MUNICIPAL FREEDOM OF INFORMATION & PROTECTION OF PRIVACY ACT ELECTRONIC DOCUMENT AND RECORDS MANAGEMENT SYSTEM JOHN DALY, CMO JANUARY 16, 2017

Transcription

1 MUNICIPAL FREEDOM OF INFORMATION & PROTECTION OF PRIVACY ACT ELECTRONIC DOCUMENT AND RECORDS MANAGEMENT SYSTEM JOHN DALY, CMO JANUARY 16, 2017

2 MUNICIPAL FREEDOM OF INFORMATION & PROTECTION OF PRIVACY ACT THIS IS NOT LEGAL ADVICE

3 ANN CAVOUKIAN, PH.D. IPC COMMISSIONER ( ) One of the most important rights of citizens in a free and democratic society is access to information about government activities. Without a written record of how key government decisions are made, transparency is undermined and the basis for its policy choices may be shielded from public scrutiny.

4 ANN CAVOUKIAN, PH.D. IPC COMMISSIONER ( ) One of the most important rights of citizens in a free and democratic society is access to information about government activities. Without a written record of how key government decisions are made, transparency is undermined and the basis for its policy choices may be shielded from public scrutiny.

5 RIGHT OF ACCESS (THE ACT) 4. (1) (MFIPPA) Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless, (a) the record or the part of the record falls within one of the exemptions under sections 6 to 15. Offences 48. (1) No person shall, (c.1) alter, conceal or destroy a record, or cause any other person to do so, with the intention of denying a right under this Act to access the record or the information contained in the record;

6 ROLES AND THE RIGHT OF ACCESS (THE ACT) In most municipalities, the Act is traditionally administered through the Clerk s Office who apply the Act as deemed appropriate. Clerk Designated Head / Subject Matter Expert

7

8 IT S POSSIBLE TO BE ACCOUNTABLE, WITHOUT PROVIDING ACCESS [IPC Guide - June 2016] Records relating to your institution s [Read: Municipality/District] business that are created, sent or received through instant messaging tools, or personal accounts, are subject to the privacy and access provisions of MFIPPA. [Order PO-2836] A finding that a record is in the custody or under the control of an institution does not necessarily mean that a requester will be provided access to it; a record within an institution s custody or control may be excluded from the application of the Act.

9 CUSTODY OR CONTROL - OSHAWA [Order MO-3281 OSHAWA] The councillor s (personal ) asked for the investigator s feedback on a draft motion. The final motion,, contains detailed information about the terms of the investigator s engagement. In other words, the councillor laid the groundwork for the city s decision to engage the investigator and the terms upon which it did so. The city submits that it has not relied on the record [however..]. its creation played a significant role in council s decision to hire the investigator in the vote that took place later that day.

10 CUSTODY OR CONTROL [Re: OSHAWA A side bar note] The IPC held that the was a negotiation between the city councillor and the investigator. It was said that the negotiations relate directly to the City s mandate and functions, although nothing appears to instruct the Councillor to negotiate on the city s behalf. The lawyer consulted was later hired to deliver closed meeting investigations for the City. [Order MO-2824] whether or not a councillor is an officer did not turn on who the councillor communicated with, but rather in what capacity the councillor was acting.

11 CUSTODY OR CONTROL? [Order MO-2842] that a councillor s communications with a third party regarding bringing a National Football League (NFL) team to the City of Toronto were not in the city s custody or control. In coming to this finding, the order noted: the records related to the councillor s role as an individual constituent representative and were in their nature political rather than city records the councillor had no express authority to act for the city in regards to this matter the records (if they existed) related to a matter that was speculative or hypothetical, and an agreement to bring an NFL team to the city was not discussed or reviewed by the city and no agreement ever materialized

12 CUSTODY OR CONTROL? [MFIPPA Fact Sheet 1] The IPC has interpreted in the custody or under the control broadly, and considers a number of factors in making a determination under section 4 factors go beyond the physical location of a record, and involve factors such as: the purposes of the record, its originator, and whether the record pertains to the institution s mandate or functions. Ref: Order M-813

13 ELECTRONIC DOCUMENT & RECORDS MANAGEMENT SYSTEM (EDRMS)

14 EDRMS IS ABOUT MANAGING INFORMATION Information is tangible, measurable, and invaluable to staff and has a significant value to the Corporation that is equivalent to other capital assets, such as roads and structures. The untimely/unscheduled degradation or destruction of any asset whether a road, structure or information, is costly, both in rebuilding the asset and in potential liabilities resulting from the loss of the asset. An Electronic Document Records Management System (EDRMS) will manage the information capital assets the same way an Asset Management Plan does for other assets (roads, structures etc.).

