Bill 210 — Second Session, 24Th Legislature, 46 Elizabeth Ii the Legisla Tive A Ssembly of A Lberta Bill 210 Protection of Personal Information In the Private Sector Act (Legislature 24, Session 2)

L24 S2 1013

Alberta — Bills

1998 BILL 210 Second Session, 24th Legislature, 46 Elizabeth II THE LEGISLA TIVE A SSEMBLY OF A LBERTA BILL 210 PROTECTION OF PERSONAL INFORMATION IN THE PRIVATE SECTOR ACT MR. DICKSON First Reading Second Reading Committee of the Whole Third Reading Royal A ssent

Bill 210 Mr. Dickson BILL 210 1998 PROTECTION OF PERSONAL INFORMATION IN THE PRIVATE SECTOR ACT (Assented to , 1998) HER MA JESTY, by and with the advice and consent of the Legislative A ssembly of A lberta, enacts as follows:

Definitions 1 In this A ct, (a) "Commissioner" means the Information and Privacy Commissioner; (b) "personal information" means personal information as defined in the Freedom of Information and Protection of Privacy Act; (c) "private body" means (

i) an organization, society, corporation or other body, other than a public body, that employs 100 or more people, (ii) a bank, (iii) a treasury branch, (iv) a trust corporation, (

v) a loan corporation, (vi) a credit union, or (vii) an insurance company; 1

(d) "public body" means a public body as defined in the Freedom of Information and Protection of Privacy Act; (e) "record" means a record of personal information in any form and includes personal information that is written, photographed, recorded or stored in any manner but does not include software or any mechanism that produces records; (f) "third party" means a person, group of persons or an organization other than the individual who is the subject of the record or the private body. Purposes of this Act 2 The purposes of this A ct are (

a) to control the manner in which a private body may collect personal information from individuals, to control the use that a private body may make of that information and to control the disclosure by a private body of that information, (

b) to allow individuals, subject to limited and specific exceptions as set out in this A ct, a right of access to personal information about themselves that is held by a private body, (

c) to allow individuals a right to request corrections to personal information about themselves that is held by a private body, and (

d) to provide for independent reviews of decisions made by private bodies under this A ct and the resolution of complaints under this A ct.

PART 1 COLLECTION AND USE OF PERSONAL INFORMATION BY PRIVATE BODIES Purpose of record 3(1) A private body may, for a serious and legitimate reason, create a record but must, when creating the record, enter the purpose for which the record is created on the record.

(2) The purpose of the record is part of the record. 2

Necessary personal information 4 A private body collecting personal information may only collect personal information necessary for the purpose of the record. Collection of personal information 5 A private body must collect personal information directly from the individual the information is about unless (

a) another method of collection is authorized in writing by that individual, (

b) the collection of the information is authorized by an A ct or regulation under that A ct, (

c) the personal information is collected for the purposes of collecting a debt owed to the private body, or (

d) the personal information is collected for the purpose of providing legal services. Obligation to inform 6 A private body that collects personal information from the individual who is the subject of the record must, if requested by the individual, inform the individual of (

a) the purpose for which the personal information is collected, (

b) the title, business address and business telephone number of an officer or employee of the private body who can answer the individual's questions about the collection and the nature and substance of the information, (

c) how the individual may have access to the record, and (

d) the procedure for correcting errors about the individual in the record. Accuracy of personal information 7 If an individual's personal information will be used by a private body to make a decision that directly affects the individual, the private body must (

a) make every reasonable effort to ensure that the personal information is accurate and complete, and 3

(

b) retain the personal information for at least 3 months after using it so that the individual has a reasonable opportunity to obtain access to it. Right to request correction of personal information 8(1) A n individual who believes there is an error or omission in the individual's personal information may request the private body that has the information in its custody or under its control to correct the information.

(2) If no correction is made in response to a request under subsection (1), the private body must annotate or link the information with the correction that was requested but not made.

(3) On correcting, annotating or linking personal information under this section, the private body must notify any third party to whom that information has been disclosed within the preceding year that a correction, annotation or linkage has been made.

(4) On being notified under subsection (3) of a correction, annotation or linkage of personal information, a third party must make the correction, annotation or linkage on any record of that information under its custody or control.

(5) Within 30 days after the request under subsection (1) is received, the private body must give written notice to the individual that (

a) the correction has been made, or (

b) an annotation or linkage has been made pursuant to subsection (2). Protection of personal information 9 A private body must protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal. Use of personal information 10 A private body may use personal information only (

a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose, (

b) if the individual the information is about has consented to the use, or 4

(

c) for a purpose for which that information may be disclosed under sections 11, 12 or 13. Disclosure of personal information 11(1) A private body may disclose personal information only (

a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose, (

b) if the individual the information is about has consented to the disclosure, (

c) for the purpose of complying with an enactment of A lberta or Canada or with a treaty, arrangement or agreement made under an enactment of A lberta or Canada, (

d) for any purpose in accordance with an enactment of A lberta or Canada that authorizes or requires the disclosure, (

