Confidentiality and Privacy in Justice Cromwell’s Report: Uses and Misuses
Issues of confidentiality and privacy feature prominently in Former Justice Cromwell’s Report on the search process for the Directorship of the International Human Rights Program at the University of Toronto, Faculty of Law. They appear in four separate contexts:
- In the context of the improper disclosure, during the search and appointment process, of Dr Azarova’s identity to CIJA and in the direct and indirect communications between Justice Spiro and the Administration about Dr Azarova’s candidacy and hiring process;
- In criticizing members of the Search Committee and another unidentified person for disclosing information related to their concerns about the reasons for the Dean’s decision to terminate Dr Azarova’s appointment with other colleagues, individuals from outside the university, and the media; and
- As explanation and justification for the Dean’s refusal to engage with colleagues who expressed their concerns about the reasons for the Dean’s decision to terminate Dr Azarova’s appointment.
- As a recommendation that strict confidentiality requirement be imposed on those involved in hiring.
Each of these contexts raises different questions about the nature and scope of privacy interests and confidentiality obligations, which I discuss below. As I explain, while Mr Cromwell was correct in finding breach of privacy and confidentiality in the first of those contexts, his analysis of privacy and confidentiality in the other three is misguided.
Privacy law, in this context, concerns the personal information of the candidate and the duty of the University to protect that privacy was a duty owed to the candidate. In the University context, privacy matters are governed primarily by Ontario’s Freedom of Information and Protection of Privacy Act (FIPPA), and policies implementing it.
A duty of confidence is distinct from a privacy law’s limitation on the disclosure and use of personal information and may apply to all sorts of information. In general, the source of such duty may be a binding policy or a non-disclosure agreement, but none existed in this case. Alternatively, it may arise from the common law, reflecting the principle that a person who has received information in confidence shall not take unfair advantage of it.
While keeping the candidate’s identity confidential protects both the interests of the candidate and of the University, the interests are distinct: the privacy interests are those of the candidate; the confidentiality interest in the integrity of the hiring process is that of the University, as well as of the individuals who participate in it.
When the Assistant Vice President and two Assistant Deans at the Faculty of Law disclosed, directly or indirectly, the identity of Dr Azarova and details about the status of her appointment to Justice Spiro, they breached both privacy law’s limitations on the disclosure of personal information, as well as a duty of confidence they owed to the University. However, Mr Cromwell also invokes privacy and confidentiality as grounds justifying evasion of accountability, to shield the University from criticism, and to allege impropriety by those who disclosed to colleagues and later to the media details about a matter of public importance.
Importantly, however, privacy law does not present any obstacle for sustaining norms of collegial governance within the University and for maintaining accountability to the public at large. And a duty of confidentiality does not mean a duty not to disclose any information that the University would prefer to conceal.
These distinctions will be discussed below in relation to each of the four contexts described above.
1. Privacy and confidentiality during the search and hiring process
Unless and until an appointment was made and announced, privacy law treats the identity of candidates as personal information that the University should not, without the consent of the candidate, disclose to anyone not involved in the search and hiring process. Neither identity nor other personal information about the candidate can be used for purposes that are not reasonably connected to the search and hiring process without the consent of the candidate (unless the disclosure or use are permitted under FIPPA ). The duty to maintain the privacy of such personal information may continue even after the identity of the successful candidate is announced (or, in the case of unsuccessful candidates, even if information about their unsuccessful candidacy becomes known by that candidate or a third party).
The University may have several legitimate reasons to maintain confidentiality of information pertaining to certain aspects of the search and hiring process: one is to foster frank and open deliberation about matters such as candidates’ suitability, or the pros and cons of choosing one candidate over another. Another is to protect against external undue influence on the selection process, to ensure that the decisions are made on the basis of relevant considerations by those responsible for considering, recommending, or appointing candidates. Since some qualified candidates may be reluctant to apply if that information were not kept confidential, maintaining the confidentiality of such information encourages more qualified candidates to apply.
The legitimate interest in maintaining the confidentiality of information pertaining to certain aspects of the search and hiring process does not in itself create a duty on others to maintain such confidentiality. Therefore, it does not follow that any disclosure of such information constitutes a breach of confidence.
A breach of confidence occurs when (1) the information conveyed was confidential (that is, information that is not already public domain, or information that the public has no legal or practical ability to obtain); (2) the information was communicated in confidence; and (3) the information was misused by the party to whom it was communicated. In addition, the law recognizes that the disclosure of some information may be required in the public interest, in which case there is no duty to keep it secret.
