|
OVERVIEW
Sections 33.1 and 33.2 combined, list the only
circumstances under which a public body may disclose personal
information within Canada. Unlike Section 33.1 which also
includes disclosure outside Canada, Section 33.2 sets out the purposes for which
personal information may be disclosed only within Canada.
SECTION REFERENCE
33.2
A public body may
disclose personal information referred to in Section 33 inside Canada as follows:
(a) for the purpose for which it was
obtained or compiled or for a
consistent use with that purpose (see
Section 34);
(b) to comply with a subpoena,
warrant or order issued or made by a court, person or body in Canada with jurisdiction to compel the production of information;
(c) to an
officer or
employee of the public body or to a
minister, if the information is
necessary for the performance of the duties of the officer, employee or minister to whom the information is disclosed;
(d) to an officer or employee of a public body or to a minister, if the information is necessary for the delivery of a common or integrated program or activity and for the performance of the duties of the officer, employee or minister to whom the information is disclosed;
(e) to an officer or employee of a public body or to a minister, if the information is necessary for the protection of the health or safety of the officer, employee or minister;
(f) to the auditor general or any other prescribed person or body for
audit purposes;
(g) to a member of the Legislative Assembly who has been requested by the individual the information is about to assist in resolving a problem;
(h) to a representative of the bargaining agent, who has been authorized in writing by the employee, whom the information is about, to make an inquiry;
(i) to a public body or a
law enforcement agency in Canada to assist in an
investigation
(i) undertaken with a view to a law enforcement proceeding, or
(ii) from which a law enforcement proceeding is likely to result;
(j) to the archives of the government of British Columbia or the archives of a public body, for
archival purposes;
(k) in accordance with
Section 35 (disclosure for research or statistical purposes).
SUMMARY
Section 33.2 lists the
circumstances under which public bodies may disclose personal information within
Canada. Section 33.2 permits disclosure at the discretion of the
public body. Section 33.2 does not require disclosure. As indicated
by the word "may" in the opening phrase, a public body uses its
discretion and considers each new situation on its own merits. The
disclosures of personal information within Canada are limited to the
circumstances outlined in sections 33.1 and 33.2 combined.
The provisions of section
33.2 apply principally to disclosures to third parties, but also apply where a
person requests access to her/her own personal information.
POLICY
- Public bodies may not penalize people for refusing to consent to a new disclosure of their personal information by denying them the benefit or service for which their personal information was originally collected, or in any other way.
- Public bodies contemplating new legislation or
revisions to existing legislation must complete a privacy
impact assessment (PIA) as required by section
69(5) of the Act and in accordance with Government
Operating Policy 12.3.2.ii(f) Privacy Impact Assessments. Completed
PIA’s must be submitted to the Minister responsible for the Act for
review. Provincial government ministries and agencies must also complete
a privacy impact assessment when developing or making changes to programs
or electronic systems that collect, store, use or disclose personal
information.
- Public bodies should disclose only the minimum personal information necessary to meet the operational requirements under the specific subsection of section
33.2. For example, in responding to a subpoena, warrant or order
(Subsection 33.2(b)), the public body should only provide the personal
information specifically requested in the subpoena, warrant or order.
Where the subpoena, warrant or order is unclear, public bodies should clarify
with assistance of their legal representatives, as required.
- For the purposes of section 33.2, the person to whom the information
pertains must agree to the disclosure in accordance with the requirements set
out in regulation 6. Wherever possible, public bodies should obtain
consent for all anticipated disclosures at the time that they collect the
personal information (see manual Section 32).