15 ACCOUNTABILITY, TRANSPARENCY, AVAILABILITY Each time we access a computer, we are creating or consuming information, and that time has value ($). Electronic Document and Records Management System (EDRMS) is about compliance with MFIPPA and Records Retention By-law for the safe-keeping of valuable records and the scheduled destruction of Redundant, Out-dated and Trivial Information (ROT). EDRMS ensures that the right information gets to the right people (decision makers) at the right time. ROT has value ($), consuming storage space, hardware, back-ups, electricity, staff time restoring from back-ups, staff time sorting through the ROT for the right information.

16 ROLES AND BILL 8 PUBLIC SECTOR AND MPP ACCOUNTABILITY AND TRANSPARENCY ACT, 2014 Measures to ensure preservation of records 4.1 Every head [Read: Clerk] of an institution shall ensure that reasonable measures respecting the records in the custody or under the control of the institution are developed, documented and put into place to preserve the records in accordance with any recordkeeping or records retention requirements, rules or policies, whether established under an Act or otherwise, that apply to the institution.

17 HOW DOES EDRMS FUNCTION OR LOOK LIKE?

18 WHAT ARE WE LIKELY DOING TODAY ON NETWORK DRIVES AND

19 WHAT DOES INFORMATION LOOK LIKE AS PAPER? YOU CAN T MANAGE WHAT YOU CAN T MEASURE

20 WHAT DOES REAL INFORMATION LOOK LIKE AS PAPER? YOU CAN T MANAGE WHAT YOU CAN T MEASURE

21 MEASURING REAL INFORMATION You are not alone in your experience with electronic records

22 MEASURING REAL INFORMATION.more than 90% of records created today are electronic; more than 70% of electronic information is never printed (ARMA) Records & Information Management 25,000, ,336 20,000,000 3,744,229 15,000,000 10,000,000 19,000,000 5,000, Total Files # Duplicates

23 WHAT DOES INATTENTION LOOK LIKE? In Evans v. Bank of Nova Scotia, is facing a class action law suit claiming that an employee of the bank had, over a five year period, accessed highly confidential personal banking information of 643 customers. In June of 2012, the Bank notified these customers that there may have been unauthorized access to their banking information; 138 of these individuals later informed the bank that they were victims of identity theft or fraud. The bank employee subsequently admitted that he had channelled the banking information through his girlfriend to individuals who sought to use the information for illegal purposes. The lawsuit claims damages for invasion of privacy and negligence, among other things, and argues that the bank should be held vicariously liable for the actions of its employee.

24 WHAT DOES INATTENTION LOOK LIKE? In 2011 the Durham Region Health is facing a class action lawsuit when a nurse employed by the Durham Region Health Department allegedly lost a USB thumb drive containing personal and confidential health information relating to flu vaccinations to patients. The action followed an investigation and Order by the Ontario Information and Privacy Commissioner (IPC) citing numerous breaches of the privacy health legislation. In the action, the plaintiffs sought $40 million in damages, citing risk of identity theft as a factor. The action was settled shortly after certification, with the Region agreeing to pay up to $500,000 on account of the plaintiffs costs, and individual payments to those affected individuals who can prove financial loss. In 2011 Honda Canada, Inc. is facing a class action lawsuit launched on behalf of 283,000 customers after their personal information, including names, addresses, VINs, and financial account numbers were accessed by hackers. The action seeks $200 million and faults delayed notification of the breach to affected individuals by Honda. 3

25 IF COMPUTER STORAGE IS SO CHEAP, CAN T WE JUST KEEP EVERYTHING?

26 ACCESS TO INFORMATION TRENDS

27 COST OF STORAGE AND ACCESS TO INFORMATION TRENDS

28 PRIVACY COMMISSIONER FEE REDUCTION MFIPPA Order PO-3035, the Privacy Commissioner significantly reduced the fees charged by an institution to locate expense receipts for a specified individual during 2005 to A fee of $1,485 was reduced to $120, a loss of $1,365, or 91% of original fee charged Privacy Commissioner - it is reasonable to expect that..records..should be kept in a consistent and easily searchable manner. If they are not, the appellant should not bear the financial burden of the [institutions'] failure to implement proper record management practices.

29 THE PAPER CHASE EXAMPLE Criteria Example Calculations* How many employees are in the County of Simcoe? How many employees handle paper documents? How many times does each person retrieve or file a paper document per day? 1,750 employees 250 Low estimate (or 14%) 2 trips 250*2trips = 500 trips How long does it take to retrieve a paper document? 2 minutes 500 trips*2 min = 1000min Data 16.6 hours each day spent handling paper $43.00 hour weighted average 20 work days each month 12 months each year Does not account for cost of photocopiers, printers, folders, labels, cabinets, electricity etc. 1000/60min=16.6 hours 16.6*$43.00= $713/day $713*20= $14,276/mo. $14,276*12= $171,312/yr ROI: 0.8 years once fully operationalized, and paper culture is shifted to electronic records

30 WHERE TO START? 25,000,000 20,000, ,336 3,744,229 15,000,000 10,000,000 19,000,000 5,000, Total Files # Duplicates

31 THANK YOU Q & A