Leaking the identity of the candidate to CIJA and the subsequent communications between Justice Spiro and the administration about the candidate and the hiring process breached both the privacy of the candidate and the integrity of the hiring process. They breached Dr Azarova’s privacy because they involved the disclosure of personal information about her to persons who were not entitled to receive it, and for purposes that are not reasonably connected to the search and hiring process but antithetical to it.
These actions also involved breach of confidence because the individuals who obtained internal information about the hiring process and disclosed it to CIJA and Justice Spiro misused it. They disclosed the information to promote or aid in promoting objectives that are antithetical to the purpose for which the information was shared with them. They disclosed information whose confidentiality was necessary for protecting the integrity of the hiring process and used it to undermine this very integrity. There is no question that those who were involved in the initial leak and in the subsequent communications with Justice Spiro acted inappropriately. Mr Cromwell’s same conclusion is well founded.
2. Privacy and confidentiality after the termination of Dr Azarova’s appointment process
The same conclusions about inappropriate actions do not necessarily follow in the context of events and actions that occurred after the termination of Dr Azarova appointment process, because at this point, the privacy and confidentiality interests are quite different.
Mr Cromwell characterizes as inappropriate three acts of disclosure that occurred after the Deans decision to terminate Dr Azarova’s appointment process: (a) Prof Macklin’s “brief[ing of] concerned colleagues on the details of the selection committee’s decision-making and [providing her] notes of that process to others”; (b) Vincent Wong’s “tweet[ing of] emails concerning the process”; and (c) giving a copy of Prof Macklin’s notes to the press by an unknown individual.
Mr Cromwell asserted that those actions were inappropriate, but he never explained why. Therefore, let us consider whether those action breached any protected privacy or confidentiality.
None of these actions infringed Dr Azarova’s privacy. Prof Macklin initially informed the remaining members of the IHRP Faculty Advisory Committee of her resignation from the IHRP Faculty Advisory Committee, and then later described the facts leading up to her resignation because these other members wanted to know why she resigned. She responded to inquiries from other faculty members who contacted her after they had learned directly or indirectly from Dr Azarova that the process of her appointment had been terminated. Prof. Macklin did not initiate contact with these colleagues. Any personal information about Dr Azarova that Prof Macklin discussed with colleagues was information that Dr Azarova had already disclosed, and which she obviously was fully entitled to disclose.
Likewise, the Twitter disclosures by Vincent Wong and the sharing of Prof Macklin’s notes with the press did not violate any privacy right of Dr Azarova because any personal information so disclosed had been disclosed with her consent. Moreover, those latter disclosures were made only after the story broke in the media, at which point, the information was already public. Prof Macklin did not share the identity or any other personal information about other candidates.
Did the sharing of that information breach the privacy of anyone else (e.g, the Assistant Dean, the Dean, Justice Spiro)? The answer is no, because none of the disclosed communications contained personal information of those individuals or information with respect to which that they had a reasonable expectation of privacy. Moreover, none of those who shared the information had any obligation under privacy law to protect it from disclosure.
Did any of the actions by Prof Macklin, Mr Wong, and the third individual breach a duty of confidence? Even if some of the information they disclosed had been communicated to them in confidence, their actions could only amount to a breach of confidence if the information they disclosed was still confidential at the time they disclosed it. Even then, the disclosure would not amount to misuse if there was a public interest justification for the disclosure.
Let’s consider the disclosure by Prof Macklin first. According to Mr Cromwell, she acted inappropriately by sharing information about the hiring process with concerned colleagues and sharing with them the notes about the process she had taken down. The nature of the information she disclosed and the timing of these disclosures are crucial for assessing the propriety of those disclosures.
With respect to timing of these disclosures, they occurred after the Dean’s decision to terminate Dr Azarova’s candidacy, which, as Mr Cromwell’s Report documented, followed serious breaches of confidence by several administrators from the President’s office and the Dean’s office. These prior breaches of confidentiality undermine the claim that Prof Macklin subsequent disclosure of information about the aborted hiring constituted a breach of confidentiality. By the time Prof Macklin disclosed the information that Dr Azarova had been the candidate, that information was no longer confidential; its confidentiality had already been compromised a week earlier by administrators from the President’s office and the Dean’s office. Nor did Prof Macklin disclose confidential information when she discussed the termination of Dr Azarova’s appointment with the members of the IHRP Advisory Committee and with other colleagues who reached out to her. Prof Macklin did not initiate contact with these colleagues about the events in question; the colleagues reached out to Prof Macklin after learning about the termination of Dr Azarova’s hire from Dr. Azarova herself or from people who learned about it from her.