- If a public body discovers that it has accidentally disclosed an individual’s personal information, and the disclosure was not authorized by section
33.2 or 33.1, the public body must:
-
notify the Director or Manager of Information and Privacy or the FOIPP coordinator;
-
take steps to recover the personal information from all sources to which it has been disclosed;
-
determine the impact of the disclosure, and advise senior staff as appropriate;
-
advise, where appropriate, the individual whose information has been disclosed of the disclosure, explain the steps being taken to recover the information, and inform the individual of his/her right to complain to the Information and Privacy Commissioner;
-
advise both the Privacy and Legislation (PLB), and the Office of the Information and Privacy Commissioner (OIPC) in situations where the disclosure may have a serious public or personal impact;
-
examine policies and processes that may have led to the breach of privacy and revise if necessary; and
-
provide staff education regarding privacy issues involved in the breach to reduce the potential of a future occurrence.
Privacy Protection Offences
Section 74.1 states that a person who discloses personal information not authorized by the Act, commits an offence. The fines for committing such an offence are up to $500,000 for a corporation; up to $25,000 for a partnership or an individual who is a service provider; and up to $2,000 for an individual who is not a service provider (for example, an employee). Section 74.1(8) states that in the defence of a prosecution of an offence under section 74.1, the person charged can try to prove that they exercised due diligence to avoid committing the offence.
PROCEDURE
- According to Regulation 323/93, paragraph 6, consent must be in writing and must specify to whom personal information may be disclosed and how it may be used (see manual Section 32(b)).
- Unless compelling reasons exist requiring the contrary, disclosures are recorded in writing. If a public body receives a verbal request for personal information and discloses it verbally, the transaction should be recorded in writing.
- All agreements, arrangements and treaties under which public bodies disclose personal information
must be entered into the Information Sharing Agreement section of the Personal Information Directory that is published and maintained by
PLB.
- Public bodies should ensure that incoming requests for personal information from other public bodies or law enforcement agencies are authorized and contain the following details:
-
the name of the individual whose information is requested;
-
the exact nature of the information desired;
-
the authority for the
investigation;
-
the purpose for which the requesting agency will use the information; and
-
the name, title and address of the person authorized to make the request.
-
The written request for personal information under this section and the outgoing correspondence (recording the fact that disclosure did or did not take place) should be retained on file. A written record of a verbal request and disclosure should be retained on file.
-
A "notice of disclosure" must be in writing and must describe the specific personal information elements, which were disclosed, when, to whom and for what purpose.
-
A copy of the notice is also placed on the file of the person whose personal information has been disclosed.
INTERPRETATION
Paragraph 33.2(a)
Secondary uses of personal information are disclosure or use of such information
for a purpose other than that for which it was originally collected.
Secondary uses of databases containing personal information are restricted by
section 33.2(a) of the Act. The Section permits the secondary disclosure
of personal information for the purpose for which it was obtained or for a
"use consistent with that purpose", (Investigation Report P98-011)
The "purpose" for which personal
information was obtained or compiled is the object to be attained or the thing
intended to be done, e.g., the administration of a program, the provision of a
service or other activity. Such purposes must meet the requirements of Section
32.
Personal information may be "obtained"
for a variety of reasons, for example, to decide on a person's eligibility for
benefits, to determine if a person is a suitable candidate for a job with the
government, to determine the type of medical care a person needs or to ascertain
the level of the public's satisfaction with the service provided by a public
body.
Personal information may be collected in a variety of ways -- through forms,
surveys, interviews (where the responses are recorded in some way),
questionnaires, film, audio or video tapes, magnetic media or other non-textual
media.
Personal information is "compiled"
when it is assembled from several sources or generated, calculated,
extrapolated, interpolated, linked, deduced or created.
A consistent use is one that has a direct
and reasonable connection to the original use. A disclosure for a
consistent use is therefore permissible if it is directly connected to the
original use or is a logical extension of the original use.
Examples:
-
John Doe writes to a municipal councillor in order to raise an issue that he
would like to have discussed at an upcoming council meeting. The letter
does not contain sensitive personal information and Mr. Doe request that the
councillor bring the issue forward on his behalf. IN this case, it would
be a consistent use of Mr. Doe's personal information to circulate the letter at
the council meeting without severing.
