PLB Home
Policy and Procedures Manual
Section 33.1 - Disclosure inside or outside Canada
OVERVIEWSection 33.1 establishes a narrowly defined set of purposes under which a public body may disclose personal information outside Canada. Sections 33.1 and 33.2 combined list the only circumstances under which a public body may disclose personal information inside Canada.
SECTION REFERENCE
33.1
(1)
A public body may disclose personal information referred to in section 33 inside or outside of Canada as follows:
(a) in accordance with Part 2; (b) if the individual the information is about has identified the information and consented, in the prescribed manner, to its disclosure inside or outside Canada, as applicable; (c) in accordance with an enactment of British Columbia or Canada that authorizes or requires its disclosure; (d) in accordance with a provision of a treaty, arrangement or agreement that, (i) authorizes or requires its disclosure, and (ii) is made under an enactment of British Columbia or Canada; (e) to a minister, if the information is immediately necessary for the performance of the duties of the minister; (f) to an officer or employee of the public body or to a minister, if the information is immediately necessary for the protection of the health or safety of the officer, employee or minister; (g) to the Attorney General or legal counsel for the public body, for use in civil proceedings involving the government or public body; (h) to the minister responsible for the Coroners Act, or a person referred to in section 36 of that Act, for the purposes of that Act; (i) for the purpose of (i) collecting monies owing by an individual to the government of British Columbia or to a public body, or (ii) making a payment owing by the government of British Columbia or by a public body to an individual; (j) in the case of the Insurance Corporation of British Columbia, if (i) the information was obtained or compiled by that public body for purposes of insurance provided by the public body, and (ii) disclosure of the information is necessary to investigate, manage or settle a specific insurance claim; (k) for the purposes of (i) licensing or registration of motor vehicles or drivers, of (ii) verification of motor vehicle insurance, motor vehicle registration or drivers licenses; (l) for the purposes of licensing, registration, insurance, investigation or discipline of persons regulated inside or outside Canada by governing bodies of professions and occupations; (m) if (i) the head of the public body determines that compelling circumstances exist that affect anyone’s health or safety, and (ii) notice of disclosure is mailed to the last known address of the individual the information is about, unless the head of the public body considers that giving this notice could harm someone’s health or safety; (n) so that the next of kin or a friend of an injured, ill or deceased individual may be contacted; (o) in accordance with section 36 (disclosure for archival or historical purposes). (2)
In addition to the authority under any other provision of this section or section 33.2, a public body that is a law enforcement agency may disclose personal information referred to in section 33
(a) to another law enforcement agency in Canada, or (b) to a law enforcement agency in a foreign country under an arrangement, a written agreement, a treaty or provincial or Canadian legislative authority. (3)
The minister responsible for this Act may, by order, allow disclosure outside Canada under a provision of section 33.2 in specific cases or specified circumstances, subject to any restrictions or conditions that the minister considers advisable.
Section 33.1 applies to the disclosure of personal information both inside and outside of Canada.
Section 33.1 permits, not requires, disclosure at the discretion of the public body. As indicated by the word "may" in the opening phrase, a public body uses its discretion and considers each new situation on its own merits. The word "only" indicates that any disclosures of personal information, outside of Canada, are limited to the circumstances outlined in section 33.1.
- Public bodies may not penalize people for refusing to consent to a new disclosure of their personal information by denying them the benefit or service for which their personal information was originally collected, or in any other way.
- Ministries that are contemplating new legislation or revisions to existing legislation that have privacy or access implications, or are developing or making changes to programs or electronic systems that collect, store, use or disclose personal information, must complete a privacy impact assessment (PIA) as required by section 69(5) of the Act and in accordance with Government Operating Policy 12.3.2.ii(f) Privacy Impact Assessments. All PIA’s related to legislative changes or to program and system initiatives that involve data linkages, information sharing, outsourcing, or are of a corporate nature must be submitted to the Minister responsible for the Act for review.
- Public bodies should disclose only the minimum personal information necessary to meet the operational requirements under the specific subsection of section 33.1.
- For the purposes of section 33.1(b), the person to whom the information pertains must agree to the disclosure in accordance with the requirements set out in regulation 6 and must specifically consent to the information being disclosed outside of Canada, if this is the case. Wherever possible, public bodies should obtain consent for all anticipated disclosures at the time that they collect the personal information (see manual section 32).
- Under section 33.1(c), disclosure may occur outside of Canada where it is authorized or required by an enactment of Canada or British Columbia.