Nor did Prof Macklin breach a duty of confidence when she shared with the colleagues who contacted her what she knew of the events leading to her resignation from the Selection Committee and from the IHRP Advisory Committee. And obviously, it was appropriate for her to explain to the IHRP Advisory Committee the reasons for her resignations.
Obviously, Prof Macklin did not owe any duty of confidence to Justice Spiro and to those who aided and abetted his interference in the hiring of Dr Azarova. If anything, as a colleague and former member of the Selection Committee and the IHRP Advisory Committee, she had a duty to alert her colleagues about the interference and explain the reasons for her resignation.
Even if some of the information that Prof Macklin shared with colleagues was still confidential, breach of confidence occurs only when the information is misused. Whether disclosure amounts to misuse depends on the whether its disclosure could undermine the legitimate objectives that confidentiality was designed to protect: in this case, fostering frank discussion and collegiality among those involved in the hiring process and avoiding undue interference in it. The Dean’s decision to terminate Dr Azarova’s hiring and to proceed with interviewing candidates that the search committee considered unsuitable, made abruptly and without prior discussion with the search committee undermined the first objective; and Justice Spiro’s interference, aided by University administrators, had already compromised the second.
The disappearance of the interests that confidentiality was meant to promote changed the calculus. When Prof Macklin shared her concerns about what had happened, and disclosed information necessary to explain and support her concern, she did not do that to undermine the collegiality and integrity of the hiring process, nor could she—the process had already been compromised.
Furthermore, the termination of Dr Azarova’s appointment, which, at the very least, coincided with Justice Spiro’s interference, introduced a new consideration that affects the analysis—the public interest. The law recognizes that the disclosure of some information may be required in the public interest. There is no question that concerns about politically motivated interference in a hiring process at a university, by a sitting Justice no less, and the question of whether that interference played a role in the Dean’s decision, were matters of great public interest. Colleagues, other members of the University community and the public at large had interest in finding out the truth about what had happened and no interest in keeping the facts secret. Maintaining confidentiality would not have served the public interest, only the interest of those who would have preferred to avoid scrutiny.
The University’s reaction to the concerns raised, first internally and then publicly, further changed the equities of the matter. Instead of addressing the concerns in a transparent manner, the University’s initial reaction was complete dismissal, describing the concerns as “uninformed and speculative rumours”. And after the story broke in the media, the University insisted that “no offer of employment was made, nor accepted or rescinded” and mischaracterized the stage of the negotiations with Dr Azarova, as merely “exploratory discussions”. This mischaracterization the University’s unwillingness to provide any meaningful information about the attempted interference, only increased the public interest in having the information disclosed.
This was the point when Mr Wong made his disclosures and the unknown individual shared Prof Macklin’s notes with the media. These disclosures were made in response to the University’s public representations. At this point, the issue was already a subject of controversy on a matter of great public interest. The University publicly disclosed some information about the hiring process to support its own account of the events. Those who thought the University’s statement was partial and misleading and were entitled to challenge it and disclose the contradictory information they had to support their claims.
Regarding the third, unknown, individual: without knowing the identity of the individual who provided Prof Macklin’s notes to the press, Mr Cromwell had no basis to conclude that a duty of confidentiality had been breached because there was no basis to determine that such a duty existed in the first place.
In sum, when Prof Macklin, Mr Wong, (and a third individual) shared information with colleagues and then with the public, the confidentiality of the hiring process had already been compromised by the University and the objectives animating a duty of confidentiality no longer existed. In addition, the public interest outweighed any remaining claim of confidentiality in any of the details subsequently disclosed.
It is regrettable and surprising that instead of highlighting the differences between the initial breaches of confidentiality by University administrator and the justified subsequent disclosures by Prof Macklin, Mr Wong (and the third individual), Mr Cromwell chose to draw false equivalence between them, and described all as inappropriate.
Mr Cromwell reached those conclusions without providing any legal analysis. But as shown above, while the disclosures by administrators from the President’s office and the Dean’s office constituted breach of privacy and breach of confidence, the disclosure by Prof Macklin, Mr Wong, and the third individual did not. If by labelling those actions as inappropriate Mr Cromwell was not making a legal statement but an ethical one, his conclusion is also deficient because he did not provide any reason to support a conclusion that those actions were unethical. Nor can one be easily found.
