Bill 204 — Fourth Session, 23Rd Legislature, 45 Elizabeth Ii the Legislative Assembly of Alberta Bill 204 Protection of Personal Information In the Private Sector Act (Legislature 23, Session 4)

L23 S4 1175

Alberta — Bills

1996 BILL 204 Fourth Session, 23rd Legislature, 45 Elizabeth II THE LEGISLATIVE ASSEMBLY OF ALBERTA BILL 204 PROTECTION OF PERSONAL INFORMATION IN THE PRIVATE SECTOR ACT MR. SEKULIC First Reading Second Reading Committee of the Whole Third Reading Royal Assent

Bill 204 Mr. Sekulic BILL 204 1996 PROTECTION OF PERSONAL INFORMATION IN THE PRIVATE SECTOR ACT (Assented to , 1996) HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Alberta, enacts as follows:

Definitions 1 In this Act, (a) "Commissioner" means the Information and Privacy Commissioner; (b) "personal information" means personal information as defined in the Freedom of Information and Protection of Privacy Act; (c) "private body" means (

i) an organization, society, corporation or other body, other than a public body, that employs 100 or more people, (ii) a bank, (iii) a treasury branch, (iv) a trust corporation, (

v) a loan corporation, 1

(vi) a credit union, or (vii) an insurance company; (d) "public body" means a public body as defined in the Freedom of Information and Protection of Privacy Act; (e) "record" means a record of personal information in any form and includes personal information that is written, photographed, recorded or stored in any manner but does not include software or any mechanism that produces records; (f) "third party" means a person, group of persons or an organization other than the individual who is the subject of the record or the private body. Purposes of this Act 2 The purposes of this Act are (

a) to control the manner in which a private body may collect personal information from individuals, to control the use that a private body may make of that information and to control the disclosure by a private body of that information, (

b) to allow individuals, subject to limited and specific exceptions as set out in this Act, a right of access to personal information about themselves that is held by a private body, (

c) to allow individuals a right to request corrections to personal information about themselves that is held by a private body, and (

d) to provide for independent reviews of decisions made by private bodies under this Act and the resolution of complaints under this Act. 2

PART 1 COLLECTION AND USE OF PERSONAL INFORMATION BY PRIVATE BODIES Purpose of record 3(1) A private body may, for a serious and legitimate reason, create a record but must, when creating the record, enter the purpose for which the record is created on tire record.

(2) The purpose of the record is part of the record. Necessary personal information 4 A private body collecting personal information may only collect personal information necessary for the purpose of the record. Collection of personal information 5 A private body must collect personal information directly from the individual the information is about unless (

a) another method of collection is authorized in writing by that individual, (

b) the collection of the information is authorized by

an Act or regulation under that Act, (

c) the personal information is collected for the purposes of collecting a debt owed to the private body, or (

d) the personal information is collected for the purpose of providing legal services. Obligation to inform 6 A private body that collects personal information from the individual who is the subject of the record must, if requested by the individual, inform the individual of (

a) the purpose for which the personal information is collected, (

b) the title, business address and business telephone number of an officer or employee of the private body who can answer the individual's questions about the collection and the nature and substance of the information, (

c) how the individual may have access to the record, and 3

(

d) the procedure for correcting errors about the individual in the record. Accuracy of personal information 7 If an individual's personal information will be used by a private body to make a decision that directly affects the individual, the private body must (

a) make every reasonable effort to ensure that the personal information is accurate and complete, and (

b) retain the personal information for at least 3 months after using it so that the individual has a reasonable opportunity to obtain access to it. Right to request correction of personal information 8(1) An individual who believes there is an error or omission in the individual's personal information may request the private body that has the information in its custody or under its control to correct the information.

(2) If no correction is made in response to a request under subsection (1), the private body must annotate or link the information with the correction that was requested but not made.

(3) On correcting, annotating or linking personal information under this section, the private body must notify any third party to whom that information has been disclosed during the one year before the correction was requested that a correction, annotation or linkage has been made.

(4) On being notified under subsection (3) of a correction, annotation or linkage of personal information, a third party must make the correction, annotation or linkage on any record of that information in its custody or under its control.

