Program Recap: New Privacy Obligations under the Child, Youth and Family Services Act

  • July 07, 2020
  • Bridget McInnis, JD (Certificate in Aboriginal Legal Studies), MSW

On January 1, 2020, Part X of the Child, Youth, and Family Services Act (“CYFSA”) came into effect. Its provisions govern the collection, use, and disclosure of personal information by service providers and the Ministry of Community and Social Services (“the Ministry”). On June 25, the OBA convened a webinar panel of legal practitioners in the field of child and youth law to discuss the impact that Part X will have on service providers, and the challenges that are likely to arise throughout its implementation across the province. Chaired by Kimberley Ishmael (Keel Cottrelle LLP) and Jane Stewart (Justice for Children and Youth), the panel also included Samira Ahmed (Justice for Children and Youth), Michelle Manning (Information & Privacy Commission of Ontario), Kristina Reitmeier (Children’s Aid Society of Toronto), and Ian Ross (Office of the Children’s Lawyer).

Michelle Manning of the IPC began the discussion with an overview of the salient features of Part X and the role that the IPC plays in ensuring that service providers are in compliance with its provisions. She began by noting that Part X represents a marked departure from the current practices of many service providers. For instance, individuals have a right under Part X to access the entirety of their records containing personal information, as long as the records relate to the provision of a service. Previous common practice of service providers involved redacting information in records that did not directly relate to the individual requesting access. Further, individuals have a right to request that information contained in their records be corrected. These two provisions point to the ideological shift from paternalism to individualism that underlines Part X – records of personal information belong to the individual, not to the service providers who create them.

Michelle also outlined how the collection, use, and disclosure of information can be done either with or without consent, depending on the circumstances. Whether personal information is collected, used, or disclosed with or without consent, there are identical “data minimization” requirements. Some examples of these requirements include the following: service providers must be fulfilling a legitimate purpose when dealing with personal information; service providers should only collect as much personal information as is necessary in the circumstances; and service providers should not disclose personal information in circumstances where non-personal information would serve the same purpose.

In terms of the role of the IPC, anyone can file a complaint to the Commission based on the provisions of Part X. The IPC also holds the power to initiate its own review of service providers’ compliance with Part X. The majority of complaints filed to the IPC are resolved either at the intake stage (i.e. for lack of jurisdiction) or during mediation (i.e. through reaching a settlement). If not resolved during one of these two stages, the complaints will proceed to the adjudication stage where the IPC may or may not issue orders or recommendations for service providers. Outside of the complaints process, service providers may contact the IPC to have their privacy practices reviewed and to receive guidance.

Michelle concluded with some helpful tips for service providers navigating these new obligations under the CYFSA. Firstly, as the Commission has not yet interpreted Part X’s provisions, service providers can look to decisions interpreting the Personal Health Information Protection Act (“PHIPA”) due to its strong mirroring of the CYFSA in its language. Michelle also emphasized the need for training – select staff members should be required to have a certain level of expertise in the area, whereas all other service providers should have a foundational knowledge. Service providers should also develop safeguards for the protection of personal information at the administrative, technical, and physical levels.

The conversation then shifted to how privacy issues arise at the Office of the Children’s Lawyer, with Ian Ross highlighting certain challenges surrounding consent in particular. Privacy issues tend to arise when the OCL represents children and youth in custody/access disputes or where its clinicians are seeking information from a children’s aid society for the purposes of a report under s. 112 of the Courts of Justice Act. Previous practice involved obtaining the consent of the child’s parents for the disclosure of personal information. However, under Part X, there is no age requirement for consent. This means that, in certain circumstances, a child under the age of 16 could be deemed capable of providing consent. In these scenarios, the giving or withholding of consent by the child would override the wishes of the parent.

Given the lack of guidance in Part X’s provisions regarding consent, Ian deemed this to be a “grey area” of the legislation. Due to the CYFSA placing a strong emphasis on obtaining and respecting the views and wishes of children, Ian suggested that it may always be necessary (dependent on age) for service providers to at least consult with children prior to collecting, using, or disclosing personal information. He would consider this to be a best practice for service providers in order to place children at the centre of decision-making, as is required by the CYFSA.

Kristina Reitmeier then proceeded to highlight the perspective of children’s aid societies, and further emphasized the point made by Michelle – Part X constitutes a marked departure from the traditional practices of society workers. Prior to Part X coming into force, societies across the province had varying policies surrounding privacy protection, leading to inconsistencies. The new provisions appear to promote a change in institutional culture that respects to a greater extent the rights of children and youth.

Kristina emphasized the large change that Part X has brought to society practices by examining its provisions surrounding the collection of information. As has been discussed, service providers are only permitted to collect as much information as is reasonably necessary for the provision of the service. However, the previous practice of society workers was to air on the side of caution by collecting as much information as possible to ensure complete records. This caution was required due to the rare, but highly publicized, inquests into injuries or deaths of children in care. Kristina stated that Part X now requires service providers “to know when to put down the pen” when collecting information.

Samira Ahmed of Justice for Children and Youth concluded the panel by discussing the perspective of children and youth. In particular, she discussed an issue that comes up often at her office – the inclusion of Youth Criminal Justice Act (“YCJA”) information within a child’s CAS record. Though the YCJA contains fairly strict provisions regarding the retention of personal information, such information often ends up in the file of a child in care and can be used against them (i.e. to remove a former child in care’s own children). Samira noted that this problem can be addressed by Part X, as individuals have the right to correct the personal information found in their records – including removing the parts containing YCJA information. However, in order for children and youth to exercise this right, they must first become aware of having such a right. Samira emphasized that resources should be developed that outline privacy rights under the CYFSA in child-friendly language. This would be an empowering tool for children and youth.

In summary, the panelists were in agreement that Part X of the CYFSA constitutes a shift in culture for service providers, placing a greater emphasis on the rights of children and youth to control their personal information records and decide how they are to be utilized. Given its novelty, only time will tell if service providers will apply Part X to develop best practices that place the voice of the child at the centre of decision-making.

Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.