Personal information received on an unsolicited basis is not “collected”
Date: September 8, 2011
The Information and Privacy Commissioner of Ontario issued a notable privacy investigation report this past summer under of the Municipal Freedom of Information and Protection of Privacy Act (the “Act“). The complainants complained, amongst other things, that the Municipality in issue had improperly collected their personal information contained in correspondence they sent to the Municipality, in contravention of the Act.
Investigator Ratner found that the Municipality did not “collect” personal information under the Act when it received unsolicited correspondence. This finding was based on an interpretation of the language in the Act, which distinguishes between personal information having been “obtained or compiled” by an institution and being “collected” by an institution. Investigator Ratner recognized that personal information may come into the custody or control of an institution in a number of ways: it may be actively solicited, it may be passively received, or it may be created by the institution. The phrase “obtained or compiled” is intentionally broad, and intended to accommodate the various ways in which an institution may acquire personal information.
The phrase “obtained or compiled” is used in the context of use and disclosure obligations, which apply regardless of how information comes into the custody or control of an institution, as opposed to the term “collect” that is used in the context of collection obligations, which apply only to personal information that is actively sought or created by an institution.
This decision has great significance for institutions that receive unsolicited personal information and confirms that it will not be considered to have been “collected” for the purposes of the corresponding collection obligations under the Act.