(5) Within 30 days after the request under subsection (1) is received, the private body must give written notice to the individual that (

a) the correction has been made, or (

b) an annotation or linkage has been made pursuant to subsection (2). 4

Protection of personal information 9 A private body must protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal. Use of personal information 10 A private body may use personal information only (

a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose, (

b) if the individual the information is about has consented to the use, or (

c) for a purpose for which that information may be disclosed under sections 11, 12 or 13. Disclosure of personal information 11(1) A private body may disclose personal information only (

a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose, (

b) if the individual the information is about has consented to the disclosure, (

c) for the purpose of complying with an enactment of Alberta or Canada or with a treaty, arrangement or agreement made under an enactment of Alberta or Canada, (

d) for any purpose in accordance with an enactment of Alberta or Canada that authorizes or requires the disclosure, (

e) for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body having jurisdiction to compel the production of information or with a rule of court that relates to the production of information, (

f) for the purpose of enforcing a legal right that the private body has against any person, (

g) for the purpose of (

i) collecting a fine or debt owing by an individual to the 5

private body or to its assignee, or (ii) making a payment owing by a private body to an individual, (

h) to a representative of a bargaining agent who has been authorized in writing by the individual the information is about to make an inquiry, (

i) so that the next of kin or a friend of an injured, ill or deceased individual may be contacted, (

j) in accordance with

section 13, (

k) for use in a proceeding before a court or quasi-judicial body to which the private body is a party, (

l) when the information is available to the public, (

m) to a relative of a deceased individual if the disclosure is not an unreasonable invasion of the deceased's personal privacy, (

n) to its lawyer, (

o) to a public body that collects information in the exercise of its functions or the implementation of a program under its management, (

p) to a person to whom the information must be communicated by reason of the urgency of a situation that may threaten the life, health or safety of the person concerned, or (

q) where the private body has reasonable grounds to believe that the person concerned has committed or is about to commit, a crime or offence against the private body, its agents or employees.

(2) Only information that is reasonably required may be disclosed under subsection (1)(h). Consistent purpose 12 For the purposes of sections 10(a), 11(a), 16(1)(

a) and 16(2)(

a) a use or disclosure of personal or health care information is 6

consistent with the purpose for which the information was collected or compiled if the use or disclosure has a reasonable and direct connection to that purpose. Disclosure for research or statistical purposes 13(1) The Commissioner may, on written request, grant a person authorization to receive personal information from a private body for study, research or statistical purposes, without the consent of the person concerned, if, in the Commissioner's opinion, (

a) the intended use of the information is not frivolous and the study, research or statistical purpose cannot be achieved unless the information is communicated in a form allowing the person to be identified, and (

b) the personal information will be used in a manner that will ensure its confidentiality.

(2) In granting a request under subsection (1) the Commissioner may add any conditions to the use of the personal information that the Commissioner believes are necessary to preserve the confidentiality of the information.

(3) A request granted under this

section shall be for a specified period of time. Employment information 14 No private body may take any employment action against an individual because of an individual's refusal to disclose personal information except where (

a) the information is directly related to the requirements of the individual's employment, or (

b) the information is required to be provided under the terms of a collective agreement under which the individual is covered.

PART 2 HEALTH CARE INFORMATION

Definitions 15 In this Part, "health care information" means personal 7

information about an individual's health and health care history including (

a) information about a physical or mental disability, and (

b) information collected or obtained by a private body under the Alberta Health Care Insurance Act. Use and disclosure of health care information 16(1) Notwithstanding

section 10, a private body may use health care information only (

a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose, or (

b) if the individual the information is about has consented to the use.

(2) Notwithstanding sections 11, 12 and 13, a private body may disclose health care information only (

a) for the purpose for which the information was collected or compiled or for a use consistent with that purpose, (

b) if the individual the information is about has consented to the disclosure, or (

c) for any purpose in accordance with an enactment of Alberta or Canada that authorizes or requires the disclosure.

PART 3 REVIEWS AND COMPLAINTS Right to ask for a review 17 A person who believes that the person's own personal information has been collected, used or disclosed in violation of

Part 1 or 2 may ask the Commissioner to review that matter. How to ask for a review 18(1) To ask for a review under this Part, a written request must be delivered to the Commissioner.

(2) A request for a review of a complaint under

section 17 must be 8

delivered within (a) 60 days after the person asking for the review is notified of the decision of the private body on which the complaint is based, or (

b) any longer period allowed by the Commissioner.

(3) The failure of a private body to respond in time to a request for access to a record is to be treated as a decision to refuse access, but the time limit in subsection (2)(

a) for delivering a request for review does not apply. Notifying others of review 19 On receiving a request for a review, the Commissioner must as soon as practicable (

a) give a copy of the request (

i) to the head of the private body concerned, and (ii) to any other person who in the opinion of the Commissioner is affected by the request, and (

b) provide a

summary of the review procedures and an anticipated date for a decision on the review (

i) to the person who asked for the review, (ii) to the head of the public body concerned, and (iii) to any other person who in the opinion of the Commissioner is affected by the request. Mediation may be authorized 20 The Commissioner may authorize a mediator to investigate and try to settle any matter that is the subject of a request for a review. Inquiry by Commissioner 21 If a matter is not settled under

section 20, the Commissioner must conduct an inquiry and may decide all questions of fact and law arising in the course of the inquiry. 9

(2) An inquiry under subsection (1) may be conducted in private.

