The Data Matching Agreements Act — Bill 87 (2018) [First Reading Bills]

Bill 87 (Bill087-2017)

Saskatchewan — Bills

DATA MATCHING AGREEMENTS 1 1 BILL No. 87

An Act respecting Data Matching Agreements and making consequential amendments to The Freedom of Information and Protection of Privacy Act TABLE OF CONTENTS 1

Short title 2

Definitions 3 Application of Act 4 Collection, use, disclosure of information 5 Before undertaking data matching project 6 Duties of parties 7 Retention and destruction 8 Reporting 9 Access to information by the data subject (Assented to ) HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Saskatchewan, enacts as follows:

Short title 1 This Act may be cited as The Data Matching Agreements Act.

Definitions 2 In this Act: “commissioner” means the Information and Privacy Commissioner appointed pursuant to The Freedom of Information and Protection of Privacy Act; “data matching” means the matching or linking of information in one database in the possession and control of an initiating organization with information in one or more other databases in the possession and control of a participating organization without the consent of the individuals who are the subjects of the information; “data matching agreement” means an agreement that governs the collection, use and disclosure of information by the parties to a data matching project and meets the prescribed requirements; 10 Duties of government access coordinator 11 Commissioner 12 Proceedings prohibited 13 Immunity from prosecution 14 Offence and penalty 15 Regulations 16 SS 1990-91, c F-22.01 amended 17 Coming into force

DATA MATCHING AGREEMENTS 2 2 “data matching project” means a plan, system, project, program or activity to perform data matching as outlined in a data matching agreement; “government access coordinator” means the government access coordinator appointed pursuant to The Freedom of Information and Protection of Privacy Act; “government institution” means a government institution within the meaning of The Freedom of Information and Protection of Privacy Act; “head” means a head as defined in The Freedom of Information and Protection of Privacy Act or The Local Authority Freedom of Information and Protection of Privacy Act; “information” means personal information and personal health information; “initiating organization” means any government institution or a prescribed local authority undertaking a data matching project; “local authority” means a local authority within the meaning of The Local Authority Freedom of Information and Protection of Privacy Act; “participating organization” means a government institution, local authority, trustee or prescribed organization that has entered into a data matching agreement with an initiating organization; “personal health information” means personal health information within the meaning of The Health Information Protection Act; “personal information” means personal information within the meaning of The Freedom of Information and Protection of Privacy Act or The Local Authority Freedom of Information and Protection of Privacy Act; “prescribed” means prescribed in the regulations; “trustee” means a trustee within the meaning of The Health Information Protection Act.

Application of Act 3 This Act applies only to data matching agreements entered into on or after the day on which

section 1 of this Act comes into force. Collection, use, disclosure of information 4 If an initiating organization or a participating organization performs data matching, each of those parties shall collect, use or disclose information used in or generated by data matching in accordance with this Act. Before undertaking data matching project 5(1) An initiating organization may undertake a data matching project with a participating organization if all parties comply with this Act.

(2) Subject to the regulations, before undertaking a data matching project, an initiating organization shall: (

a) prepare a data matching agreement in the form provided by the government access coordinator;

DATA MATCHING AGREEMENTS 3 3 (

b) if an initiating organization is a government institution: (

i) submit the agreement to the government access coordinator for comment; and (ii) request the government access coordinator to submit the agreement to the commissioner for comment; (

c) if the initiating organization is not a government institution, submit the agreement to the commissioner for comment; (

d) post the prescribed information on its website; and (

e) enter into the data matching agreement mentioned in clause (

a) with any participating organization.

(3) Subject to the regulations, a data matching agreement must include: (

a) the purpose and scope of the data matching project; (

b) an obligation respecting the security and safekeeping of the information used in and generated by the data matching project; (

c) a prohibition against the use and disclosure of the information for purposes not related to the data matching agreement, except if authorized by law; (

d) a description of how the information will be: (

i) transmitted; and (ii) matched or linked; (

e) a procedure for notification of the commissioner and the parties to the agreement if there is a breach of the agreement; and (

f) any other prescribed information.

(4) An initiating organization and a participating organization may amend an existing data matching agreement, and subsections (2) and (3) apply, with any necessary modification. Duties of parties 6 The parties to a data matching agreement shall take reasonable steps to ensure the security, accuracy and completeness of the information used in and generated by the data matching. Retention and destruction 7 On completion of the data matching project, the information database generated by the data matching project: (

a) is subject to the retention and destruction schedule, if any, set out in the agreement; or (

b) if the agreement does not contain a retention and destruction schedule, must be retained for 2 years and destroyed as soon as is reasonably practicable after the expiration of that period.

DATA MATCHING AGREEMENTS 4 4 Reporting 8(1) On completion of a data matching project, the initiating organization shall provide a report in the form provided by the government access coordinator: (

a) if the initiating organization is a government institution, to the government access coordinator and the commissioner; (

b) if the initiating organization is not a government institution, to the commissioner.