-
A community health unit compiles a mailing list of participants in a
pre-natal program. The health unit created and uses the mailing list to
distribute information about program activities and about pre- and post-natal
health care. Disclosure of the mailing list to the the Ministry of Health
so that the Ministry can monitor the program's effectiveness would be consistent
with the purpose for which the health unit originally compiled the list.
Disclosure to a local retailer who intends to distribute a catalogue of baby
products would not be consistent with the purpose for which the health unite
compiled the list. The health unite would have to obtain the consent of
each individual on the list before disclosing it to the retailer.
-
Providing a local newspaper with copies of photographs taken by or for a school may, in some circumstances, be disclosure of the students' personal information for a consistent purpose. In deciding whether or not such a disclosure is permitted under paragraph 33.2(a), the school considers the purpose of disclosing the photograph and whether it has a reasonable and direct connection to the purpose of the event being photographed.
There may be a reasonable expectation that photographs of participants in a public function such as a soccer game or a school play would be disclosed publicly. For example, the publication of a photograph of the cast of a school play in a flyer advertising the play would be disclosure for a consistent purpose.
It is less likely that there would be the same expectation of disclosure of candid photographs of students in a classroom or on the playground.
-
Whether or not a school allows a local newspaper to photograph school events is determined by the school's general policy on access to school property, not by the Act. The newspaper is not a public body and their collection and use of personal information is not governed by the Act.
Public bodies may disclose personal information if it is necessary to do so
in order to accomplish the purpose for which the personal information was originally
acquired or assembled. Such purposes must meet the requirements of Section
32 (Use of personal information). Public bodies may disclose personal
information for a consistent use if it is directly connected to the original use
or is a logical extension of the original use. See Section
34. Paragraph 33.2(b)
A "subpoena" (from the Latin sub poena,
"under penalty"), also called a "summons to witness", is a
command issued by a party in litigation requiring the attendance of a person as a witness at a court or hearing, at a certain place and time, to give testimony on a certain matter. Under a subpoena duces tecum ("[bring the documents] with you under penalty"), the person may also be required to bring documents, records or files in her/his possession or under her/his control relating to the subject matter of the proceedings.
In this context, a "warrant" is a judicial authorization to collect [personal] information.
In this context, an "order" is an authoritative command, direction or instruction [to produce personal information].
A "Court, person or body with jurisdiction to compel the production of
information" has the power to order persons or bodies to produce information.
Time is usually of the essence in dealing with a subpoena, as it is often served with very little notice.; Employees of public bodies do not ignore subpoenas, as they risk being cited for contempt of court and, at a minimum, fined if they do so. Consult with the public body’s legal counsel and respond accordingly.
Although public bodies "may disclose" personal information under paragraph 33.2(b), public bodies normally comply with orders, warrants or subpoenas, both to assist in the administration of justice and because they may be cited for contempt of court if they refuse to comply with the order, warrant or subpoena.
Public bodies may wish to consult their legal advisors when they receive an order, warrant or subpoena to determine the compellability of the personal information in question, whether the subpoena, order or warrant has been served properly or whether there is some compelling reason to oppose the order, warrant or subpoena.
Paragraph 33.2(c)
Public bodies may use this provision to disclose personal information to an officer or employee within the public body or to any minister. This means that the minimum amount of personal information is disclosed to the fewest number of people necessary to perform the duties of, or protect the health or safety of, the officer, employee or minister.
Paragraph 33.2(c) does not allow disclosure to the employees or officers of other public bodies
An "employee" is a person employed by a public body. The definition of employee in Schedule 1 of the Act includes a person retained under contract to perform services for the public body. The term
"officer" is included to ensure that all persons working for a public body in any capacity are encompassed by this disclosure provision.
Example:
A "minister"
"Necessary for the performance of the
duties" means that the employees, officers or ministers must need to see, generate or handle the personal information in order to do their jobs. This may include the administration of statutes, regulations, programs and other activities.
