Alberta Commissioner's office faults EAP provider

Released today from the Information and Privacy Commissioner of Alberta:

Employee Assistance Provider found in contravention of Personal Information Protection Act

The Office of the Information and Privacy Commissioner has found that Wilson Banwell Human Solutions Inc. (Wilson Banwell) contravened the Personal Information Protection Act (PIPA) by disclosing more personal information than was necessary to a complainant's employer. The investigation also determined Wilson Banwell contravened PIPA by disclosing the complainant's personal information to a union for purposes that were not reasonable, and to an extent that was not reasonable.

After failing to pass a drug and alcohol test, the complainant was referred to Wilson Banwell, an Employee Assistance Provider (EAP), for a "return to work assessment." He signed a consent authorizing release of "assessment / treatment summaries" to his employer to facilitate his return to work. The complainant believed Wilson Banwell would limit its report to recommendations arising from the assessment. However, the Wilson Banwell psychologist sent a three-page report to both the complainant's employer and union. The report provided a summary of the clinical interview the psychologist conducted with the complainant, including details of a previous visit the complainant had made to Wilson Banwell on his own initiative, and some personal information of the complainant's wife.

The Investigator recommended Wilson Banwell:

• revise its "Release of Information" form to clarify exactly what information will be disclosed to a client's employer for return to work purposes, and
• remind all staff of Wilson Banwell's policies respecting written consent, and the requirement to disclose only the least amount of information necessary for reasonable purposes.

Wilson Banwell agreed to implement these recommendations.

For more information about investigation report P2007-IR-001, please visit our website at: http://www.oipc.ab.ca/

I expect the result would have been the same if the complaint was brought under PIPEDA, except the parties wouldn't have been named.