The question frequently arises as to when aggregated or anonymized can be disclosed and when even with the aggregation or anonymization it is likely to disclose information that need to be protected. Two recent decisions from the Office of the Information and Privacy Commissioner of Ontario provide some guidance.
In PO-3438 the issue was whether aggregate information about professional allowances paid by drug manufacturers to pharmacies could be released. The drug manufacturers argued that release of the total dollar amounts of professional allowances that drug manufactures collectively paid to pharmacies and the percentages of those amounts paid with under the Ontario Drug Benefit Act or otherwise would disclose confidential third party information, contrary to s. 17 (1) (a) of the Freedom of Information and Protection of Privacy Act (FIPPA).
After review the three-part test set out in FIPPA,
- the records must reveal information that is a trade secret or scientific, technical, commercial, financial or labour relations information; and
- the information must have been supplied to the ministry in confidence, either implicitly or explicitly; and
- the prospect of disclosure of the records must give rise to a reasonable expectation that one of the harms specified in paragraph (a) of section 17(1) will occur.
The adjudicator ruled that, since the information was the total dollar amounts of the professional allowances and was not linked to any named drug manufacturer, that is was simply not "credible" to conclude that the release of the information could reasonably be expected to result in the harm envisaged by s. 17 (1) (a).
By contrast, in Order PO-3429 the situation was different. A requestor had sought access to historical data showing the length of sentence for individual inmates locked up in provincial correction institutions from the Ministry of Community Safety and Correctional Services. The researcher wanted the last known postal code for each inmate.
The issue under FIPPA was whether the postal code information would disclose personal information as defined in FIPPA. In this case, the adjudicator agreed that the information, even if anonymized, could reasonably be used to identify an individual offender. The evidence persuaded the adjudicator that the postal code information could be used to re-identify individuals and that disclosure of the information, when linked to other data sets being disclosed, such as length of sentence, could lead to the identification of individuals. The decision of the Ministry to refuse to disclose the information was upheld.
This issue of aggregate or anonymized information is a vexing one for privacy practitioners and these cases show that the answer is not an easy one. Each case needs to be examined on its own merits and in light of other information that may be available to be linked with the anonymous or aggregate data.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
