Bill 54 — Second Session, 27Th Legislature, 58 Elizabeth Ii the Legislative Assembly of Alberta Bill 54 Personal Information Protection Amendment Act, 2009 (Legislature 27, Session 2)

L27 S2 1450

Alberta — Bills

2009 Bill 54 Second Session, 27th Legislature, 58 Elizabeth II THE LEGISLATIVE ASSEMBLY OF ALBERTA BILL 54 PERSONAL INFORMATION PROTECTION AMENDMENT ACT, 2009 MR. DENIS First Reading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Second Reading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Committee of the Whole . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Third Reading . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Royal Assent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

1 Bill 54 Mr. Denis BILL 54 2009 PERSONAL INFORMATION PROTECTION AMENDMENT ACT, 2009 ( A s s e n t e d t o , 2 0 0 9 ) HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Alberta, enacts as follows: Amends SA 2003 cP-6.5 1 The Personal Information Protection Act is amended by this Act. 2

Section 1 is amended (

a) by renumbering it as

section 1(1); (

b) in subsection (1) (

i) in clause (

a) by adding “address” after “business e-mail”; (ii) in clause (

e) by renumbering subclause (

i) as subclause (i.1) and adding the following before subclause (i.1): (

i) as a partner or a director, officer or other office-holder of the organization, (iii) by adding the following after clause (g): (g.1) “legislative instrument of a professional regulatory organization” means a bylaw, resolution or rule that is

1 Explanatory Notes Explanatory Notes 1 Amends

chapter P-6.5 of the Statutes of Alberta, 2003. 2

Definitions.

2 (

i) enacted or otherwise established by a professional regulatory organization under

an Act or a regulation of Alberta, and (ii) of a legislative nature; (g.2) “local government bo dy” means a local government body as defined in the Freedom of Information and Protection of Privacy Act; (iv) by repealing clause (

j) a nd substituting the following: (j) “personal employee inform ation” means, in respect of an individual who is a potential, current or former employee of an organization, personal information reasonably required by the organization for the purposes of (

i) establishing, managing or terminating an employment or volunteer-work relationship, or (ii) managing a post-employment or post-volunteer-work relationship between the organization and the individual, but does not include personal information about the individual that is unrelated to that relationship; (

v) by adding the following after clause (k): (k.1) “professional Act” m eans an enactment under which a professional or occupational group or discipline is organized, and that provides for (

i) membership in the professional or occupational group or discipline, and (ii) the regulation of the members of the professional or occupational group or discipline with respect to more than one of the following: (

A) registration; (

B) competence;

2 Explanatory Notes

3 (

C) conduct; (

D) practice; (

E) disciplinary matters; (k.2) “professional regulat ory organization” means an organization incorporated under a professional Act; (vi) by adding the following after clause (m): (m.1) “regulation of Alberta” means a regulation as defined in the Regulations Act that is filed under that Act; (m.2) “regulation of Canada” means a regulation as defined in the Statutory Instruments Act (Canada) that is registered under that Act; (m.3) “service provider” means any organization, including, without limitation, a parent corporation, subsidiary, affiliate, contractor or subcontractor, that, directly or indirectly, provides a service for or on behalf of another organization; (

c) by adding the following after subsection (1):

(2) For the purposes of

section 14(c.3), 17(c.3) and 20(c.3), “audit” means a financial or other formal or systematic examination or review conducted in accordance with recognized standards for an accepted business purpose, but does not include an examination or review conducted with respect to a business transaction referred to in

section 22. 3

Section 4(3) is amended (

a) by repealing clause (

d) and substituting the following: (

d) the collection, use or disclosure of an individual’s business contact information if the collection, use or disclosure, as the case may be, is for the purposes of enabling the individual to be contacted in relation to the individual’s business responsibilities and for no other purpose;

3 Explanatory Notes 3

Section 4 presently reads in part:

(3) This Act does not apply to the following: (

d) the collection, use or disclosure of business contact information if the collection, use or disclosure, as the case may be, is for the purposes of contacting an individual in that individual’s capacity as an employee or an official of an organization and for no other purpose; (

g) the collection, us e or disclosure of personal information by an officer of the Legislature if the collection, use or

4 (

b) by repealing clause (

g) and substituting the following: (

g) the collection, use or disclosure of personal information by the following officers of the Legislature if the collection, use or disclosure, as the case may be, relates to the exercise of that officer’s functions under an enactment: (

i) the Auditor General; (ii) the Ombudsman; (iii) the Chief Electoral Officer; (iv) the Ethics Commissioner; (

v) the Information an d Privacy Commissioner; (

c) by repealing clause (

j) a nd substituting the following: (

j) personal information co ntained in any record that (

i) was transferred to an archival institution before the coming into force of this Act where access to the record (