(2) Subject to the regulations, the report mentioned in subsection (1) must include the following: (

a) the completion date; (

b) the type of activities performed as part of the data matching agreement; (

c) the retention and destruction periods; and (

d) any other prescribed information. Access to information by the data subject 9 Subject to the regulations, any individual has the right to obtain from the initiating organization confirmation as to whether information concerning him or her is or was being used in the data matching project, and, if that is the case, access to that information and the details of the data matching agreement that are posted in accordance with clause 5(2)(d). Duties of government access coordinator 10 The government access coordinator shall: (

a) provide advice and direction to government institutions to promote compliance with this Act; (

b) prepare the form of the data matching agreement required pursuant to clause 5(2)(a); (

c) prepare the form of report required pursuant to subsection 8(1); (

d) prepare any other prescribed documents or forms. Commissioner 11 The commissioner may do all or any of the following: (

a) offer comment on the implications for privacy protection of a proposed data matching project; (

b) after hearing from the initiating organization, make recommendations with respect to the initiation, operation or completion of a data matching project by the initiating organization; (

c) after hearing from the initiating organization, recommend that the initiating organization: (

i) cease or modify data matching that contravenes this Act, The Freedom of Information and Protection of Privacy Act, The Local Authority Freedom of Information and Protection of Privacy Act or The Health Information Protection Act; and

DATA MATCHING AGREEMENTS 5 5 (ii) destroy collections of information collected in contravention of this Act, The Freedom of Information and Protection of Privacy Act, The Local Authority Freedom of Information and Protection of Privacy Act or The Health Information Protection Act; (

d) from time to time, carry out investigations with respect to information in the possession or under the control of an initiating organization or a participating organization to ensure compliance with this Act, The Freedom of Information and Protection of Privacy Act, The Local Authority Freedom of Information and Protection of Privacy Act or The Health Information Protection Act. Proceedings prohibited 12(1) No action or proceeding lies or shall be commenced against the Government of Saskatchewan, a government institution, a head or other officer or employee of a government institution, a local authority, a trustee or any party acting in accordance with a data matching agreement for: (

a) the giving in good faith of access to any record pursuant to this Act; or (

b) any consequences that flow from the giving of access mentioned in clause (a).

(2) No action or proceeding lies or shall be commenced against the Government of Saskatchewan, the commissioner, the government access coordinator, a government institution, a head or other officer or employee of a government institution, a local authority, a head or other officer or employee of a local authority or a trustee if that person is acting pursuant to the authority of this Act or the regulations, for anything in good faith done, caused, permitted or authorized to be done, attempted to be done or omitted to be done by that person or by any of those persons pursuant to or in the exercise or supposed exercise of any power conferred by this Act or the regulations or in the carrying out or supposed carrying out of any responsibility imposed by this Act or the regulations.

Immunity from prosecution 13 No person is liable to prosecution for an offence against any Act or regulation by reason of that person’s compliance with a recommendation of the commissioner pursuant to this Act. Offence and penalty 14(1) No person shall contravene any provision of this Act.

(2) Every person who contravenes a provision of this Act is guilty of an offence and is liable on

summary conviction: (

a) in the case of an individual, to a fine of not more than $50,000, to imprisonment for not more than one year or to both; and (

b) in the case of a corporation, to a fine of not more than $500,000.

(3) If a corporation commits an offence pursuant to this Act, any officer or director of the corporation who directed, authorized, assented to, acquiesced in or participated in the commission of the offence is guilty of the offence and liable on

summary conviction to the penalties provided for the offence whether or not the corporation has been prosecuted or convicted.

DATA MATCHING AGREEMENTS 6 6 Regulations 15 The Lieutenant Governor in Council may make regulations: (

a) defining, enlarging or restricting the meaning of any word or expression used in this Act but not defined in this Act; (

b) for the purposes of the definition of “data matching agreement” in

section 2, prescribing the requirements of a data matching agreement; (

c) for the purposes of the

definitions of “initiating organization” and “participating organization” in

section 2, prescribing organizations; (

d) prescribing information to be posted on a website for the purposes of clause 5(2)(d); (

e) prescribing additional information to be included in a report for the purpose of clause 8(2)(d); (

f) for the purposes of

section 9, respecting an individual’s access to his or her information; (

g) for the purposes of clause 10(d), prescribing documents or forms to be prepared by the government access c

Document details

Collection	Saskatchewan — Bills
Citation	Bill 87 (Bill087-2017)
Type	bill
Volume / chapter	bill fr 88800 105509.pdf
Language	en
Format	pdf
Source	PROVINCIAL
Identifier	af6b59863eef2c75faab56a60d735648448af6f2

Source file is stored in the law ingest library (pdf).