September 4, 2012

Privacy and FIPPA: procedural fairness issues

Administrative Law
Freedom of Information
Inquiry and Investigations
Professional Regulation

As we have previously mentioned, we received numerous questions from participants during the Q&A period of our June 7, 2012 Webinar on Privacy and Confidentiality, co-hosted by Lisa Fong and Angela Westmacott. We continue to address these questions through our blog. If you missed the webinar, it can be purchased for viewing here.

Here we address questions involving legal requirements of procedural fairness, and how these requirements interact with personal privacy concerns. These questions do not directly pertain to requests made under freedom of information legislation, but instead largely focus on disclosure requirements in regulatory processes involving investigation and disciplinary proceedings.

At the core of these questions is this foundational principle: disclosure to registrants and complainants pursuant to procedural fairness is distinct from disclosure made to these same individuals or others pursuant to FIPPA. As discussed below, sections 3(2) and 33.1(1)(l) of FIPPA allow public bodies to disclose personal information for the purpose of affording procedural fairness to persons during investigations or discipline hearings. Although a freedom of information request may lead to the similar result as a disclosure request from a party to a proceeding, the demands of procedural fairness and the demands of FIPPA operate independently from one another.

The requirements of procedural fairness will vary depending on the circumstances faced by a particular regulatory body, and legal questions as to when and how much disclosure will be necessary in any given situation require contextualized legal advice. Instead, what we offer here in this blog entry are various considerations to have in mind when confronted with questions of disclosure, without reference to specific facts.

1. The balance between a regulatory body’s duty to provide procedural fairness and its statutory duty to provide access to information appears to be at the crux of many decisions. Can you point to procedural fairness criteria that must be considered?

Whenever a professional regulatory body makes a decision or determination that may affect someone’s rights or interests, duties of procedural fairness arise. One can ascertain the exact requirements of procedural fairness only by looking at the particular circumstances, and considering the case law. In other words, a regulatory body will, more often than not, need specific legal advice to address this question. One can derive rough answers, however, from the principles that make up procedural fairness. Essentially, procedural fairness involves two main rules (usually expressed in the form of Latin principles):

Audi alteram partem (“Hear the other side”) – An individual affected by a decision must know the case against them and be provided with an opportunity to answer it; and

Nemo judex in sua causa debet esse (“No one can be the judge in their own cause”) – An individual affected by a decision has the right to an impartial decision-maker.

The first sub-rule manifests itself in various ways. For example, if a regulatory body investigates the background and references of an applicant for registration and the references raise issues that might lead to the body denying the application, then the body may have a duty to let the applicant respond to the issues. Similarly, registrants who may be subject to discipline will have a right to understand the allegations and the evidence against them, and may have more specific procedural rights, such as the right to cross-examine witnesses or to have an oral hearing where credibility is at issue, depending on the specific circumstances.

The second sub-rule requires a regulatory body to provide decision-makers that can act without bias or an appearance of bias. This may require vetting decision-makers for potential conflicts of interest, and providing them with proper training on how to behave with the requisite level of decorum and professionalism so as to not raise any allegations of bias from those affected by their decisions.

The question of how a regulatory body can fulfill the requirements of procedural fairness is rarely a simple one and will require an informed and contextualized legal opinion. Furthermore, the consequences of failing to do so can be serious, as decisions are generally subject to review for procedural fairness.

2. At what juncture in a professional regulatory body’s investigation and discipline processes does procedural fairness require disclosure of the identity of the complainant to the member subject to investigation and/or discipline?

Procedural fairness is primarily, although not exclusively, triggered whenever the professional regulatory body makes final rather than interim decisions that may affect the rights or interests of an individual. In the professional regulatory context, governing bodies typically deal with complaints against their members in two separate stages. First, these complaints are investigated under the direction of an investigation or inquiry committee. Then, if that committee determines a disciplinary hearing is warranted in the circumstances, this second stage of the process will be triggered. But is a decision of the inquiry committee final or interim?

From one perspective, the decision of the investigation or inquiry committee at the first stage of this process might be best characterized as an interim decision, since it does not lead to a final determination of liability or guilt against a member. On the other hand, a decision that a matter should proceed to a hearing can be seen as a significant and final determination of the inquiry or investigation committee, since it ends this committee’s involvement in the complaint process, and the investigated member’s rights and interests are affected by them facing a formal inquiry, as well as through possible publication of a citation against them (which can carry stigma). Short v. College of Dental Surgeons of BC, 2000 BCSC 1410 at paragraphs 25-28.