A) was unrestricted before the coming into force of this Act, or (

B) is governed by an ag reement entered into by the archival institution and the donor of the record before the coming into force of this Act, or (ii) is transferred to an archival institution after the coming into force of this Act where access to the record is governed by an agreement entered into by the archival institution and the donor of the record before the coming into force of this Act;

4 Explanatory Notes disclosure, as the case may be, relates to the exercise of that officer’s functions under an enactment; (

j) personal information containe d in any record transferred to an archival institution where access to the record was unrestricted or governed by an agreement between the archival institution and the donor of the record before the coming into force of this Act;

5 4

Section 6 is repealed and the following is substituted: Policies and practices 6(1) An organization must develop and follow policies and practices that are reasonable for the organization to meet its obligations under this Act.

(2) If an organization uses a service provider outside Canada to collect, use, disclose or store personal information for or on behalf of the organization, the policies and practices referred to in subsection (1) must include information regarding (

a) the countries outside Canada in which the collection, use, disclosure or storage is occurring or may occur, and (

b) the purposes for which the service provider outside Canada has been authorized to collect, use or disclose personal information for or on behalf of the organization.

(3) An organization must make written information about the policies and practices referred to in subsections (1) and (2) available on request. 5

Section 8 is amended (

a) by adding the following after subsection (2):

(2.1) If an individual consents to the disclosure of personal information about the individual by one organization to another organization for a particular purpose, the individual is deemed to consent to the collection, use or disclosure of the personal information for the particular purpose by that other organization.

(2.2) An individual is deemed to consent to the collection, use or disclosure of personal information about the individual by an organization for the purpose of the individual’s enrolment in or coverage under an insurance policy, pension plan or benefit plan or a policy, plan or contract that provides for a similar type of coverage or benefit if the individual (

a) has an interest in or derives a benefit from that policy, plan or contract, and

5 Explanatory Notes 4

Section 6 presently reads: 6 An organization must (

a) develop and follow policies and practices that are reasonable for the organization to meet its obligations under this Act, and (

b) make information about the policies and practices referred to in clause (

a) available on request. 5

Section 8 presently reads: 8(1) An individual may give his or her consent in writing or orally to the collection, use or disclosure of personal information about the individual.

(2) An individual is deemed to consent to the collection, use or disclosure of personal information about the individual by an organization for a particular purpose if (

a) the individual, without actually giving a consent referred to in subsection (1), voluntarily provides the information to the organization for that purpose, and (

b) it is reasonable that a person would voluntarily provide that information.

(3) Notwithstanding

section 7(1), an organization may collect, use or disclose personal information about an individual for particular purposes if (

a) the organization

6 (

b) is not the applicant for the policy, plan or contract. (

b) in subsection (4) by adding “, (2.1), (2.2)” after “Subsections (2)”. 6

Section 13 is amended (

a) in subsection (1)(

b) by adding “or position name or title” after “name”; (

b) by repealing subsection (2).

6 Explanatory Notes (

i) provides the individual with a notice, in a form that the individual can reasonably be expected to understand, that the organization intends to collect, use or disclose personal information about the individual for those purposes, and (ii) with respect to that notice, gives the individual a reasonable opportunity to decline or object to having his or her personal information collected, used or disclosed for those purposes, (

b) the individual does not, within a reasonable time, give to the organization a response to that notice declining or objecting to the proposed collection, use or disclosure, and (

c) having regard to the level of the sensitivity, if any, of the information in the circumstances, it is reasonable to collect, use or disclose the information as permitted under clauses (

a) and (b). (4) Subsections (2) and (3) are not to be construed so as to authorize an organization to collect, use or disclose personal information for any purpose other than the particular purposes for which the information was collected.

(5) Consent in writing may be given or otherwise transmitted by electronic means to an organization if the organization receiving that transmittal produces or is able at any time to produce a printed copy or image or a reproduction of the consent in paper form. 6

Section 13(1) and (2) presently read: 13(1) Before or at the time of collecting personal information about an individual from the individual, an organization must notify that individual in writing or orally (

a) as to the purposes for whic h the information is collected, and (

b) of the name of a person who is able to answer on behalf of the organization the individual’s questions about the collection.