- If a public body discovers that it has accidentally disclosed an individual’s personal information and the disclosure was not authorized by section 33.1, the public body must:
notify the Director or Manager of Information and Privacy or the FOIPP coordinator;
take steps to recover the personal information from all sources to which it has been disclosed;
determine the impact of the disclosure, and advise senior staff as appropriate;
advise, where appropriate, the individual whose information has been disclosed of the disclosure, explain the steps being taken to recover the information, and inform the individual of his/her right to complain to the Information and Privacy Commissioner;
advise both the Privacy Legislation Branch (PLB), and the Office of the Information and Privacy Commissioner (OIPC) in situations where the disclosure may have a serious public or personal impact;
examine policies and processes that may have led to the breach of privacy and revise if necessary; and,
provide staff education regarding privacy issues involved in the breach to reduce the potential of a future occurrence.
Privacy Protection Offences
Section 74.1 states that a person who discloses personal information not authorized by the Act, commits an offence. The fines for committing such an offence are up to $500,000 for a corporation; up to $25,000 for a partnership or an individual who is a service provider; and up to $2,000 for an individual who is not a service provider (for example, an employee). Section 74.1(8) states that in the defence of a prosecution of an offence under section 74.1, the person charged can try to prove that they exercised due diligence to avoid committing the offence.PROCEDURE
- According to Regulation 323/93, paragraph 6, consent must be in writing and must specify to whom personal information may be disclosed and how it may be used (see manual
section 32(b)).
- Consent must specifically state that the information may be disclosed outside Canada, if this is the case.
- Unless compelling reasons exist requiring the contrary, disclosures are recorded in writing. If a public body receives a verbal request for personal information and discloses it verbally, the transaction should be recorded in writing.
- All agreements, arrangements and treaties under which public bodies disclose personal information must be entered into the Information Sharing Agreement section of the Personal Information Directory that is published and maintained by PLB.
- Public bodies should ensure that incoming requests for personal information from other public bodies or law enforcement agencies are authorized and contain the following details:
the name of the individual whose information is requested;
the exact nature of the information desired;
the authority under which the information is requested;
the purpose for which the requesting agency will use the information; and,
the name, title and address of the person authorized to make the request.
- The written request for personal information under this section and the outgoing correspondence (recording the fact that disclosure did or did not take place) should be retained on file. A written record of a verbal request and disclosure should be retained on file.
A "notice of disclosure" must be in writing and must describe the specific personal information elements, which were disclosed, when, to whom and for what purpose.
A copy of the notice is also placed on the file of the person whose personal information has been disclosed.
Paragraph 33.1(a)
Public bodies may disclose personal information inside or outside Canada "in accordance with Part 2" in response to a request under section 5 (How to make a request). Part 2 of the Act permits disclosure:
where the person concerned has requested access to information, including his/her own personal information, subject to the exceptions in sections 12 to 22;
where a person or body has requested access to records containing the personal information of a third party and disclosure of the personal information does not constitute an unreasonable invasion of the privacy of the third party concerned under section 22, subject to other exceptions and to third party notification requirements; or
where section 25 applies (Information must be disclosed if in the public interest).
Paragraph 33.1(b)
"Identified" means that the person is aware of the specific information to be disclosed and has been informed of the new use to which the information will be put and of the consequences of agreeing or refusing to the disclosure.
Consented:
The absence of consent is interpreted as the absence of authorization. Where the person concerned has not consented to a disclosure of personal information, public bodies cannot assume consent to the new disclosure.
If the person concerned approves a disclosure, it means that the person knows the consequences of the disclosure of his/her personal information and may make an informed decision about whether or not to agree to it.
If the person concerned consents to his or her personal information being disclosed, he or she must specifically consent to it being disclosed outside of Canada.Example:
A university researcher asks a high school for the names and addresses of graduating students in order to contact them for a survey he is conducting. The school releases this information only if the students involved have given consent.
Paragraph 33.1(c)
Under subsection 33.1(c), disclosure may occur outside of Canada where it is authorized or required by an enactment of Canada or British Columbia.Paragraph 33.1(d)
The "treaty, arrangement or agreement" must specifically authorize or compel the disclosure of the personal information that is released under section 33.1(d). It is not enough that disclosure would assist in a program’s operation. Further, if a "treaty, arrangement or agreement" is used to release personal information under section 33.1(d), the authority to enter into the “treaty, arrangement or agreement” must be clearly established in an enactment for this provision to apply. The Government of Canada has sole power to conclude treaties with foreign countries.