The question of when a complaint must be disclosed during an investigation or discipline process was addressed in Puar v. Association of Professional Engineers and Geoscientists of BC, 2009 BCCA 487. The BC Court of Appeal found that procedural fairness may require that a complaint be disclosed to an investigated member prior to the disciplinary hearing stage only where the investigated member has a statutory right to respond to complaint allegations at the investigative stage (at paragraph 20). For professional regulators under legislation that provides for such an opportunity to respond (such as under s.33(5) of the Health Professions Act), the complainant’s name should be disclosed during the investigation stage, so that the investigated member has this information before making their response to the complaint. But if a member has no statutory right to respond at the investigation stage, a regulator is not obligated to provide this information until the disciplinary hearing (at paragraph 22). In any event, a regulatory body need not disclose a complaint or identify a complainant at the outset of an investigation: Strauts v. College of Physicians and Surgeons of British Columbia (1997), 36 B.C.L.R. (3d) 106 (C.A.).

The Court of Appeal noted in Puar, however, that even where a regulatory body need not disclose a complaint (or a complainant’s identity) at the investigation stage, providing the investigated member with early disclosure is generally useful (at paragraph 22). As the investigation stage involves a fact-finding process, a fulsome exchange of information between the regulatory body, the complainant and the investigated member will always be desirable for the purpose of an inquiry committee making a well-founded decision.

A regulatory body may expressly address disclosure in its bylaws or rules. For example, BC Law Society Rules 3-5(3), (4) and (5) stipulate that the Executive Director “must” deliver a copy of a complaint (or, if that is not practicable, a summary of it) to the lawyer subject to the complaint, but also authorize the Executive Director to delay notification where “necessary for the effective investigation,” which power of delayed disclosure includes a discretion to decline to identify the complainant, or the source of the complaint.

3. Should a Registrant’s response to a complaint always be disclosed to the complainant?

It is generally understood that many decisions of a professional regulatory body directly affect the rights and interests of members or registrants, as well as of applicants for registration, thereby giving rise to clear procedural fairness requirements. Less clear is whether complainants have any procedural fairness rights. Our views on the procedural fairness rights to be afforded to complainants have been addressed in the past through our blog generally here, with specific reference to disclosure here, and setting out factors for regulatory bodies to consider in terms of when disclosure may be necessary here.

For colleges under the Health Professions Act, complainants have certain statutory procedural rights. Most notably, complainants can seek to have certain kinds of inquiry committee decisions reviewed by the Health Professions Review Board. Under that system, a complainant should, practically speaking, generally receive a copy of a registrant’s response to their complaint, as it comprises part of the basis for why a regulatory body may dismiss the complaint or agree to a particular resolution. Further, and more notably, the complainant can acquire a prima facie right to this information simply by applying for a review of any outcome short of a decision to issue a citation. More generally, where the legislature provides complainants before any regulatory body with a right to appeal a decision dismissing a complaint, it can be said that the decision of the regulator to order such a dismissal is deemed to affect the rights or interests of that complainant.

On the other hand, the enabling statutes of many other self-regulating professions do not afford any procedural rights to complainants. Some regulated professions do not cede any greater role to the complainant beyond the initial lodging of a complaint other than to act as a witness to the matters complained of. In these circumstances the regulator may feel that a decision to dismiss a complaint does not affect the rights and interests of the complainant as they have no right to appeal or seek review of such a decision. In such circumstances a regulatory body may be justified in the view that a complainant does not have any right, as a matter of procedural fairness, to see or even be advised of a member’s response to their complaint.

Nevertheless, since the purpose of an investigation is to determine whether there are sufficient grounds to warrant a formal hearing, it may generally be considered a best practice for a regulatory body to disclose a member’s response (subject, of course, to special circumstances), so that the complainant can, in turn, reply to this document and provide the committee overseeing the investigation with as much information as possible.

A regulatory body may expressly address disclosure of member responses in its bylaws or rules. For example, BC Law Society Rule 3-5(8) stipulates that the Executive Director “may deliver to the complainant a copy or a summary of a response received from the lawyer, subject to solicitor and client privilege and confidentiality.”