(3) The person who asked for the review, the private body concerned and any other person given a copy of the request for the review must be given an opportunity to make representations to the Commissioner during the inquiry, but no one is entitled to be present during, to have access to or to comment on representations made to the Commissioner by another person.

(4) The Commissioner may decide whether the representations are to be made orally or in writing.

(5) The person who asked for the review, the head of the private body concerned and any other person given a copy of the request for the review may be represented at the inquiry by counsel or an agent.

(6) An inquiry under this

section must be completed within 90 days after receiving the request for the review unless the Commissioner (

a) notifies the person who asked for the review, the private body concerned and any other person given a copy of the request for the review that the Commissioner is extending that period, and (

b) provides an anticipated date for the completion of the review. Burden of proof 22(1) If the inquiry relates to a decision to refuse a person access to all or part of a record, it is up to the private body to prove that the applicant has no right of access to the record or part of the record.

(2) Notwithstanding subsection (1), if the record or part of the record that the applicant is refused access to contains personal information about a third party, it is up to the applicant to prove that disclosure of the information would not be an unreasonable invasion of the third party's personal privacy.

(3) If the inquiry relates to a decision to give an applicant access to all or part of a record containing personal information about a third party, it is up to the applicant to prove that disclosure of the information would not be an unreasonable invasion of the third party's personal privacy. 10

Commissioner's orders 23(1) On completing an inquiry under

section 21, the Commissioner must dispose of the issues by making an order under this section.

(2) If the inquiry relates to a decision to give or to refuse to give access to all or part of a record, the Commissioner may, by order, do the following: (

a) require the private body to give the applicant access to all or part of the record, if the Commissioner determines that the private body is not authorized or required to refuse access; (

b) either confirm the decision of the private body or require the private body to reconsider it, if the Commissioner determines that the private body is authorized to refuse access; (

c) require the private body to refuse access to all or part of the record, if the Commissioner determines that the private body is required to refuse access.

(3) The Commissioner may specify any terms or conditions in an order made under this section.

(4) The Commissioner must give a copy of an order made under this

section (

a) to the person who asked for the review, (

b) to the private body concerned, and (

c) to any other person given a copy of the request for the review.

(5) A copy of an order made by the Commissioner under this

section may be filed with a clerk of the Court of Queen s Bench and, after filing, the order is enforceable as a judgment or order of that Court. No appeal 24 An order made by the Commissioner under this Act is final. 11

Duty to comply with orders 25(1) Not later than 30 days after being given a copy of an order of the Commissioner, the private body concerned must comply with the order unless an application for judicial review of the order is made before that period ends.

(2) If an application for judicial review is made before the end of the period referred to in subsection (1), the order of the Commissioner is stayed until the application is dealt with by the Court.

PART 4 OFFENCES AND PENALTIES Offences 26 A person who contravenes any provision in

Part 1 or

Part 2 of this Act is guilty of an offence and liable (

a) for a first offence, to a fine not exceeding $50 000, and (

b) for a second or subsequent offence, to a fine not exceeding $100 000.

PART 5 MISCELLANEOUS AND TRANSITIONAL Power to make regulations 27(1) The Lieutenant Governor in Council may make regulations (

a) respecting procedures to be followed in making, transferring and responding to requests under this Act; (

b) respecting procedures to be followed in giving access where an applicant has asked to examine a record or for a copy of a record that cannot reasonably be reproduced; (

c) respecting the making of requests under this Act orally instead of in writing; (

d) respecting fees to be paid under this Act and providing for circumstances when fees may be waived in whole or in 12

part; (

e) respecting forms for the purposes of this Act; (

f) respecting any matter that is to be included in a notice required by this Act; (

g) defining, enlarging or restricting the meaning of any term used in this Act but not defined in this Act; (

h) exempting any private body or class of private body from the operation of a regulation made under this subsection; (

i) respecting special procedures for giving individuals access to personal information about their mental or physical health; (

j) providing that other Acts or regulations, or any provisions of them, prevail despite this Act; (

k) respecting any other matter or thing that the Lieutenant Governor in Council considers necessary to carry out the intent of this Act. Application of this Act 28 This Act applies to any record in the custody or under the control of a private body regardless of whether it comes into existence before or after this Act comes into force. Coming into force 29 This Act comes into force on Proclamation. 13 Title: 1996 (23rd, 4th) Bill 204, Protection of Personal Information in the Private Sector Act

Document details

Collection	Alberta — Bills
Citation	L23 S4 1175
Type	bill
Volume / chapter	L23 S4 1175
Language	en
Format	json
Source	PROVINCIAL
Identifier	67f7ac2536beccb343fd505a25a740b572eb1304

Source file is stored in the law ingest library (json).