3. Confidentiality and privacy as an explanation and justification for the Dean’s refusal to engage with colleagues who expressed their concerns
Mr Cromwell invoked confidentiality and privacy as justifications for the for the Dean’s refusal to engage with colleagues who expressed their concerns. He explains that the Dean wanted to provide more detailed information to the IHRP Faculty Advisory Committee, but that legal advice he received “discouraged from doing so on grounds of confidentiality and protection of privacy.” Mr Cromwell noted that he saw the email exchange containing that advice but he provided no detail about its content. It is hard to assess the soundness of such legal advice, but as the earlier analysis shows, when members of the Advisory Committee shared their concerns with the Dean, there were neither privacy concerns nor confidentiality grounds that could have prevented the Dean from explaining his action to the Advisory Committee. In any event, nothing prevented the Dean from discussing those matters with members of the Advisory Committee in confidence. It should also be noted that according to Mr Cromwell, the legal advice that he saw only “discouraged” the Dean from providing more detailed information; he does not say that the Dean received legal advice according to which it would have been illegal for him to provide more detailed information.
As noted above, any personal information about Dr Azarova that the Dean would have disclosed to members of the Advisory Committee would have already been communicated to them by Dr Azarova, or from others who obtained it from her and with her consent. In any event, even if Dr Azarova still had a protected privacy interest at that point, if the Dean wished to have an open-minded discussion about his decision with members of the Advisory Committee, privacy would not preclude him from disclosing the relevant personal information necessary for such deliberation.
In fact, relevant University Policy contemplates and authorizes this kind of disclosure. For examples, it states:
Personal information may be disclosed as necessary within the University on a need-to- know basis according to the “Need-to-Know Principle”, which provides that:
Personal information may be provided to a University officer, employee, agent or consultant, who needs the personal information for the performance of his/her duties, if the disclosure is necessary and proper in the discharge of the University’s functions.[1]
With respect to confidentiality, a duty to maintain confidentiality applies only to confidential information that a person has received in confidence from a third party. There is no duty not to disclose one’s own information. Mr Cromwell does not explain why a discussion between the Dean and the Advisory Committee would breach a duty of confidentiality, to whom such a duty was owed, and on what basis. But as the analysis in the previous section shows, no such a duty seems to exist or remain when the members of the Advisory Committee shared their concerns with the Dean.
It seems that Mr Cromwell (and the legal advice he mentioned) confused the University’s existing self-interest in not disclosing information about its own actions with a non-existent duty to maintain confidentiality of information owed to someone else. In the absence of a duty to someone else, citing unspecified “confidentiality grounds” as an impediment for explaining one’s actions may amount to no more than a circular argument: “I will not explain my actions because explaining them would require me to disclose information that I do not wish to share with you because I do not wish to explain my actions.” Labelling one’s own information “confidential” does not necessarily make it so and does not provide sufficient grounds for failing to disclose it.
If accountability and good governance require the disclosure of information, then the Administration’s interest in suppressing the information is not a sufficient reason not to disclose it. The Dean might be excused if he followed clear instructions by his superiors not to engage, but this would not excuse his superiors. In any event, Mr Cromwell makes no such finding, only a finding that the Dean was “discouraged” from engaging on the basis on vague grounds.
Last, Mr Cromwell’s own Report belies the claim that privacy and confidentiality grounds prevented the Dean from being transparent about his actions. Mr Cromwell did not write his report in any judicial or quasi-judicial capacity, but was appointed by the Administration to provide a “factual narrative”. If it is lawful for him to disclose the details that his Report discloses, it would have been equally lawful for the Administration to disclose them earlier.
4. The recommendation that strict confidentiality requirement be imposed on those involved in hiring
Mr Cromwell makes several recommendations about confidentiality. While there is merit in some of those recommendations, his overall approach is ill conceived and some of its aspects are highly problematic. He confuses privacy with confidentiality and ignores myriad of circumstances where disclosure of information within and without the University will be legitimate, useful, and lawful.
His first recommendation is to have a written confidentiality guidelines for professional and managerial recruitment processes. Such guidelines should address specific examples of what the obligation of confidentiality entails in that context. The obligation of confidentiality ought to include at least the identity of candidates, their personal information and the deliberations of the selection committee.
The fourth recommendation is similar. Mr Cromwell recommends that members of selection committees and members of the University community in general ought to be provided with practical summaries of the University’s obligations under privacy legislation.
In general, these recommendation seems benign, but it is not clear why they is necessary, as policies, such as FIPPA – General and Administrative Access and Privacy Practices (2011), already exist.
Moreover, there is no indication that members of the Selection Committee were not aware of the duty to maintain confidentiality of their deliberations or the personal information of candidates. The problem was that the Assistant Dean, who served as Chair of the Selection Committee provided confidential information to another Assistant Dean and the Assistant Vice President in response to an inquiry by Justice Spiro. The organizational culture within the President’s office and the Dean’s office might have played a greater role in precipitating the breach than the lack of any specific additional written policy.