Subsection 33.1(d) does not authorize public bodies to disclose personal information under the legislation of other provinces or other countries.
"Arrangements" should normally be in writing. A verbal arrangement is acceptable only on rare occasions, for example, where one or more of the participants do not wish to acknowledge that they have concluded an arrangement on sensitive law enforcement, security or intelligence matters. Where an arrangement is unwritten, the head of the public body approves disclosures of personal information that take place as part of the arrangement.
Before disclosing personal information under section 33.1(d), public bodies should ascertain that the treaty, arrangement or agreement, contains language specifically authorizing or requiring such exchange of information and,
(a) ensure that provisions for such an agreement are clearly spelled out in an enactment of British Columbia or Canada, or,
(b) ensure that the language of an enactment of British Columbia or Canada specifically provides for such an exchange of information.Paragraph 33.1(e)
Public bodies may use this provision to disclose personal information to a minister in situations where the information is “immediately” necessary for the performance of the Minister’s duties.
"Immediately necessary for the performance of the duties" means that the minister must need to see, generate or handle the personal information without delay in order to do his/her job. This may include the administration of statutes, regulations, programs and other activities.
A "minister"
Paragraph 33.1(f)
Public bodies may use this provision to disclose personal information to an officer or employee of the public body or to a minister if it is immediately required to protect the health or safety of the officer, employee or minister. This means that the minimum amount of personal information is disclosed to the fewest number of people necessary.
Paragraph 33.1(f) does not allow disclosure to the employees or officers of other public bodies
An "employee" is a person employed by a public body. The definition of employee in Schedule 1 of the Act includes a service provider retained to perform services for the public body. The term "officer" is included to ensure that all persons working for a public body in any capacity are encompassed by this disclosure provision.Example:
A student working with a public body as part of their educational activities or doing a practicum are to be deemed to be either an employee or an officer for the purposes of this Act.
"minister"
"For the protection of the health or safety of the officer, employee or minister" means that the disclosure must be necessary to prevent harm to the health or safety of the person in question (officer, employee or minister).Examples:
A public body has a client who is known to behave violently when dealing with the employees of this public body. The public body has told its employees about this client's behaviour and has instructed them to arrange for a security guard to be present whenever the client is known to be coming to the office for an appointment. This enables employees dealing with the client to take precautions for their own safety.
A prison inmate with active hepatitis is due to be transferred from one institution to another. To enable escort officers to take adequate precautions against contracting hepatitis, it is permissible to warn them that the prisoner has a highly contagious disease and to tell them what measures they should take to minimize the risk of infection.
Paragraph 33.1(g)
The Attorney General represents the government in legal matters and often requires access to personal information to discharge his/her legal duties. The Attorney General Act, RSBC 1996, c. 22, contains no specific provision authorizing ministries and other public bodies to disclose personal information. Paragraph 33.1(g) of the Act provides for such disclosures where appropriate.Example:
The Ministry of Transportation is named as a party in a civil proceeding for personal injuries in an accident that involved a bridge collapse on a public highway. The Ministry may disclose personal information about the victims and witnesses to the Attorney General to assist in the civil proceeding.
"Civil proceedings involving the government" are legal proceedings involving private rights and remedies (as opposed to criminal matters) in which the government of British Columbia or a public body is a party.
Government ministries and agencies must comply with the policies and procedures for responding to requests by the Ministry of Attorney General for disclosure of personal information to assist in legal proceedings involving the government of British Columbia. Contact your Director/Manager of Information and Privacy to obtain a copy of these procedures.
Paragraph 33.1(h)
Obtain written confirmation that the person/entity to which personal information is to be released under this section is authorized under subsection 36(1) of the Coroners Act to receive the information. Public bodies may wish to consult with their legal representatives and respond accordingly.
Public bodies may disclose personal information to people who are authorized under section 36 of the Coroners Act, RSBC 1996, c. 72, to appear personally or by counsel at the inquest; to tender evidence and call witnesses; to examine, cross examine, and re-examine witnesses; and to obtain from the coroner a summons directed to any witness whom they desire to call.
Disclosures under this provision, including disclosure to the minister responsible for the Coroners Act, must be for the purposes of the Coroners Act.
Person referred to in section 36 of the Coroners Act
The Coroners Act provides coroners with the authority to hold inquests into deaths due to certain causes (including deaths by violence, misadventure, negligence, malpractice, suicide, pregnancy, occurring suddenly and unexpectedly, by unknown diseases or causes, occurring in correctional institutions or prisons, occurring while resident in a community care facility or while in the custody of a peace officer).
