacy for a
group of employees. In that case, the Employer ordered a peace officer in its
Special Investigation Unit to investigate possible employee fraudulent activity in a
particular office. The peace officer so assigned undertook credit checks of the
employees without authorization from the Employer in order to determine if
- 15 -
anyone was in financial difficulty. It was ultimately found by the peace officer that
the fraudulent activity was the responsibility of parties outside of the government.
[41] According to the agreed facts in that case the employees reported the breach to
the Province’s Privacy Commissioner and the government conceded that the
searches performed were inappropriate and in violation of the Freedom of
Information and Protection of Privacy Act. After the breach was revealed the
Employer apologized to the affected employees and told them that all records
had been destroyed. The investigation undertaken by the Privacy Commission
found that the breach was unauthorized and carried out in contravention of the
privacy legislation.
[42] In that decision the arbitrator stated at page 7:
Both parties accepted the proposition that, as arbitrator under this
collective agreement, I am entitled to consider a breach of the Freedom of
Information and Protection of Privacy Act as a matter that could be
adjudicated within the principles set out in by the Supreme Court of
Canada in the Weber and Parry Sound decisions. The Union refers to
Article 5 of the collective agreement, providing for management’s rights,
and argues that those rights are circumscribed by the obligation to follow
the law.
28. As a practical matter, this means that the substantive
rights and obligations of employment-related statutes are
implicit in each collective agreement over which an arbitrator
has jurisdiction. A collective agreement might extend to an
employer a broad right to manage the enterprise as it sees
fit, but this right is circumscribed by the employee’s statutory
rights. The absence of an express provision that prohibits
the violation of a particular statutory right is insufficient to
conclude that a violation of that right does not constitute a
violation of the collective agreement. Rather, human rights
- 16 -
and other employment-related statutes establish a floor
beneath which an employer and union cannot contract.
29. As a result, the substantive rights and obligations of the
parties to a collective agreement cannot be determined
solely by reference to the mutual intention of the contracting
parties as expressed in that agreement. Under McLeod,
there are certain terms and conditions that are implicitly in
the agreement, irrespective of the mutual intentions of the
contracting parties. More specifically, a collective agreement
cannot be used to reserve the right of an employer to
manage operations and direct the work force otherwise than
in accordance with its employees’ statutory rights, either
expressly or by failing to stipulate constraints on what some
arbitrators regard as management’s inherent right to manage
the enterprise as it sees fit. The statutory rights of
employees constitute a bundle of rights to which the parties
can add but from which they cannot derogate. (Parry Sound
(District) Social Services Administration Board v. OPSEU
Local 324, 2003 SCC 42 [2003] 2 SCR 157.
[43] In the matter at hand, the Employer made known personal health information of
certain employees known to anyone who cared to log into the P drive of a work
computer. Though this breach was inadvertent, it was an action akin to an
accident waiting to happen. Accordingly, I am of the view that FIPPA has been
breached.
[44] The Employer argued that FIPPA did not apply because FIPPA the documents at
issue fall within FIPPA’s exception for labour and employment related matters
under s. 65(6). I disagree. The exceptions that are set out at Section 65 relate to
the protection of documents “collected, prepared or maintained” by an institution
in relation to:
1. Proceedings or anticipated proceedings before a court, tribunal or
other entity relating to labour relations or to the employment of a
person by the institution.
- 17 -
2. Negotiations or anticipated negotiations relating to labour relations
or to the employment of a person by the institution between the
institution and the person, bargaining agent or party to a proceeding
or an anticipated proceeding.
3. Meetings, consultations, discussions or communications about
labour relations or employment related matters at which the
institution has an interest.
[45] In my view, the intent of those exceptions are to ensure that an employer is not
ham-strung from using information it holds in its possession when facing litigation
or other labour relations proceedings. The health information at issue was related
to WSIA statutory entitlements and does not fit within those articulated
exceptions. It does not forgive the Employer from allowing a circumstance where
disclosure of personal health information it holds about a group of employees to
anyone who logs into a particular computer drive – albeit inadvertently.
[46] The parties also made submissions about whether there have been violations of
various other statutes. In my view, it is unnecessary to make determinations
beyond what is set out above.
[47] For those reasons, the grievance is upheld. In my view, some damages are
owing to those grievors who were employed at the time that the grievance was
filed. I remit this matter back to the parties to agree upon the amount. In the
event this is not possible, the Board should be informed and a short
supplemental decision will be issued – without reasons.
[48] I remain seized.
Dated in Toronto this 29th day of December, 2015.
Felicity D. Briggs, Vice Chair