The second and third recommendations are highly problematic. Mr Cromwell recommends that members of selection committees be required to sign written confidentiality agreements spelling out the obligations of confidentiality which they are accepting, and he emphasizes that under no circumstances are details of a recruitment process to be shared with anyone not directly involved except for the purposes of checking references or obtaining necessary legal advice.
These recommendations are overbroad and fail to distinguish between justified and unjustified disclosure. There are many circumstances in which it would be legitimate and useful to share details about a recruitment process not only for checking external references or obtaining legal advice, but in order to receive valuable input and insights from colleagues. There are circumstances where sharing of information will be justified to ensure accountability and transparency. It is entirely possible to maintain collegiality and accountability while complying with all privacy or confidentiality obligations. Preventing the disclosure of information with those who wish to interfere with the University’s collegial processes can be ensured without undermining those collegial processes, and the need to protect the integrity of hiring processes should not result in immunizing those who undermine it.
Requiring members of search committees to sign confidentiality agreements is problematic for similar reasons. Requiring members of the selection committee to sign confidentiality agreement could not have prevented Assistant Vice President and the Assistant Dean Advancement and Development (who were not members of the Selection Committee) from discussing the candidacy of Dr Azarova with Justice Spiro and from requesting information about the appointment from the Assistant Dean. The Assistant Dean, who served as Chair of the Selection Committee not only provided them the information, which she knew was confidential, but also requested that they relay Justice Spiro’s concerns to the Dean. It is not clear that a confidentiality agreement would have deterred the Assistant Dean, but it could have deterred the other members of the selection committee from sharing their concerns after they learned about the breach that had already happened. None of the problems that Mr Cromwell identified would have become known if those members of the Selection Committee did not speak up.
Moreover, while the Assistant Dean’s actions breached her duty of confidence—a duty she owed even without a written non-disclosure agreement—the disclosure of information by the other members of a Search Committee was lawful and in the public interest. Therefore, to the extent that Mr Cromwell’s recommendation is intended to prevent members of search committees from disclosing their concerns about problems in the hiring process, it seeks to impose new obligation beyond those existing in law. Implementing this recommendation will not only be against the public interest, but it will also render hollow the University Statement on Freedom of Speech, which includes the right to criticize the University. How can one criticize the University without disclosing the details that underly the criticism?
Furthermore, implementing the recommendation to sign confidentiality agreements will hinder collegial governance. While members of selection committees should be informed about the legal obligations applicable to them, they should not be required to agree to additional and unnecessary obligations. The exercise of their right to participate in the governance of the University should not be conditioned upon willingness to assume liability that would not otherwise exist.
It is far from clear that the privacy and confidentiality breaches documented in Mr Cromwell’s Report occurred because those who committed them were not aware of their duties. Two of the three administrators who participated in the breach are legally trained. All three have many years of experience in the University’s administration. It is hard to believe that they disclosed confidential information to a donor, and communicated the donor’s disapproval of a pending candidate to the Dean, without knowing or considering that there was something wrong with that. Rather, it seems more likely that the problem was not lack of knowledge but an institutional culture and a set of incentives that motivated them to prioritize the wishes of a donor over their duties to and the values of the University.
When the University announced the appointment of the Assistant Vice President, it provided a glimpse into this culture. The announcement mentions her previous job, the Assistant Dean, Advancement for the Faculty of Law, and indicates that for the past five years at that job, she had “consistently been among the top advancement performers at U of T” and “Under her leadership, Law’s advancement programs achieved significant gains in fundraising and alumni relations, organizational capacity, communications, volunteer relations, and donor relations.”[2]
This announcement suggests that the University ranks advancement officers on an annual basis, based on their “performance”, which probably means the amount of money they bring in. It is also likely that their compensation is tied to “performance”. If this is the case, then the University established a system that aligns the private interests of advancement officers with those of donors and thus incentivizes them to prioritize the interests of donors over the values of the University.
The University did not ask Mr Cromwell to look into this issue and he didn’t. But if this is the system that the University has created for maintaining its relationships with donors, then solemn statements about the values of the University and stricter rules on confidentiality may do very little to prevent donors from interfering, and will only reduce accountability and increase the University’s collegiality deficit.
[1] University of Toronto, FIPPA – General and Administrative Access and Privacy Practices (2011).
[2] Announcement of Chantelle Courtney as Assistant Vice-President, Divisional Relations, Division of University Advancement (PDAD&C #53), February 5, 2019
Leave a Reply