Public Sector

Question 1

Relevant Laws

Answer 1

Privacy Act 1983
Access to Information Act 1985

Provinces enables legislation with combined laws for both.

Question 2

Request to information

Answer 2

Individuals can request the institution directly to see if they’re allowing access. Else, a formal request can be filed and instiution must respond within 30 days of the receipt.

When denied, the institution must update the requestor and inform him/her about the right to appeal to commissioners.

Question 3

Decision to appeal to commissioner can include:

Answer 3

1. Denial of access
2. no response from the institution
3. Disagreement with the amount of fee charged
4. diagreement on the extension period
5. granting someone else access when the data subject disagrees.
6. denial on correction of info

Question 4

Privacy Act - Collection

Answer 4

Only collect if the information directly relates to the operations of the instiution. No consent required for this.

Collect info directly if it will be used for administrative purposes unless:
1. impossible to collect directly
2. perosn has consented for indirect collection
3. 13 exceptions

Question 5

Use of Info Collected under the Privacy Act

Answer 5

No consent required when info is used for the purpose for which it was collected and purposes consistent with it, or “for a purpose for which the information may be nonconsensually disclosed to the institution.”

Question 5

Requirement to collect from the individual for operating purposes of the institution

Answer 5

“The official Policy on Privacy Protection explains that “Parliamentary authority is usually contained in an act of Parliament or subsequent regulations,” and can also be in the form of “approval of expenditures proposed in the Estimates and as authorized by an Appropriations Act.”15 Although a specific legal requirement to collect the information is one option available to institutions subject to the policy, this requirement can be met by the mere recognition of a government program through the budgetary approval for that program. When one considers the implications, it is easy to conclude, based on the historical lack of scrutiny and detail provided in the budgetary approval process, that many institutions are collecting personal information based on some loose authority to do so, and the parliamentarians may not have been aware that approving the budget for a program increased the government’s ability to collect personal information in accordance with the Privacy Act.”

Question 6

Disclosure under the act

Answer 6

Consent required. However disclosure is permitted under Section 8(2) of the Act. It includes:
1. for a purpose for which info was obtained and for a use consistent with that purpose
2. in accordance with an act of parliament or any regulations made under authorizing such disclosure
3. complying with a subpeona or warrant
4. to the attorney general of Canada
5. disclosure to investigative agency
6. agreement or arrangement between govt of canada or an institution like govt of province, westbank first nation, govt of foreigin state, international organisation established by govt of states, for the purpose of administering or enforcing any law or carrying out a lawful investigation.
7. member of parliament for assisting the individual to whom the info relates in resolving a problem
8. to officers or employess for internal audit, or office of comptroller general or any body for audit purpose.
9. library and archives of Canada for archival purposes.
10. to any person or body for research or statistical purposes if head of govt institution: i) is satisfied that purpose cannot be accomplished in a form that would identify the individual to whom it relates; and ii) obtains from person or body a written undertaking that no subsequent disclosure will be made that would identify the individual.
11. to any abroginal govt., for researching or validating the claims, disputes, or grievances of any of the abroginal peoples of Canada
12. in order to collect a debt owing to her majesty in right of Canada
13. head of the institutions feels that public interest outweights invasion or disclosure would benefit the individual.

Question 7

Purposes consistent with the original purpose for which the info was collected

Answer 7

Revenue Canada’s practice of releasing info on travelers to Canada Employment and Immigration Commission to seek people getting insurance when out of country. Federal court of appeal said it is permitted under the act.

Also requriement to keep a record for 2 years when info is disclosed on these sections.

Further, if disclosed on public interest over privacy, then the commissioner must be notified.

Question 8

Info Source

Answer 8

Transparency Principle fo Privacy Act - requires each govt institution to publish yearly all the personal information banks maintained by the insitution. Must contain:
1. Description of class of individuals on whom the info contained
2. name of instituion having control
3. title and address of person to whom requests on info to be directed
4. SOP on purposes for obtaining the info and uses consistent with the purposes on which info will be put.
5. details on retention and disposal
5.

Question 9

Personal Information Banks - Access to Information Act Requests

Answer 9

“The Access to Information Act Requests bank contains the requests under the Access to Information Act submitted by individuals to access records under the control of the Treasury Board of Canada Secretariat, the replies to such requests, and any other information relevant to the processing of the requests.”

Question 10

Personal Information Bank - Application for Employment

Answer 10

“The Applications for Employment bank serves to maintain an inventory of applications from individuals requesting employment with the Treasury Board Secretariat. These requests “usually consist of a letter containing such information as name, address, education and experience. These applications are screened if positions become available.”

