New child welfare laws have privacy issues, watchdog says
Bill 89 will give ministry broad powers to collect personal information
Ontario’s privacy watchdog is calling for greater privacy protections in new child welfare laws which will give the Ministry of Children and Youth Services broad powers to collect, use and disclose personal information.
The new privacy section of Bill 89, the Child, Youth and Family Services Act (CYFSA), will be the first time many service providers, such as children’s aid societies, are backed by personal privacy laws.
When the new rules come into effect, they will require service providers, such as children’s aid societies, to get consent when collecting information and to report serious privacy breaches to the privacy commissioner’s office.
However, because the ministry is subject to the Freedom of Information and Protection of Privacy Act (FIPPA) and not these new laws, it is not under the same privacy obligations.
“(FIPPA) is a very old piece of legislation and in my view is outdated, and doesn’t have the kinds of privacy protections that are required in this era of big data,” said Brian Beamish, Ontario’s information and privacy commissioner.
Bill 89 will also give the ministry additional broad powers to collect, use and disclose personal information, an authority that they already have under FIPPA, he said.
In addition to mandatory privacy breach reporting to his office and a consent-based model for collecting personal information, his recommendations for privacy safeguards include removing identifiers from records used by the ministry when analyzing data and creating a separate unit that will do this analysis.
These areas are important enough that they should be addressed up front in the legislation, Beamish said.
While there are improvements to be made, Beamish said the privacy protections in Bill 89 are a “really big step forward” for youth and families in the system.
One area that the commissioner’s office is satisfied with is the right for youth to access their own files which will come with very limited exceptions.
This will be a drastic change for people like Arisha Khan, a former foster child who is in a dispute with Peel Children’s Aid Society to see her own file.
“They summarized 12 years of involvement into a five-page summary that had a lot of erroneous facts in it, and they just weren’t willing to give me my file,” said Khan, a 21-year-old international economics student at McGill University. “They said that if I wanted it, I would have to sue them.”
“(FIPPA) doesn’t have the kinds of privacy protections that are required in this era of big data.” BRIAN BEAMISH PRIVACY COMMISSIONER
Khan said her care history was freely talked about among workers, something she maintains is a common experience in the foster-care community.
“You just feel very disrespected. I think they think that it’s kind of OK to air the dirty laundry with everyone involved,” she said. “Workers who I didn’t even know would have information about me.”
Based on his experience in the health-care sector, Beamish said he believes that this careless and thoughtless behaviour may not be intentional.
“I think when you bring in legislative requirements, it makes people start thinking about what a good privacy practice is,” he said.
“It will require a culture shift.”