|
OVERVIEW
Section 30 requires a public body to provide appropriate physical and procedural security measures to protect personal information in
its custody or under its control.
SECTION REFERENCE
30 A
public body must protect
personal information
in its custody or under its control by making
reasonable security arrangements against such risks as
unauthorized access,
collection,
use, disclosure or
disposal.
SUMMARY
Section 30 imposes a duty upon
the public body to prevent unauthorized access to personal information in its custody or control both from within and outside the public body. This section also requires the
public body to ensure that access by members within the public body is governed by the principle of
need to know. Appropriate physical and procedural arrangements are discussed below.
POLICY
- Public bodies must:
-
ensure their employees are trained to follow proper security procedures;
-
monitor their employees’ compliance with security standards;
-
ensure physical and procedural security precautions are established and maintained at appropriate levels; and,
-
comply with the CORE security access matrix for recorded information.
-
Public bodies shall analyze the types and level of sensitivity of the personal information in their custody and control. Public bodies shall follow the directions on security of information, provided in
CORE Chapter
12 and take the necessary steps, over time and within available resources, to implement those physical and procedural safeguards.
-
A Privacy Protection Schedule (PPS) for use by ministries must be completed and attached as a schedule to any contract between ministries and a contractor under which the contractor will be collecting, creating, using, disclosing or storing "personal information" (as defined in the
FOIPPA) unless it is not intended that the ministry will own or control the personal information. The Core Policy Manual reference is Contract Award Administration Policy 11 at
CPM 6.3.3(e)
(11).
-
The PPS for use by other public bodies may be completed and attached as a schedule to any contract between a public body and
service provider under which the service provider will be collecting, creating, using, disclosing or storing "personal information" (as defined in the
FOIPPA) unless it is not intended that the public body will own or control the personal information.
-
Public bodies should develop policy governing the use of and access to non-written formats of recorded personal information (e.g. audio tapes, video tapes, photographs, and discs) to supplement the policies governing the use of and access to written information.
-
Public bodies must ensure that the disposal of personal information has been approved by the designated authority and meets all the requirements of any governing legislation. For Ministries, this means disposal in accordance with the Document Disposal Act and ARCS/ORCS On-line. Public bodies not covered by the Document Disposal Act are encouraged to use procedures outlined in point 5 below.
-
Notwithstanding any other authorities that any public body may be subject to, a public body must retain personal information that has been used to make a decision affecting an individual for a minimum of one year.
PROCEDURE
- Review all records containing personal information to determine which category of
CORE Chapter
12 applies to those particular records. CORE Chapter 12 defines the security arrangements for all forms of government documents.
- Those public bodies not governed by
CORE should consider using a sliding scale of security as defined under Interpretation in this section.
- To ensure the security and retention of audio tapes, video tapes or discs, public bodies should follow the guidelines as stated in the
Records and Information Management Manual.
- Establish procedures to minimize the risk of unauthorized access. Permit access to personal information only by personnel who require it in order to perform their duties. Log all access, including who accessed the information, their purpose for access and the time of access. Establish a Security Access Matrix that describes which job functions are permitted access to specific types or groups of personal information. These access charts should be available to all staff. Access to personal information should only be permitted to those who demonstrate their right of access on the security access chart.
- The public body is responsible for ensuring that the disposal of personal information has been approved by the designated authority. This responsibility may be exercised in several ways:
-
transfer of the record to the legal custody of
the archives of the government of British Columbia or the archives of a public
body; or
-
physical destruction of the record containing the personal information in such a way that it cannot be retrieved or reconstructed (e.g. paper records should be shredded, burned or pulped; magnetic media should be erased or physically destroyed).
-
Standards for the destruction of records are available from the archives of the government of British Columbia.
-
Public bodies should keep a record of the personal (and non-personal) information they destroy, transfer to
the archives of the government of British Columbia, or transfer to the archives of a public body.
-
If the final disposition of records containing personal information is to the legal custody of the
the archives of the government of British Columbia or to the archives of a public body, the
public body must ensure that the security and confidentiality of personal information is protected during storage and transfer.
-
A review of security arrangements should be undertaken as part of any Privacy Impact Assessment conducted by completing the
Privacy Impact Assessment Process. Additionally, a more in depth evaluation of security standards can be undertaken by completing a Threat and Risk Assessment Form which is available from the Risk Management Branch of the Ministry of Finance.