Question 11

Personal Info Bank - Education Leave/Co-op Replacement Program

Answer 11

“The Educational Leave/Co-op Replacement Program (EDCO) bank contains personal information such as name, address, telephone number, social insurance number, classification, department, employment and educational history, curriculum vitae, transcripts, letters of offer of employment and salary.”

Question 12

Personal Information Bank -“Financial Officer/Internal Auditor Recruitment and Development”

Answer 12

“The Financial Officer/Internal Auditor Recruitment and Development bank (FORD/IARD) contains personal information such as name, address, telephone number, social insurance number, language, employment equity, employment history, classification, education, curriculum vitae, and interview assessment.”

Question 13

Personal Information Bank - Public Enquiries

Answer 13

“The Public Enquiries bank contains the names, email addresses and telephone numbers of individuals who have submitted comments or questions using the departmental telephone line, email address, or feedback form on the Treasury Board Secretariat’s intranet and internet sites; it also contains the responses to such comments, questions and any other information relevant to the processing of these comments and questions. Only point-of-entry information will be maintained in this bank. Information may exist in other banks as the responses are processed; these responses will be retained according to the appropriate response banks.”

Question 14

Peronal Information Bank - Personal Service Contract

Answer 14

“The Personal Service Contract bank contains contracts placed, types of services rendered, length of contracts, and amount of money expended. The bank also contains supporting documents for the contracts.”

Question 15

Right of Access under the Privacy Act

Answer 15

1. Available to any citizen or PR
2. Must respond within 30 days or respond with extension or decision
3. No fee
4. General Obligation to assist like in the right langauge

Denied on :
1. was obtained from a foreign state and state is insisting on nondisclosure
2 .federal - provincial affairs could be injured
3. expectation of injury to international affair, national defense or security
4. “less than 20 years old and relates to the detection, prevention or suppression of crime, or the enforcement of any law of Canada or a province or activities suspected of constituting threats to the security of Canada”
5. “reasonable expectation of injury either to the enforcement of a law of Canada or province or to the conduct of a lawful investigation”
6. reasonable expection of causing injury to security of penal institution
7. info was collected by Royal Canadian Mounted Police while performing policing services for a province or municipality.
8. “would likely reveal the identity of an individual who furnished an investigative body with personal information relevant to the granting or denying of security clearances.”
9. “information’s release could reasonably be expected to lead to a serious disruption of the individual’s institutional, parole or statutory release program and the information was obtained by the Correctional Service of Canada or the National Parole Board about a person while they were serving a sentence for having committed an offence.”
10. threaten safety of individuals
11. “he information being accessed is the personal information of someone other than the requestor, and there is no permitted reason for the nonconsensual disclosure of the personal information of the person who is not the requestor.
12. The personal information being requested is subject to solicitor-client privilege.
13. The release of the personal information would be contrary to the requestor’s interest considering the particular physical or mental health of the individual seeking access.”

“Any individual who is granted access to information is also granted the right to request that corrections or notations be made to the personal information. Moreover, if the government institution shared the personal information with another institution and that information “were used to make a decision that affected the individual within the last two years, the original government institution would be responsible for making sure the subsequent entity receiving the personal information also made the necessary correction or notation”

Question 16

Exempt banks

Answer 16

“One type of personal information is completely inaccessible. The Privacy Act allows for the creation of exempt banks by institutions that have personal information holdings consisting predominantly of personal information that would be inaccessible because it is information that was obtained or prepared by any government institution or part of any government institution that is an investigative body in the course of lawful investigations pertaining to the enforcement of any law of Canada or a province. Whenever an institution does employ exempt banks, the privacy commissioner will audit use of the bank.”

Question 17

Retention of PI

Answer 17

“Section 4 of the regulations states:
Personal information concerning an individual that has been used by a government institution for an administrative purpose shall be retained by the institution:
a)for at least two years following the last time the personal information was used for an administrative purpose unless the individual consents to its disposal; and,
b)where a request for access to the information has been received, until such time as the individual has had the opportunity to exercise all his rights under the Act.”

Question 18

Role of OPC

Answer 18

1. Privacy act creates OPC
2. Broad powers to investigate and controls
3. only recommend at the end of solutions, exception when govt institutions erroneously denied access to PI being requested, in this case, OPC can proceed to federal court.
   4.

Question 19

No Fly list

Answer 19

“Privacy Commissioner Jennifer Stoddart objected to the program. In fact, in an unprecedented show of solidarity, the federal commissioner and all the provincial counterparts launched a massive campaign in June 2007 to exert political pressure on the government to cease the no-fly program.”

