Confidential Or Statistical Personal Information

An employer must, by law, take appropriate measures to ensure the confidential nature of personal information that he holds with regard to his employees. Quebec statutes applicable to public bodies ¹ and private enterprises ² define "personal information" as follows: any information which relates to a natural person and allows that person to be identified.

Within a public body or an enterprise, only those employees for whom it is necessary in the performance of their duties are entitled to use personal information held by their employer without the consent of the person concerned. Likewise, no information may be conveyed to a third party without such consent except in the cases of exceptions provided for by law.

In this age of new technologies, several employers compile and keep information about their employees on a data storage medium, in a human resources database. Reports required for file management and follow up are generated from such databases which are divided into several categories of information (various sorting factors), the number of which vary depending on the nature, extent or degree of complexity of the public body's or enterprise's management process. Quite often, reports do not contain the employees’ names or their social insurance numbers. At first glance, this might imply that the information contained in such a report no longer meets the definition of the phrase "personal information", that the previously described constraints regarding the use or the communication of personal information no longer exist and that the report may circulate more freely.

WRONG!

Information contained in a computerized report is personal information from the moment it relates to a physical person and it offers the means, opportunity or possibility of identifying this person, with or without the assistance of other information. To determine if such a possibility of identification exists, the report must be examined in light of its content and the characteristics of the public body or enterprise concerned and its manpower.

The decision rendered on March 1, 2001 by the Commission d'accès à l'information in the case of Fédération de la santé et des services sociaux c. Ministère de la santé et des services sociaux ³ clarifies our remark.

In accordance with the Act respecting access to documents held by public bodies and the protection of personal information (the "Act"), the union applied to the Ministry for access to a copy of a database held by the latter. This database was used to compile statistics on employees working in the health and social services network. It included 69 categories of information on 225,000 employees working in more than 500 establishments. Of the 69 categories, the union withdrew its request for information regarding the category "employee number".

The Ministry refused to comply with the request maintaining that information contained in the database was personal information, the confidential nature of which it must ensure and that it could not convey such information without the consent of the employees concerned.

The Commission d'accès à l'information examined each category of information in light of the evidence adduced, taking into consideration the fact that certain information relating to public sector employees is public pursuant to the Act (which is generally not the case for employees working for a private enterprise). It pondered over which of the 68 categories of information requested that included the database could be communicated without any possibility of identifying the person or persons concerned. It decided that only 16 of the 68 categories examined met this requirement.

It therefore partially granted the union’s request for access and ordered the Ministry to communicate, on computer-based support, the information under the 16 categories, all other information being personal and confidential.

Quebec legislation respecting the protection of personal information includes provisions that define the scope of the exercise of fundamental rights recognized by the Charter of Human Rights and Freedoms and by the Civil Code of Quebec, namely the right to the safeguard of reputation and the right to privacy. Any violation of these rights is likely to incur the liability of the employer who risks having to pay some compensation for damages sustained because of his fault. Furthermore, any illegal and intentional violation gives rise to a recourse for exemplary damages (punitive damages).

Before allowing employees to consult a report generated from a database or before communicating this report to any person without the consent of the employees concerned, the employer must seriously ask himself if any "personal information", the confidentiality of which he is bound to ensure, has been deleted from the report.

1. An Act respecting access to documents held by public bodies and the protection of personal information, R.S.Q., c. A-2.1.
2. An Act respecting the protection of personal information in the private sector, R.S.Q., c. P-39.1.
3. C.A.I., March 1, 2001, file 99 18 53.