Is a Twitter account name (or ‘user name’) personal information? In the context of a Freedom of Information request, the Office of the Information and Privacy Commissioner of Alberta found that such information, where it is not clearly the case that the account is associated with an identifiable individual, is not personal.
It also extended its finding to conclude that email addresses should be regarded similarly.
This will be welcome guidance to businesses that have struggled to treat social media and other account names appropriately under privacy legislation.
Context
In Alberta Education (Re), 2019 CanLII 18046 (AB OIPC), the Applicant made a request for access under the Freedom of Information and Protection of Privacy Act (“FIPPA”) to Alberta Education (the Public Body). He requested a list of Twitter users / accounts that had been blocked for each Twitter account operated or authorized by the Public Body.
The Public Body provided responsive records, but applied section 17(1) of FIPPA (disclosure harmful to personal privacy) to redact the names of some blocked Twitter accounts. The Applicant requested review by the Information and Privacy Commissioner of Alberta (“OIPC”) of the Public Body’s decision to redact.
The Adjudicator determined that there was insufficient evidence to establish that the names of blocked Twitter accounts had a personal dimension. As a result, she found that section 17(1) did not require the Public Body to withhold this information from the requestor. She directed the Public Body to give the Applicant access to the severed information.
When and why an account/username is not personal information
The Alberta OIPC noted that only information which has a personal dimension and can be said to be “about an identifiable individual”, and quoted the Leon’s Furniture case, in which the Alberta Court of Appeal determined vehicle license plates were not personal information as they were about the vehicle and not an identifiable person:
In general terms, there is some universality to the conclusion in Leon’s Furniture that personal information has to be essentially “about a person”, and not “about an object”, even though most objects or properties have some relationship with persons. As the adjudicator recognized, this concept underlies the definitions in both the FOIPP Act and the Personal Information Protection Act. It was, however, reasonable for the adjudicator to observe that the line between the two is imprecise. Where the information related to property, but also had a “personal dimension”, it might sometimes properly be characterized as “personal information”. In this case, the essence of the request was for complaints and opinions expressed about Ms. McCloskey. The adjudicator’s conclusion (at paras. 49-51) that this type of request was “personal”, relating directly as it did to the conduct of the citizen, was one that was available on the facts and the law.
In this case, the Public Body withheld the names of Twitter accounts and the image associated with a Twitter account, where it believed it was possible that the information may reveal the identity and image of an individual who is the account holder. The Public Body was concerned that disclosing the name of blocked Twitter accounts would enable the Applicant to infer that identifiable individuals associated with the Twitter accounts engaged in inappropriate conduct.
The Alberta OIPC observed that while some individuals may use their names as the name of their Twitter account, others do not. In addition, organizations and “bots” may also use Twitter accounts. As a result, the Alberta OIPC concluded that “the name of a Twitter account cannot be said to have a personal dimension necessarily, even though an account may have the appearance of being associated with an identifiable individual.”
Upon reviewing the user names in question, the Alberta OIPC noted that it was unable to say that the account name was likely to be about an identifiable individual, as it was unknown whether any of the information was, in fact, associated with an identifiable individual. The AB OIPC observed that while some names and corresponding pictures could possibly be genuine, others did not appear to be. In addition, some names appeared to be the names of organizations and businesses. With regard to the names and photographs that appear to be of individuals, the AB OIPC was unable to find, on the evidence before it, that the accounts with which they are associated were actually being used by these individuals, or that the name of the account and the image associated with it, were about the same individual.
To put it in the terms used by the Alberta Court of Appeal, the evidence before the AB OIPC “supports finding that the information severed by the Public Body is “about a Twitter account”, rather than “about an identifiable individual””.
The Alberta OIPC concluded that FIPPA would “apply in the same way to email addresses and Twitter accounts. If there is evidence establishing that an email address or a Twitter account is connected to an identifiable individual, and the email address or Twitter account appears in a context that reveals personal information about the individual, then the information is personal information”.
For more information about Denton’s data expertise and how we can help, please see our Transformative Technologies and Data Strategy page.
