100% guarantee too high a bar

The Office of the Information and Privacy Commissioner for Ontario has considered the issue of blurring of faces in a video – or more importantly the possibility of reversing that blurring – with its decision in Humber River Hospital (Re). The applicant had fallen in a hallway of the hospital, and sought three pieces of video footage showing the events. Much of the decision relates to whether that footage constituted personal health information and so whether it was covered under the relevant legislation or not, and whether it could be severed from information not covered. However, one further issue was another aspect of the hospital’s stance with regard to the footage:

[41] The hospital submits that blurring or blacking out images has traditionally been considered an appropriate method of severing video footage. It submits, however, that in this case, blurring out the images of the individuals other than the complainant is not sufficient to properly sever them out of the video. It submits that instructions on how to reverse or remove facial blurring or blacking out are readily available online.

 [42] The hospital further explains that in its initial response to the access request, it asked its lawyers to assist with the blurring of the video. The blurred video was then viewed by the complainant’s family, at no charge. The hospital submits that the complainant refused to see the video and refused to provide a confidentiality undertaking in exchange for a copy of the severed video. In the hospital’s submission, there is a real risk that he intends to re-identify the patients and other individuals in the video, and/or further disseminate the video to others who may do so.

The hospital proposed that the video should be blurred further by a cybersecurity expert, which would take ten hours and would be at the applicant’s expense, and that the applicant should be subject to an undertaking not to attempt to de-blur the video or to disseminate it to anyone else.

The Commissioner’s office ordered release of the video, and declined to impose any of the conditions sought by the hospital. The decision noted:

[54] I understand the hospital’s concern for confidentiality and its desire to ensure that the privacy of its patients is not compromised. In my view, however, the risk that the obscuring technology the hospital chooses to apply to the video will be reversed is far too remote to justify withholding the entirety of the footage from the complainant. As the hospital itself acknowledges, this office routinely makes orders for the release of severed video footage. This has been ordered in cases where the information to be withheld is highly sensitive. The standard for severing cannot be perfection. In my view, it would be too high of a bar to require that severing be 100% foolproof.

The adjudicator declined to order either that the applicant undertake not to attempt to de-blur the video or to disseminate it, holding that there was no basis beyond speculation to think that he might do so.