Question 20

Video Surveillance Guidelines

Answer 20

1. should be considered as an exceptional step and only used in exceptional circumstances when less privacy-invasive measures aren’t available.
2. people must be informed about the use of video surveillance cameras
3. right of access to personal infor must be respected
4. must be subject to independent audit and evalutaion
5. fair info practices should be respected in collection, use and disclosure of personal information.

Feb 2015, federal, provincial and territorial ombudsmen and commissioners issued joint guidance on use of body-worn cameras by law enforcement authorities. It called upon law enforcement to evaluate risks to privacy posed by these cameras and develop policies and procedures overseeing their use. Included:
1. informing public on the use
2. notifying individual when recording is done
3. safeguarding recordings through encryption, limited access, and set retention periods
4. establishing training and accountabilitiy process for employees.
5. establishing processes for responding to civilian on everyday interactions
6. ensuring info is protected in secondary use for recordings for officer training and research employee performance evaluation.

Question 21

Reasonable Expectation of Privacy - Federal vs Provincial

Answer 21

“Unlike the federal scheme, which relies solely on a broad definition of personal information, the approach in many provinces is to protect the vast array of data that is included in the definition of personal information in some instances, but in other cases to afford less protection to that personal information if it does not merit a reasonable expectation of privacy. This is particularly the case when dealing with the protections relating to the disclosure of personal information.”

“Unlike the federal Privacy Act, where the notion of an invasion of privacy is mentioned only once with respect to a single instance where the disclosure of personal information without consent is permitted, the provincial approach often allows the nonconsensual disclosure of personal information if the release of the information would not result in an unreasonable invasion of privacy.

“Nova Scotia law, Freedom of Information and Protection of Privacy Act (FOIPOP), provides a good example. It starts by stating:
20 (1) The head of a public body shall refuse to disclose personal information to an applicant if the disclosure would be an unreasonable invasion of a third party’s personal privacy.
Then, to help determine whether a disclosure of personal information constitutes an unreasonable invasion of a third party’s personal privacy, the act lists some of the relevant factors one should consider:
a)the disclosure is desirable for the purpose of subjecting the activities of the Government of Nova Scotia or a public body to public scrutiny;
b)the disclosure is likely to promote public health and safety or to promote the protection of the environment;
c)the personal information is relevant to a fair determination of the applicant’s rights;
d)the disclosure will assist in researching the claims, disputes or grievances of aboriginal people;
e)the third party will be exposed unfairly to financial or other harm;
f)the personal information has been supplied in confidence;
g)the personal information is likely to be inaccurate or unreliable; and,
h)the disclosure may unfairly damage the reputation of any person referred to in the record requested by the applicant.

“In addition, although those factors are to be considered, the act further describes situations where the disclosure of personal information will be presumed to be an unreasonable invasion of a third party’s personal privacy. Those situations are, not surprisingly, a list of situations involving what one would generally consider the more sensitive types of personal information. They are:
a)the personal information relates to a medical, dental, psychiatric, psychological or other health-care history, diagnosis, condition, treatment or evaluation;
b)the personal information was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation;
c)the personal information relates to eligibility for income assistance or social-service benefits or to the determination of benefit levels;
d)the personal information relates to employment or educational history;
e)the personal information was obtained on a tax return or gathered for the purpose of collecting a tax;
f)the personal information describes the third party’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness;”
“g)the personal information consists of personal recommendations or evaluations, character references or personnel evaluations;
h)the personal information indicates the third party’s racial or ethnic origin, sexual orientation or religious or political beliefs or associations; or,
i)the personal information consists of the third party’s name together with the third party’s address or telephone number and is to be used for mailing lists or solicitations by telephone or other means”

“To balance matters out, the law then provides a list of situations where the disclosure of personal information is not an unreasonable invasion of a third party’s personal privacy. These situations involve less sensitive personal information or a context in which it is more difficult to claim a reasonable expectation of privacy. The situations are:
a)the third party has, in writing, consented to or requested the disclosure;
b)there are compelling circumstances affecting anyone’s health or safety;
c)an enactment authorizes the disclosure;
d)the disclosure is for a research or statistical purpose and is in accordance with Section 29 or 30;
e)the information is about the third party’s position, functions or remuneration as an officer, employee or member of a public body or as a member of a minister’s staff;
f)the disclosure reveals financial and other similar details of a contract to supply goods or services to a public body;
g)the information is about expenses incurred by the third party while travelling at the expense of a public body;
h)the disclosure reveals details of a licence, permit or other similar discretionary benefit granted to the third party by a public body, not including “personal information supplied in support of the request for the benefit; or,
i)the disclosure reveals details of a discretionary benefit of a financial nature granted to the third party by a public body, not including personal information that is supplied in support of the request for the benefit or is referred to in clause (c) of subsection (3).”