Friday, September 21, 2007

So Much for Transparency ☹

As I sat yesterday contemplating the contents of the courier package, I thought about Kafka’s Joseph K. and the niggling and growing frustration he felt as he prepared for his trial. These aren’t bad people… these nameless and faceless bureaucrats. But they are a breed, and its in their nature to jealously hoard and guard information.

You may have read the post concerning my Freedom of Information request for the Privacy Impact Assessments for the Ontario Laboratory Information System (OLIS), the Ontario Drug Benefit Drug Program Viewer (ODBDPV), and the Integrated Public Health Information System (iPHIS). My original intention was innocuous enough. Very few PIAs are available on the Internet. I was looking for examples I could use in the Health Privacy Professional Workshop I teach at the Waterloo Institute for Health Informatics Research. I had read two of the three PIAs in question in my former role as Chief Privacy and Security Officer for the Ontario Smart Systems for Health Agency and thought that they would be useful and topical references for workshop participants.

In June the Ontario Ministry of Health and Long Term Care (MOHLTC) denied access to the documents under various exemptions in the Freedom of Information and Protection of Privacy Act. I appealed the decision to the Information and Privacy Commissioner for Ontario.

My appeal has just gone through the mediation process and the courier package contained a new decision to release redacted copies of the OLIS and ODBDPV PIAs. The full iPHIS PIA is still denied. To say the OLIS and ODBDPV PIAs were redacted is an understatement.

Now I would have expected some modest redacting where there was a risk of exposing, for example, security vulnerabilities or trade secrets. However, the redaction in this case went over the top.

The redacted ODBDPV PIA (download a copy here) is an 83-page document. The pages are blank until page 56 where they then released 16 pages of already available public information such as regulations and forms. The last 12 pages are also blank. Not a cover page, table of contents or executive summary… I would not even be able to identify the document as the ODBDPV PIA were it not for the covering decision letter.

The redacted OLIS PIA (download a copy here) is a 153-page document. The first 11 pages containing the cover page, document boilerplate and definitions have been released. This is followed by 110 blank pages, then 2 ½ pages containing a textbook table of very general privacy risks and some legal authorities followed by another 30 blank pages.

Of course the iPHIS PIA was denied in its entirety, which for the sake of the trees involved was probably just as well.

All in all the MOHLTC sent me more than 200 blank pages!

The reasons for the denied access referenced the following exemptions under the Freedom of Information and Protection of Privacy Act.

• Section 12 – Cabinet Records
• Section 14 – Law Enforcement
• Section 17 – Third Parties
• Section 19 – Solicitor-Client Privilege

The sad thing is that these are good projects, and I expect that the PIAs would demonstrate that all known privacy risks have been identified and are being well managed. I personally know and respect the people who wrote these documents. Unfortunately we are subject to those governmental and societal influences so well described by Franz Kafka in his books The Castle and The Trial (I reflect on these issues and my own experience as one of Kafka’s bureaucrats in my essay We’re All Kafka Bureaucrats). If I didn’t know better I could read sinister motives into the Ministry’s denial of my request. What could they be hiding? What terrible risks lurk in these systems that could do serious damage to the good citizens of Ontario?

But no. They hide everything… good and bad. Its in their nature. So much for transparency.

Needless to say I have applied to the Information and Privacy Commissioner’s office to proceed to the next stage – adjudication. We’ll see what happens next.

Oh.. and I will be using these documents in my privacy workshop, though not in the way I had originally intended.

Supplementary Comment (22/9/07):

I'm not the only one frustrated by Government's response to FOI requests. Check out this article in the Globe and Mail titled Delay, denial and stonwalling still clog FOI system.


Alan Brookstone said...

Brendan, this is an insightful commentary and excellent piece of work. I think that you have hit the nail on the head. In the digital world, information is increasingly accessible by the larger collective which pushes the boundaries of what is 'expected' much more rapidly than the ability of government or policy makers to respond. What results is an uneasy truce where the desire of the individual for transparency butts heads with legislative and governance framework that is still rooted in the past.

Anonymous said...

If the purpose of a PIA is to identify, classify and respond to privacy risks associated with the personal health information of Ontario's citizens in the systems, shouldn't the public be allowed to understand how this is done?

Releasing blank paper doesn't appear consistent with this message on the MOHLTC website: Openness And Transparency Enhanced As Privacy Practices Strengthened