Saskatchewan’s Information and Privacy Commissioner has ruled that the Saskatchewan Health Authority (SHA) must release records related to its “Do Not Hire List” and “Cautionary Hire List” to an applicant who had requested access to this information.
Commissioner Ronald J. Kruzeniski also said he has “concerns” with the use of cautionary hire lists, noting this was the third report he has issued on these types of lists — and there are at least two more coming in front of him in the near future.
The SHA had refused to disclose why the individual was placed on its list, citing privacy protection laws. However, the Privacy Commissioner determined that the SHA did not meet the legal burden to withhold this information.
Background
The applicant submitted a comprehensive access to information request to the SHA on Dec. 14, 2023. The request sought access to all human resource and labour relations documents pertaining to the applicant from March 2021 to the present. This included specific information on why the applicant was listed on the SHA’s and the former Cypress Health Region’s hiring restriction lists.
In its response on Jan. 12, 2024, the SHA provided some documents but withheld the “Do Not Hire List/Cautionary Hire List” in full, invoking subsection 30(2) of LA FOIP.
This subsection allows local authorities to refuse to disclose personal information that is evaluative or opinion-based and compiled solely for determining employment suitability, provided the information is given in confidence.
Review and findings
Dissatisfied with the SHA’s decision, the applicant requested a review by the Saskatchewan Information and Privacy Commissioner. The review examined whether the SHA had appropriately applied the exemption under subsection 30(2) of LA FOIP.
The Commissioner found that the SHA did not meet the burden of proof required to withhold the information. Specifically, the SHA’s argument that the information was provided in confidence was deemed insufficient.
“Just stating that the information is ‘provided by the manager to HR in confidence, implicitly’ is not sufficient to meet the burden of proof required by section 51 of LA FOIP,” the Commissioner noted.
The ruling highlighted several points where the SHA’s justification fell short:
- The SHA failed to demonstrate how the information was provided in confidence.
- The SHA did not provide enough detail to support its claim that the information was evaluative or opinion material solely for determining employment suitability.
- The SHA’s submission lacked adequate reference to specific policies or procedures that might have supported its stance.
Broader implications
The ruling also raised broader concerns about the SHA’s use of cautionary and do not hire lists. The Commissioner’s remarks suggested systemic issues within the SHA’s handling of such sensitive information.
“The existence of these lists poses access and privacy issues that should be considered by the SHA,” the report stated. It emphasized the need for the SHA to be transparent with individuals about their status on these lists and the reasons behind it.
“For example, the SHA’s aforementioned Work Standard sets out the steps required to place someone on the list and the process regarding ongoing maintenance of the list. It states that all external resumes, including contractors, must be checked against the cautionary hire list prior to any offer being made,” the Commissioner said.
“This step is done by employees in Workforce Planning & Employment Strategies. It also appears other departments may have access to the list. Who all has access to this list across the SHA is a privacy concern. How are potential breaches of privacy related to this list being caught and handled? If the SHA is reluctant to be transparent with individuals about being on the list and why, how are individuals supposed to challenge these decisions? I encourage the SHA to reconsider its use of these lists unless it can demonstrate that all access and privacy related concerns are adequately addressed.”
The Commissioner ordered the SHA to release the requested information to the applicant within 30 days of the report’s issuance.
For more information, see Saskatchewan Health Authority (Re), 2024 CanLII 71542 (SK IPC).
