Yukon Information and Privacy Commissioner
Procedures for Managing Complaints and Requests for Review
An individual who has submitted an access request to the ATIPP Office can make a complaint about the response that they received. Complaints about an access request response can include:
• Some of the information in the response has been withheld.
• Access has been refused to all information requested.
• The public body performed an inadequate search for records.
• The response is late.
A third party who is notified that their personal or business information will be released by a public body to an applicant who made an access request can complain. These complaints must be submitted at least five business days before the response date for the access request.
The IPC can also accept complaints about decisions made by the Access and Privacy Officer (the ATIPP Office) after an access request has been submitted, including:
• A decision to refuse to process an access request.
• No response has been provided by the ATIPP Office within 10 business days after the access request was submitted.
• A decision to extend the due date of an access request.
• A decision to deny a fee waiver.
• A decision to declare an access request abandoned.
• A dispute about the fee estimated for an access request.
The IPC can investigate complaints that relate to the privacy rights. These include the following:
• Personal information has been collected by a public body contrary to the ATIPP Act.
• Personal information has been used by a public body contrary to the ATIPP Act.
• Personal information has been disclosed by a public body contrary to the ATIPP Act.
• A privacy breach has occurred involving a complainant’s personal information.
Personal Information Correction Complaints
Under the ATIPP Act, an individual has a right to request a correction of any personal information held by a public body, including where the information is not accurate or if information is missing. The IPC can investigate complaints about this process, including:
• If an individual does not receive a response correction.
• If the request for correction of an individual’s personal information has been denied.
Informal Case Resolution (ICR)
Informal Case Resolution
All complaints received by the IPC will initially be managed through our Informal Case Resolution (“ICR”) process unless a decision is made to proceed directly to a formal investigation. ICR generally allows for a faster resolution, and will take no longer than 60 days. Our procedure for managing complaints through ICR is as follows:
An Investigator from the ICR Team speaks with a public body contact, and provides all parties with information about the complaint in an opening letter.
The Investigator and the public body contact discuss the complaint to reach a resolution.
If a resolution is reached, the Investigator provides details on this in a closing letter, and provides a copy to all parties. The ICR Investigator may make informal recommendations as part of the resolution for the file.
The Investigator follows up as necessary with the public body to ensure that any informal recommendations that were made have been implemented.
A case summary may be published for complaints resolved through ICR if it is determined that there is educational value. Public bodies and complainants are not named in case summaries. Statistics about ICRs will be published in the Annual Report of the IPC, and examples may be cited.
If resolution does not occur within 60 days, the Investigator will send a letter informing the parties of the outcome. If a file is not resolved through ICR, the IPC may conduct a formal investigation.
A complaint may proceed to a formal investigation in the following circumstances:
• Resolution unsuccessful: The complaint could not be resolved through ICR.
• Serious or complex: A complaint does not lend itself to ICR due to the seriousness of the complaint or complexity, such as a systemic complaint involving multiple complainants.
• Educational purposes: There is a need to raise awareness through publication of an investigation report about the requirements of the ATIPP Act.
• Precedent required: The IPC decides upon receiving the complaint that it will proceed directly to investigation because there is a need to clarify the interpretation of a provision of the ATIPP Act at issue.
A formal investigation may take between 90 – 150 days to complete. Our procedure for managing a formal investigation is as follows:
The registrar prepares a notice of investigation for the parties, and sends it along with instructions for submissions. The registrar works with the parties to finalize and circulate the submissions and any replies.
Once the submissions and replies are received, the registrar provides all evidence relevant to the investigation to the IPC. The IPC analyses the evidence and relevant law and makes findings of fact and law arising in the course of the investigation.
The IPC prepares a report containing findings, any recommendations to remedy a finding of non-compliance with the ATIPP Act, and reasons for the findings and recommendations. In the report, the IPC also advises the public body of its requirement to give written notice of its decision about whether it will follow the recommendations and inform the parties of their right to appeal.
4. Parties are informed.
The registrar distributes the report to the parties involved in the investigation.
If recommendations are included in the report, the IPC receives the public body’s decision about whether it will follow the recommendations within the time period required. If the public body does not respond in time, the IPC will notify the parties that the public body is deemed to have refused to follow the recommendations.
The IPC publishes the investigation report on the IPC’s website and identifies whether the public body accepted the recommendations. Statistics will be published.
- Is the Information and Privacy Commissioner part of government?
No, the Information and Privacy Commissioner (IPC) is an independent officer of the Yukon Legislative Assembly and is, therefore, not part of the Yukon government.
The IPC is responsible for monitoring compliance with the Health Information Privacy and Management Act (HIPMA) and the Access to Information and Protection of Privacy Act (ATIPP).
The IPC has a number of responsibilities under these Acts and has broad authority to investigate complaints made, including the power to compel production of records and witnesses. Under ATIPP and HIPMA, the IPC also has adjudicative authority which means her office can make findings of fact and law that are binding on public bodies and custodians subject to the Acts.
- When does the IPC hold an Adjudication under ATIPP?
Most complaints initially proceed to Informal Case Resolution (ICR) to try to settle the issues for review. Where a complaint is not completely settled during informal case resolution, a party can ask the IPC to conduct an adjudication. The IPC has discretion to decide whether to proceed to adjudication.
The IPC may initiate her own investigation, known as an own motion investigation, on a decision or matter that the commissioner reasonably believes could be the subject of a complaint.
- What happens in an adjudication?
An adjudication is the final stage in a complaint investigation and is a formal process conducted by the IPC. The parties to an adjudication are entitled to make representations to the IPC about the issues identified for adjudication. In most inquiries, the representations are made in writing and the parties do not appear before the IPC.
If the IPC decides to proceed to adjudication, a notice of adjudication is issued to the parties. The notice of adjudication outlines the next steps in the adjudication. The notice of adjudication will confirm:
- the parties to the adjudication,
- the sections of the ATIPP Act that will be considered,
- the issues for adjudication,
- the timeline for notifying the IPC of any preliminary objections to the adjudication,
- the schedule for delivery and exchange of initial and reply submissions from the parties, and
- a deadline for requesting the IPC’s approval for “in camera” submission material.
At the adjudication, the IPC considers the Fact Report prepared by the Investigation and Compliance Review Officer from the Informal Case Resolution (ICR) team, the representations received from the parties, reviews any records in dispute, and decides how each issue should be resolved and makes her recommendation(s) . The IPC issues a written report to the parties setting out her findings, recommendation(s) and reasons for the findings and recommendation(s).
Some of the things the IPC can recommend are:
- the release of some or all of the information in a record
- the modification of a fee waiver
- the correction of personal information