e) for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body having jurisdiction to compel the production of information or with a rule of court that relates to the production of information, (

f) for the purpose of enforcing a legal right that the private body has against any person, (

g) for the purpose of (

i) collecting a fine or debt owing by an individual to the private body or to its assignee, or (ii) making a payment owing by a private body to an individual, (

h) to a representative of a bargaining agent who has been authorized in writing by the individual the information is about to make an inquiry, (

i) so that the next of kin or a friend of an injured, ill or deceased individual may be contacted, (

j) in accordance with

section 13, 5

(

k) for use in a proceeding before a court or quasi-judicial body to which the private body is a party, (

l) when the information is available to the public, (

m) to a relative of a deceased individual if the disclosure is not an unreasonable invasion of the deceased's personal privacy, (

n) to its lawyer, (

o) to a public body that collects information in the exercise of its functions or the implementation of a program under its management, (

p) to a person to whom the information must be communicated by reason of the urgency of a situation that may threaten the life, health or safety of the individual concerned, or (

q) where the private body has reasonable grounds to believe that the individual concerned has committed or is about to commit a crime or offence against the private body, its agents or employees.

(2) Only information that is reasonably required may be disclosed under subsection (1)(g). Consistent purpose 12 For the purposes of sections 10(

a) and 11(1)(a), a use or disclosure of personal information is consistent with the purpose for which the information was collected or compiled if the use or disclosure has a reasonable and direct connection to that purpose. Disclosure for research or statistical purposes 13(1) The Commissioner may, on written request, grant a person authorization to receive personal information from a private body for study, research or statistical purposes, without the consent of the individual concerned, if, in the Commissioner's opinion, (

a) the intended use of the information is not frivolous and the study, research or statistical purpose cannot be achieved unless the information is communicated in a form allowing the person to be identified, and (

b) the personal information will be used in a manner that will ensure its confidentiality. 6

(2) In granting a request under subsection (1) the Commissioner may add any conditions to the use of the personal information that the Commissioner believes are necessary to preserve the confidentiality of the information.

(3) A request granted under this

section shall be for a specified period of time. Employment information 14 No private body may take any employment action against an individual because of an individual's refusal to disclose personal information except where (

a) the information is directly related to the requirements of the individual's employment, or (

b) the information is required to be provided under the terms of a collective agreement under which the individual is covered.

PART 2 VIDEO SURVEILLANCE Restrictions on video surveillance 15 A private body shall not directly or indirectly (

a) conduct video surveillance of employees or any other person in areas where there is a reasonable expectation of privacy, including toilets, showers and change rooms, or (

b) conduct video surveillance for monitoring employee work performance unless it holds a permit issued by the Commissioner pursuant to

section 16. Application to Commissioner for video surveillance 16 The Commissioner may, upon application by a private body and payment of such fees as may from time to time be established by the Commissioner, issue a permit permitting video surveillance of employees or any other person upon being satisfied that (

a) there is a specific problem which the surveillance cameras are intended to address, (

b) there is a compelling need to collect the information 7

through the use of video surveillance, (

c) there is no alternative less intrusive manner to collect the information, (

d) there is a satisfactory plan to assess the effectiveness of the surveillance cameras, (

e) the employer does not intend to continue using the surveillance cameras after the problem has been resolved, (

f) access to the videotapes will be restricted to persons whose use of the videotapes will be limited to the original purpose of the surveillance, (

g) videotapes will be kept for a maximum period of 7 days before their erasure or destruction, unless required for purposes of a specific investigation, and (

h) if an incident is viewed on videotape and as a result an employee is the subject of a warning or any other form of disciplinary proceedings, a copy of the videotape of the incident or incidents will be made available to the employee or his representative within 14 days of the warning, commencement of disciplinary proceedings or legal action.

PART 3 REVIEWS AND COMPLAINTS Right to ask for a review 17 A person who believes that (

a) the person's own personal information has been collected, used or disclosed in violation of

Part 1, or (

b) a private body has conducted video surveillance contrary to

Part 2 may ask the Commissioner to review that matter. How to ask for a review 18(1) To ask for a review under this Part, a written request must be delivered to the Commissioner. 8

(2) A request for a review of a complaint under

section 17 must be delivered within (a) 60 days after the person asking for the review is notified of the decision of the private body on which the complaint is based, or (

b) any longer period allowed by the Commissioner.

(3) The failure of a private body to respond in time to a request for access to a record is to be treated as a decision to refuse access, but the time limit in subsection (2)(

a) for delivering a request for review does not apply. Notifying others of review 19 On receiving a request for a review, the Commissioner must as soon as practicable (

a) give a copy of the request (

i) to the private body concerned, and (ii) to any other person who in the opinion of the Commissioner is affected by the request, and (

b) provide a

summary of the review procedures and an anticipated date for a decision on the review (

i) to the person who asked for the review, (ii) to the public body concerned, and (iii) to any other person who in the opinion of the Commissioner is affected by the request. Mediation may be authorized 20 The Commissioner may authorize a mediator to investigate and try to settle any matter that is the subject of a request for a review. Inquiry by Commissioner 21(1) If a matter is not settled under

section 20, the Commissioner must conduct an inquiry and may decide all questions of fact and law arising in the course of the inquiry. 9

(2) A n inquiry under subsection (1) may be conducted in private.