INTERPRETATION
For public bodies covered by the Core
Policy Manual (CORE), "reasonable security arrangements" are those as provided for in
the CORE
Policy Manual.
For public bodies not covered by CORE, "reasonable security arrangements" are those
that
a fair, rational person would think were appropriate to the sensitivity of the information and to the medium in which it is stored, transmitted, handled, or transferred. A sliding scale of security arrangements is appropriate, depending on the sensitivity of the personal information that a public body handles.
Stringent security measures (e.g., locked filing cabinets, computer access codes and a physically secure room to which access is controlled by a guard, receptionist, locked door or electronic access control device) are appropriate for particularly sensitive information such as medical records, personnel files or inmate files.
Less rigorous methods (e.g., unlocked filing cabinets; computers kept behind a counter or other barrier to the public; office doors locked at night) are adequate for less sensitive information, such as names and addresses.
Examples of physical security arrangements:
-
Storing records containing personal information in locked storage rooms or locked filing cabinets, with controls over distribution of keys or lock combinations.
-
Use of numbers or other methods to label file drawers, records storage boxes and other storage containers so as not to reveal the fact that they contain personal information.
Examples of procedural security arrangements:
-
Access controls on computer systems (i.e., passwords that allow different levels of access to various screens and differing capabilities to read, extract or change data).
-
Where contracted services are used for storage, transportation or destruction of records, including security provisions in the service contract, public bodies should require the contractors to provide a certificate of destruction.
Unauthorized access
Access to personal information is unauthorized if an employee of a public body does not have approved access according to the security access chart (i.e., if the employee has access to personal information which they do not need to see or handle in the course of their job duties).
Unauthorized collection
"Collection" of personal information is unauthorized if it is not done in accordance with sections 26 (Purpose for which information may be collected) and section 27 (How personal information is collected) of the Act. See "collect" in Policy Definitions.
Unauthorized use
"Use" of personal information is unauthorized if it is not in accordance with section 32 (Use of personal information) of the Act.
Unauthorized disclosure
An unauthorized disclosure is revealing, exposing, showing, providing copies of, selling, giving or telling personal information in a way that is not in accordance with section 33
(Disclosure of personal information) of the Act. The public body ensures that disclosures of personal information are authorized under section 33.1 or section 33.2 of the Act.
"Unauthorized disposal" of personal information means destruction or removal of records containing personal information from the custody and/or control of a public body without the approval of the designated authority or in ways which do not adhere to approved methods and standards. Public bodies must not dispose of personal information within a year of that information being used to make a decision about an individual. See section 31 (Retention of personal
information) and section 31.1 (Application to employees and others).
"Authorized Disposal" means disposing of records containing personal information in accordance with approved legislated government records standards and procedures. For public bodies which are covered by the Document Disposal Act: disposal of records must be authorized by a records retention and disposition authority. Such retention and disposition schedules may require a public body to retain the records well past the 1-year period required under section 31 of this Act.
A public body ensures that the disposal of personal information is approved by the designated authority. For public bodies, which are subject to the Document Disposal Act, disposal of records must be authorized by a records retention and disposition authority approved either by the Executive Council or the Legislative Assembly, depending on the age of the records.
If the public body is not subject to the Document Disposal Act, no disposal of personal information occurs without the authorization of the
head of the public body. The head may delegate this responsibility.
Authorized disposal of information may be either:
-
Transfer of the record to the legal custody of the
archives of the government of British Columbia or the archives of a public body; or,
-
Physical destruction of the record containing the personal information in such a way that it cannot be retrieved or reconstructed (e.g., paper records should be shredded, burned or pulped; magnetic media should be erased or physically destroyed).
Standards for the destruction of records are available from
the archives of the government of British Columbia for public bodies subject to the Document Disposal Act.
Examples of unauthorized disposal:
-
Destroying sensitive medical records by throwing them into an ordinary garbage can, instead of using approved methods of destruction such as shredding or incineration.
-
Destroying employment competition files immediately after the competition when the approved retention and disposition schedule requires that they be kept for the current year plus three additional years before destruction.
Public bodies should keep a record of the personal (and non-personal) information they destroy or transfer to
the archives of the government of British Columbia or to the archives of a public body.
If the final disposition of records containing personal information is their transfer to the legal custody of the
archives of the government of British Columbia or to the archives of a public body, the
public body must ensure that the security and confidentiality of personal information is protected during storage and transfer.
REFERENCES
APPENDICES
|