Subsection 36(1) of the Coroners Act permits people, whose interest may be affected by evidence likely to be introduced at an inquest, to appear personally or be represented by counsel at the inquest. It also permits them to tender evidence and call witnesses, examine, cross-examine and re-examine witnesses and to obtain from the coroner a summons directed to any witness whom the person wishes to call.
Subsection 36(2) of the Coroners Act states that, where the inquest is into the death, arising out of his/her work, of a worker to whom Part 1 of the Workers Compensation Act applies, a representative of his/her employer and a representative of the trade union certified as the bargaining agent for the worker are deemed to be the persons to whom subsection 36(1) applies.
Paragraph 33.1(i)
When considering disclosure under this provision, a public body must ensure that the request is in writing and that it specifies the nature of the personal information to be disclosed, the name of the person whose information is requested (and any other necessary identifying information, such as file number), the purpose of the request (including a citation of the legal authority for collecting the monies) and the name, title and address of the official making the request.
The only personal information that should be released in response to such requests is the minimum amount needed to locate the person (e.g., last known address or telephone number). The reply should also be in writing so that there is a record of the disclosure.
The permissive authority of section 33(i)(ii) may not be used to override the mandatory provisions under Part 2 of the Act. (Order 217-1998). This means that this section may not be used to gain access to information that would be otherwise withheld under Part 2 of the Act.
"collecting monies owing by an individual"
Subparagraph 33(i)(i) is primarily, though not solely, intended to assist public bodies whose mandate does not normally include the collection of monies. Some public bodies (e.g., Ministry of Small Business and Revenue), which have program responsibility for the collection of monies owing, have the necessary powers to do so in their own legislation. Subparagraph 33(i)(i) merely reinforces their authority to request the necessary information.
For other public bodies, the collection of monies is incidental to their major responsibilities. Nevertheless, these ministries must on occasion recover debts or pursue defaulters. Subparagraph 33(i)(i) gives them the authority to carry out these activities.
"Monies" is the medium of exchange authorized or adopted by a government as part of its currency; assets that can be easily converted to cash; capital that is invested or traded as a commodity; funds; sums of money [Black’s]; sums of money; a current medium of exchange in the form of coins and banknotes; wealth; property viewed as convertible into money [OED].Examples:
A public body approaches a bank manager for information on the state of a person’s bank account, as the public body needs to know if the person is being truthful when he says that garnishment of his account to collect monies owing would cause undue hardship. In order to identify the person to bank employees, the public body must disclose a certain amount of personal information to them.
A person has been fined by the Ministry of Environment (the Ministry) for illegal dumping of chemicals. The Ministry is attempting to locate the person in order to collect the fine and, in doing so, approaches the Insurance Corporation of British Columbia (ICBC) for assistance. The Ministry discloses the person’s name and possibly other identifying information to ICBC. ICBC in turn may disclose the person’s address to the Ministry to assist in locating the person, in order to collect the monies owing.
A "payment" is a sum of money which a public body owes to an individual.
Example:
The municipality of Surrey owes a member of the public a refund for an overpayment of property taxes. The person has moved and the municipality does not have the new address. In order to locate the individual, the municipality asks former neighbours if they have a forwarding address for the person. The municipality must disclose the person’s name and, if necessary, the reason for the trace so that the neighbours know whom the municipality is trying to find and can provide the requested information.
Paragraph 33.1(j)
This provision allows the Insurance Company of British Columbia (ICBC) to disclose personal information both inside and outside of Canada where the personal information was collected for insurance purposes and disclosure is necessary to investigate, manage or settle a specific insurance claim.Examples:
An individual has submitted an insurance claim with ICBC. ICBC can then release personal information to a law enforcement agency to verify an individual’s involvement and confirm the details of an accident.
ICBC may disclose personal information outside Canada in a case where an ICBC insured driver is involved in a motor vehicle accident outside Canada.
Paragraph 33.1(k)
This provision permits the disclosure of personal information both inside and outside Canada for the purposes of licensing and registering motor vehicles and drivers, and verifying motor vehicle insurance, registration and drivers licenses.Examples:
commercial trucking purposes which are monitored on an international basis.
situations where an individual holding a British Columbia driver’s licence is involved with motor vehicle authorities in another jurisdiction.
Paragraph 33.1(l)
This provision permits the disclosure of personal information both inside and outside of Canada for the purposes of licensing, registration, insurance, investigation, and discipline of persons regulated inside or outside of Canada by governing bodies of professions and occupations.Examples:
When a physician moves from the UK to British Columbia, the College of Physicians and Surgeons could obtain the physician’s relevant history from the similar association in the UK.