(3) The person who asked for the review, the private body concerned and any other person given a copy of the request for the review must be given an opportunity to make representations to the Commissioner during the inquiry, but no one is entitled to be present during, to have access to or to comment on representations made to the Commissioner by another person.

(4) The Commissioner may decide whether the representations are to be made orally or in writing.

(5) The person who asked for the review, the private body concerned and any other person given a copy of the request for the review may be represented at the inquiry by counsel or an agent.

(6) A n inquiry under this

section must be completed within 90 days after receiving the request for the review unless the Commissioner (

a) notifies the person who asked for the review, the private body concerned and any other person given a copy of the request for the review that the Commissioner is extending that period, and (

b) provides an anticipated date for the completion of the review. Burden of Proof 22(1) If the inquiry relates to a decision to refuse a person access to all or part of a record, it is up to the private body to prove that the applicant has no right of access to the record or part of the record.

(2) Notwithstanding subsection (1), if the record or part of the record that the applicant is refused access to contains personal information about a third party, it is up to the applicant to prove that disclosure of the information would not be an unreasonable invasion of the third party's personal privacy.

(3) If the inquiry relates to a decision to give an applicant access to all or part of a record containing personal information about a third party, it is up to the applicant to prove that disclosure of the information would not be an unreasonable invasion of the third party's personal privacy. 10

Commissioner’s orders 23(1) On completing an inquiry under

section 21, the Commissioner must dispose of the issues by making an order under this section.

(2) If the inquiry relates to a decision to give or to refuse to give access to all or part of a record, the Commissioner may, by order, do the following: (

a) require the private body to give the applicant access to all or part of the record, if the Commissioner determines that the private body is not authorized or required to refuse access; (

b) either confirm the decision of the private body or require the private body to reconsider it, if the Commissioner determines that the private body is authorized to refuse access; (

c) require the private body to refuse access to all or part of the record, if the Commissioner determines that the private body is required to refuse access.

(3) The Commissioner may specify any terms or conditions in an order made under this section.

(4) The Commissioner must give a copy of an order made under this

section (

a) to the person who asked for the review, (

b) to the private body concerned, and (

c) to any other person given a copy of the request for the review.

(5) A copy of an order made by the Commissioner under this

section may be filed with a clerk of the Court of Queen's Bench and, after filing, the order is enforceable as a judgment or order of that Court. No appeal 24 A n order made by the Commissioner under this A ct is final. Duty to comply with orders 25(1) Not later than 30 days after being given a copy of an order of the Commissioner, the private body concerned must comply 11

with the order unless an application for judicial review of the order is made before that period ends.

(2) If an application for judicial review is made before the end of the period referred to in subsection (1), the order of the Commissioner is stayed until the application is dealt with by the Court.

PART 4 OFFENCES AND PENALTIES Offences 26 A person who contravenes any provision in

Part 1 or

Part 2 of this A ct is guilty of an offence and liable (

a) for a first offence, to a fine not exceeding $50 000, and (

b) for a second or subsequent offence, to a fine not exceeding $100 000.

PART 5 MISCELLANEOUS, TRANSITIONAL AND COMING INTO FORCE Regulations 27(1) The Lieutenant Governor in Council may make regulations (

a) respecting procedures to be followed in making, transferring and responding to requests under this A ct; (

b) respecting procedures to be followed in giving access where an applicant has asked to examine a record or for a copy of a record that cannot reasonably be reproduced; (

c) respecting the making of requests under this A ct orally instead of in writing; (

d) respecting fees to be paid under this A ct and providing for circumstances when fees may be waived in whole or in part; (

e) respecting forms for the purposes of this A ct; 12

Application of this Act Coming into force (

f) respecting any matter that is to be included in a notice required by this Act; (

g) defining, enlarging or restricting the meaning of any term used in this Act but not defined in this Act; (

h) exempting any private body or class of private body from the operation of a regulation made under this subsection; (

i) respecting special procedures for giving individuals access to personal information about their mental or physical health; (

j) providing that other Acts or regulations, or any provisions of them, prevail despite this Act; (

k) respecting any other matter or thing that the Lieutenant Governor in Council considers necessary to carry out the intent of this Act. 28 This Act applies to any record under the custody or control of a private body regardless of whether it comes into existence before or after this Act comes into force. 29 This Act comes into force on Proclamation. 13 Title: 1998 (24th, 2nd) B ill 210, P rotection of Personal I nformation in t he Private Sector Act

Document details

Collection	Alberta — Bills
Citation	L24 S2 1013
Type	bill
Volume / chapter	L24 S2 1013
Language	en
Format	json
Source	PROVINCIAL
Identifier	4e105d312f8f56e93f5861189a0c0dd59b7a0924

Source file is stored in the law ingest library (json).