Examples:
-
A staffing officer and members of the screening and assessment board require access to the resumes of applicants in a job competition as part of their responsibilities in running the competition.
-
A payroll clerk must see some of the personnel information of a public body's employees to administer their pay, service and attendance records.
-
A manager must see relevant records in an employee's personnel file to determine what disciplinary action is appropriate.
-
A director or manager of information and privacy requires access to personal information in an applicant's record to manage a request.
-
A municipal property owner writes to a municipal councillor in order to solicit her aid in resolving a dispute with an identified local employee. The letter includes sensitive information about the property owner's finances and the councillor is asked to treat the matter in confidence. It may be necessary for the councillor to disclose the personal information to the municipal official in charge of the employee's work area in order to resolve the problem. However, only the personal information that is strictly necessary for the official to deal with the problem is disclosed. The letter may not be circulated to other council members or discussed at an open meeting of council unless it can be severed so that the property owner's identity is not revealed.
Paragraph 33.2(d)
Personal information may be shared with another public body’s officer or employee (which includes contractors) or to a minister in order to deliver a common or integrated program or activity. The personal information may only be shared to allow the officer, employee or minister to perform their duties.
Paragraph 33.2(e)
"For the protection of the health or safety of the officer, employee or
minister" means that the disclosure must be necessary to prevent harm
to the health or safety of the person in question (officer,
employee or minister).
Examples:
-
A public body has a client who is known to behave violently when dealing with the employees of this public body. The public body has told its employees about this client's behaviour and has instructed them to arrange for a security guard to be present whenever the client is known to be coming to the office for an appointment. This enables employees dealing with the client to take precautions for their own safety.
-
A prison inmate with active hepatitis is due to be
transferred from one institution to another. To enable escort officers to take
adequate precautions against contracting hepatitis, it is permissible to warn
them that the prisoner has a highly contagious disease and to tell them what
measures they should take to minimize the risk of infection.
Paragraph 33.2(f) "Auditor
General" Public bodies may disclose personal information for
audit purposes, financial or otherwise, to a person or body specified in the
regulations to the Act. "Audit" Disclosure is permitted for an audit conducted both by employees or officers of the public body and by external contractors. (Contractors must undertake to abide by the provisions of the Act in protecting the personal information in their care).
The personal information disclosed under paragraph 33.2(f) may be used only for audit purposes.
The definition of "audit" in this context does not include the verification of claimants’ eligibility for benefits (i.e., where the personal information is used to make decisions about the persons concerned). It also does not include
"security audits".
Paragraph 33.2(f) reinforces the authority of the Auditor General under the Auditor General Act to be given access to a wide variety of information in records under the custody or in the control of ministries and other public bodies in order to carry out her/his audit duties. The Auditor General may also require that officers and employees of ministries and public bodies provide explanations and reports needed to perform her/his audit duties. Similarly,
"any prescribed person or body" performing audits may have
access to whatever information is needed to carry out the audit.
Paragraph 33.2(g)
A "Member of the Legislative Assembly (MLA)"
This provision permits
disclosure only to members of the Legislative Assembly of British Columbia and
only to assist the person concerned to resolve a problem. In practice,
MLA's may designate their constituency assistants to act on their behalf in
requesting personal information under paragraph 33.2(g). MLA's should be
asked to provide a list of designated staff to public bodies so that public
bodies know who is authorized to act on the MLA's behalf. "
Paragraph 33.2(g) does not
allow for the disclosure of personal information to elected federal or municipal
representatives.
"Assist in resolving a problem"
A simple inquiry as to the progress of a person's application for a service or benefit, where the application is proceeding normally, does not warrant disclosure. In such cases (i.e., where there is no problem to resolve), the person concerned must provide written authorization for the MLA to receive his/her personal information. Alternatively, a public body can provide the information directly to the person concerned.