The exchange of personal information between licensing bodies in different jurisdictions prevents a professional involved in criminal or unethical behaviour from moving to a new jurisdiction and repeating the same practice.
Paragraph 33.1(m)
This provision allows disclosure in urgent situations or in cases where disclosure is warranted because of other extraordinary circumstances while ensuring that the requirement to notify the person the information is about does not increase this risk or put someone else at risk. This paragraph usually applies to emergencies (e.g., in order to avert imminent danger to someone's health or safety) but it may also be used in other exceptional situations in which information must be disclosed either inside or outside Canada to protect an individual's health or safety and no other provision of section 33.1 or 33.2 applies.
There must be a danger to a person's physical or mental health or a threat to a person's life for the disclosure to fall under this provision.Example: Permissible disclosure
An individual is seriously injured in a car accident and immediate medical treatment is required to save his life. If the individual is incapacitated, his spouse would be given access to the medical information necessary to make medical decisions on his behalf. The notice provisions of this paragraph would be met by informing the individual of the disclosure when he recovers.
Example: Impermissible disclosure
Providing personal information to an individual attempting to bring about a family re-unification would not fit into this category, even though disclosure might seem justifiable from a humanitarian and compassionate point of view.
"notice of disclosure"
The limited exception to the notice requirement will allow public bodies, where appropriate, to weigh the risk of providing notice. It is not necessary for a public body to notify the individual the information is about if the head considers that harm will result to someone’s health or safety in giving this notice.Paragraph 33.1(n)
The "next of kin" is a person's nearest relative by blood or marriage which could include: a cousin, grandparent, niece or nephew, who has close ties to the deceased, injured or ill person.
Examples:
Spouse, parent, child.
Cousins brought up together as siblings.
A grandchild brought up by grandparents.
"may be contacted"
This paragraph allows for disclosure inside or outside Canada solely to inform the next of kin or a friend of the death, illness or injury of the person concerned and may include disclosure directly to the next of kin or to another person or organization in order to contact the next of kin or friend.
This paragraph does not permit disclosure of the nature of the illness or injury, or the cause of death.Paragraph 33.1(o)
This section restricts the disclosure of personal information outside of Canada for archival or historical purposes.
"Section 36" permits the archives of the government of British Columbia or the archives of a public body to disclose personal information for archival purposes if the disclosure meets conditions designed to prevent the invasion of the privacy of the person concerned.Paragraph 33.1(2)
Only public bodies that are law enforcement agencies are authorized to disclose personal information under section 33.1(2). This disclosure could be (a) to another law enforcement agency in Canada or (b) to a law enforcement agency in a foreign country, if an arrangement, written agreement, treaty or provincial or Canadian legislative authority is present.
Public bodies that have some law enforcement responsibilities, but whose primary function is not law enforcement, are not law enforcement agencies for the purposes of section 33.1(2). They are, however, authorized under section 33.2(i) to disclose personal information within Canada to assist in a specific law enforcement investigationExamples: Public bodies with law enforcement responsibilities that are not "law enforcement agencies" for the purposes of section 33.1(2):
Conservation branches, Ministry of Environment
Office of the Fire Commissioner, Ministry of Public Safety and Solicitor General
Financial Institutions Commission
Municipal bylaw enforcement officers
Other regulatory bodies responsible for enforcing compliance with a law.
"Law enforcement agency" is an agency whose primary function is law enforcement.
"Law enforcement agency in a foreign country"
Police forces and other law enforcement organizations in other countries including international organizations and the municipal or state police forces of foreign countries are included in this term.Examples:
In the United Kingdom: New Scotland Yard; Metropolitan London Police.
In the United States of America: Federal Bureau of Investigation (FBI); Central Intelligence Agency (CIA); US Immigration and Naturalization Service (USINS); Individual state and city police forces.
In France: La Sūreté.
International: Interpol.
"Arrangement, written agreement, treaty"
If necessary, "arrangements" under this paragraph need not be in writing.
"Legislative authority" means that the disclosure of personal information by the law enforcement agency is specifically authorized in legislation.
Paragraph 33.1(3)
In special instances the minister may allow the disclosure of necessary or appropriate personal information outside of Canada under section 33.2 that would otherwise be restricted by the Act. This section permits the minister to issue an order to allow such disclosures to take place. A summary of this order will be made public. Disclosure under section 33.1(3) would be determined on a case by case basis.