Whatever approach a regulatory body may choose to apply, it may wish to set out possible approaches expressly, in bylaws, rules or policies, to establish expectations and avoid raising concerns about member’s privacy interests. Disclosure of responses would not, however, seem to infringe member’s privacy interests at least as far as the Freedom of Information and Protection of Personal Privacy Act (“FIPPA”) is concerned; public bodies are authorized under FIPPA to disclose personal information for purposes of, inter alia, investigation or discipline of persons regulated by governing bodies of professions and occupations (FIPPA s.33.1(1)(l)).

4. If an official complaint has been received and is subsequently withdrawn before a professional regulatory body has an opportunity to advise the registrant, does the regulatory body have a duty to advise the registrant?

As discussed above, procedural fairness may require, at some point, that a professional regulatory body inform a member who is subject to investigation or disciplinary processes of the case against them. If, however, a complaint is withdrawn before any action can be taken, and in fact no action is taken, then theoretically no duty of fairness arises, as the member’s rights and interests are not at issue.

A regulatory body may, however, choose to investigate a member on its own motion, even though the original complaint is “withdrawn”. In such a case, a regulatory body may need to advise the member of the specific issues or allegations being investigated, and whether the complaint itself should be disclosed to the registrant will depend on whether or to what extent the regulatory body relies on the complaint as a basis for its investigation.

In addition to procedural fairness considerations, each self-regulating professional body should look to its own enabling or constating statute, its bylaws, and its policies to understand the applicable legal requirements for disclosing complaints to registrants or members.

5. Investigations often involve interviews with a registrant’s employer or complaints from their employer, and employers may relay information to an investigator which was obtained from the registrant’s colleagues. Once this information is disclosed to the registrant, their colleagues feel vulnerable and pulled into conflict. Should their names be redacted from the notes of these interviews? How are rights to privacy reconciled with the need for transparency in these circumstances?

Generally, if witness statements from an internal investigation are submitted by an employer as part of its complaint to a College, the witnesses who gave statements do not have a right of privacy against the College within the College’s regulatory processes. If a statute provides a registrant an opportunity to respond to a complaint, the registrant will generally have a right to know the case against them. However, in some circumstances the College might decide not to disclose the names of witnesses during its investigation. Courts have distinguished between witness identities and the substance of their accounts, at least at an investigative stage. For example, the Supreme Court of Canada has referred to principles set out by the English Court of Appeal that, “The investigating body is, however, the master of its own procedure. […] It need not put every detail of the case against a man. Suffice it if the broad grounds are given. It need not name its informants. It can give the substance only.” Nicholson v. Haldimand Norfolk (Regional) Police Commissioners, [1978] 1 S.C.R. 311 (S.C.C.) [Ont.], quoting from Selvarajan v. Race Relations Board, [1976] 1 All E.R. 13 (C.A.). This means that Colleges that need  to provide a respondent with an opportunity to provide information, such as colleges under the Health Professions Act, may reasonably decide not to disclose the identities of witnesses, provided that withholding such information does not effectively deprive the respondent of his right to provide a meaningful response to the complaint.

5. Investigations sometimes involve sensitive private information such as health records. For example, a complaint might include detailed notes made by a registrant during the diagnosis of a victim of sexual assault. What should be given to a registrant in these circumstances and what should be redacted? Does it matter if the material was obtained from management and the College does not have the patient’s consent to its release?

Within some investigative and all disciplinary processes, the regulatory body should provide all relevant information so that the registrant may properly respond, and that may include sensitive information such as health records. As the complaint is ultimately directed at the registrant, they will typically be aware of the third party personal information in any event, such as in the example given where the registrant made a diagnosis of the patient third party, and his or her own notes are the subjects of disclosure.

Any disclosure is made for the limited purpose of the proceeding, and the regulatory body should make this clear to the registrant when and if such information is released. If an investigated member makes improper ancillary use of information, they may be legally liable, rather than the regulatory body, for misuse of confidential information. Regardless of where the third party private information was obtained, for the purposes of conducting the regulatory business of investigation and discipline, a regulatory body is authorized to disclose this information without redaction under section 33.1(1)(l) of FIPPA.

Please note however that whether or not a professional regulatory body can disclose sensitive health information in any particular situation may be subject to specific facts, other statutory regimes, or court orders, such as publication bans, and should acquire a contextual legal opinion.

Lisa Fong, Benjamin Ralston and Michael Ng