The written consent of the person concerned is not normally required for disclosure to MLA’s under this paragraph. The inquiry and disclosure should be recorded
in writing. Where they take place verbally, however, the transaction should be noted on the person's file. In cases where the information is particularly sensitive (e.g., medical or criminal information), the public body may require the written consent of the person concerned.
It is likely that the MLA will pass the personal information she or he receives from a public body to the person concerned.
Public bodies do not release to the MLA, verbally or in writing, any information that would be excepted from disclosure to the person
concerned. For example, information concerning an investigation for law enforcement purposes might be excepted if the person concerned made a request for personal information. Such information is not to be released to the MLA, unless it is absolutely essential for the MLA to assist the person in resolving a problem. In such rare cases, the MLA should undertake
in writing not to disclose the information to the person concerned.
In all cases, the public body will take steps to verify the identity of the MLA requesting the personal information before disclosure. In the event that personal information belonging to a third party is to be disclosed to a MLA's assistant, public bodies verify the identity of the assistant and their relationship to the MLA making the request.
Paragraph 33.2(h)
"Representative of the bargaining agent"
Public bodies may disclosure personal information, as authorized by the person to whom the information pertains, to a representative of a union or other organization that negotiates on behalf of workers with their employers for improvements in pay, working hours, benefits and other working conditions.
"Authorized in writing"
The person to whom the information pertains must sign and date a consent form or other statement which clearly states to whom the information may be disclosed and for what purpose. The consent form should also provide notice to the individual that refusal to provide consent will not affect any decisions involving the individual.
"To make an inquiry"
For the purposes of an inquiry only, the representative may receive personal information that the employee has specifically authorized for release.
The representative may not exercise the employee's right of access to the rest of her/his personal information in the custody or control of the government or the employee's right to request a correction to his/her personal information.
Paragraph 33.2(i)
Public bodies have the discretion not to disclose personal information to other public bodies or law enforcement agencies if the request relates to an investigation that is not focused and where personal information is sought on suspicion, surmise or guesses.
"Law enforcement"
A "law enforcement agency in Canada" includes any agency in Canada whose primary function is law enforcement.
Examples:
-
Municipal police forces, such as the Vancouver Police or the Royal Canadian Mounted Police (R.C.M.P.) in its role as municipal police.
-
Provincial police forces, such as the Ontario Provincial Police (O.P.P.) or the R.C.M.P. in its role as provincial police.
-
Federal agencies, such as the Canadian Security Intelligence Service (C.S.I.S.) and the R.C.M.P. in its role as federal police.
-
Other federal, provincial and municipal agencies which enforce laws.
An "investigation" is a methodical process of examination, inquiry and observation including examining a crime scene, interviewing witnesses and reviewing documents.
A "proceeding" is the form and manner of conducting juridical business [business having to do with the administration of justice] before a court or judicial officer. Thus a "law enforcement proceeding" is a juridical process undertaken for law enforcement reasons with a view to imposing penalties or sanctions ()as opposed to simply gathering information for intelligence purposes).
"likely to result"
For a public body to disclose personal information under this paragraph there must be a reasonable probability that a law enforcement proceeding will result.
"with a view to"
The purpose of the investigation must be to institute law enforcement proceedings, even if, for lack of evidence, such proceedings do not actually take place.
Paragraph 33.2(j)
"Archival purposes"
When a public body transfers records containing personal information to the control of the archives of the government of British Columbia, it is disclosing that personal information. The Act permits disclosure for "archival purposes", that is, for the purposes of any of the functions normally performed by, for or within an archives, including scheduling, selecting, preserving, arranging and describing records and making them available for use.
Paragraph 33.2(k)
Section 35
Section 33.2 lists the only types of disclosure permitted within Canada under the Act. In order for disclosures under
Section 35 to be permitted, they it must also be included in Section 33.
"Section 35" permits disclosures by public bodies for research or statistical purposes if certain conditions are fulfilled.
REFERENCES
|
