When I submitted a request for general records, I was shocked to discover that my name had been shared not only within the institution but also outside it, eventually being disclosed publicly in a formal report by an administrative body. This breach underscores a troubling lack of expertise in handling FOI requests, particularly in smaller institutions where such responsibilities are often relegated to staff with little to no training. Additionally, these staff members are often given minimal support and training on the processing of access requests, which exacerbates the problem.
As an Access and Privacy Consultant, I've seen both sides of the fence—working as an analyst to apply legislation and as a requester seeking access to government-held records. This dual perspective is crucial for appreciating the nuanced balance between access and privacy. Recently, I experienced a situation that highlights a significant gap in understanding among some institutions about the importance of protecting the identities of FOI requesters.
Educating Rather than Criticizing
Rather than pointing fingers, I believe this experience provides an opportunity for education.
Many institutions lack in-house expertise on access and privacy, often assigning these tasks to employees as an afterthought. Only when a crisis arises does proper attention and training materialize.
For instance, you wouldn’t see your family physician for your heart problems; you would be referred to a cardiologist.
Institutions should seek advice and training from professionals experienced in access and privacy to avoid detrimental errors. (see Siobhan S. article on choosing the right professional) This training should be ongoing, ensuring staff remain up-to-date with best practices and evolving standards to manage access requests and uphold privacy principles effectively.
The Core Principles of FOI Legislation
For those unfamiliar with the intricacies of FOI legislation, the requestor's identity should be preserved when it’s unnecessary to process the request.
This principle is reaffirmed in the Information and Privacy Commissioner of Ontario's (IPC) Practice Direction #16, which states that the disclosure of a requester's identity is generally improper unless necessary (i.e. when a requester is seeking access to their personal information, and their identity is needed to conduct a search for records). This protection ensures individuals can exercise their right to access information without fear of negative repercussions.
The Impact on Democracy
FOI legislation is fundamental to a healthy democracy, promoting transparency, accountability, and public participation. Studies, such as those by the Foundation for European Progressive Studies, illustrate how robust FOI laws correlate with the overall democratic health of a nation. These laws empower citizens, ensuring government actions are open to scrutiny, thus reversing the flow of power from the government to the people.
The Dangers of Inadequate Knowledge and Training
The improper disclosure of requester identities, was examined in a report to the House of Commons, Committee Report No. 2 - ETHI (39-1) (Our Commons) (Our Commons). This report details the various consequences, such as retribution, threats, and discriminatory treatment, that can result from the unnecessary disclosure of requester identities.
Such breaches undermine the integrity of the FOI system, leading to decisions influenced by institutional or individual biases rather than legislative intent.
Education is needed at all levels
Leaders and individuals in positions of power must grasp the significance of privacy and access legislation to prevent substantial flaws in the interpretation and administration of current laws, as well as the development of others surrounding artificial intelligence.
Furthermore, leaders and democratic institutions seem to have lost the meaning and purpose behind the "right to know" contained in FOI legislation. The onus is not on the individual to argue why they want the information; it is on the institution to justify why they should not disclose it, supported by limited and specific exemptions. The democratic principle behind the legislation is the reversal of power it creates.
The Role of Technology
With the advances of AI and internet scraping, the risks associated with disclosing personal information have significantly increased.
Such disclosures can be easily exploited, leading to further privacy violations and diminishing the principles behind a healthy FOI legislation. Leaders and individuals in positions of power must grasp the importance of privacy and access legislation to prevent significant flaws in the interpretation and administration of laws.
Real-World Analogies
Consider Marc E.'s article on LinkedIn about the dangers of writing and mailing checks. Just as our understanding of what constitutes personal information evolves with technology, so must our approaches to protecting it.
Nishant Bhajaria’s piece on privacy as a cost center parallels the evolution of automobile safety standards. Initially met with resistance, safety standards are now integral to product excellence. Similarly, robust privacy protections must be seen as essential to maintaining trust and integrity in information systems.
The Cost of Privacy Breaches
Breaches of personal information are becoming increasingly costly, not just financially but in terms of consumer and public trust. Protecting the identities of FOI requesters is essential to maintaining the integrity of our democratic processes and ensuring public confidence in government institutions.
In summary, revealing the identity of an FOI requester violates privacy rights and undermines the core principles of FOI legislation. This legislation is crucial for ensuring government transparency and accountability, and the right to request information is a vital component of our democratic process. It is essential for those in power to understand and respect these principles to uphold the integrity of our legislative system.
Comments