(2) Before or at the time personal information about an individual is collected from another organization with the consent of the individual, the organization collecting the information must notify

7 7 The following is added after

section 13: Notification respecting service provider outside Canada 13.1(1) Subject to the regulations, an organization that uses a service provider outside Canada to collect personal information about an individual for or on behalf of the organization with the consent of the individual must notify the individual in accordance with subsection (3).

(2) Subject to the regulations, an organization that, directly or indirectly, transfers to a service provider outside Canada personal information about an individual that was collected with the individual’s consent must notify the individual in accordance with subsection (3).

(3) An organization referred to in subsection (1) or (2) must, before or at the time of collecting or transferring the information, notify the individual in writing or orally of (

a) the way in which the individual may obtain access to written information about the organization’s policies and practices with respect to service providers outside Canada, and (

b) the name or position name or title of a person who is able to answer on behalf of the organization the individual’s questions about the collection, use, disclosure or storage of personal information by service providers outside Canada for or on behalf of the organization.

(4) The notice required under this

section is in addition to any notice required under

section 13. 8

Section 14 is amended (

a) by repealing clause (

b) and substituting the following: (

b) the collection of the information is authorized or required by

7 Explanatory Notes the organization that is disclosing the information that the individual has consented to the collection of the information. 7 Notification respecting service provider outside Canada. 8

Section 14 presently reads in part: 14 An organization may collect personal information about an individual without the consent of that individual but only if one or more of the following are applicable:

8 (

i) a statute of Alberta or of Canada, (ii) a regulation of Alberta or a regulation of Canada, (iii) a bylaw of a local government body, or (iv) a legislative instrument of a professional regulatory organization; (b.1) the collection of the information is pursuant to a form that is approved or otherwise provided for under a statute of Alberta or a regulation of Alberta; (

b) by adding the following after clause (c): (c.1) the collection of the info rmation is necessary to comply with a collective agreement that is binding on the organization under

section 128 of the Labour Relations Code; (c.2) the collection of the info rmation is necessary to comply with an audit or inspection of or by the organization where the audit or inspection is authorized or required by (

i) a statute of Alberta or of Canada, or (ii) a regulation of Alberta or a regulation of Canada; (c.3) the collection of the information is by an organization for the purposes of conducting an audit of another organization, other than an audit referred to in clause (c.2), and it is not practicable to collect non-identifying information for the purposes of the audit; (

c) in clause (

e) by adding “as prescribed or otherwise determined by the regulations” after “publicly available”; (

d) by adding the following after clause (k): (

l) the collection of the information is in accordance with

section 15 or 22.

8 Explanatory Notes (

b) the collection of the informa tion is pursuant to a statute or regulation of Alberta or Canada that authorizes or requires the collection; (

e) the information is publicly available;

9 9

Section 15 is repealed and the following is substituted: Collection of personal employee information 15(1) An organization may collect personal employee information about an individual without the consent of the individual if (

a) the information is collected solely for the purposes of (

i) establishing, managing or terminating an employment or volunteer-work relationship, or (ii) managing a post-employment or post-volunteer-work relationship, between the organization and the individual, (

b) it is reasonable to collect the information for the particular purpose for which it is being collected, and (

c) in the case of an individual who is a current employee of the organization, the organization has, before collecting the information, provided the individual with reasonable notification that personal employee information about the individual is going to be collected and of the purposes for which the information is going to be collected.

(2) Nothing in this

section is to be construed so as to restrict or otherwise affect an organization’s ability to collect personal information under

section 14. 10

Section 17 is amended (

a) by repealing clause (

b) and substituting the following: (

b) the use of the information is authorized or required by (

i) a statute of Alberta or of Canada,

9 Explanatory Notes 9

Section 15 presently reads: 15(1) Notwithstanding anything in this Act other than subsection (2), an organization may collect personal employee information about an individual without the consent of the individual if (

a) the individual is an empl oyee of the organization, or (

b) the collection of the information is for the purpose of recruiting a potential employee.

(2) An organization shall not collect personal information about an individual under subsection (1) without the consent of the individual unless (

a) the collection is reasonable for the purposes for which the information is being collected, (

b) the information consists only of information that is related to the employment or volunteer work relationship of the individual, and (

c) in the case of an indivi dual who is an employee of the organization, the organization has, before collecting the information, provided the individual with reasonable notification that the information is going to be collected and of the purposes for which the information is going to be collected.

(3) An organization may disclose personal employee information about an individual without the consent of the individual where that information is being disclosed to an organization that is collecting that information under subsection (1).

(4) Nothing in this

section is to be construed so as to restrict or otherwise affect an organization’s ability to collect personal information under

section 14. 10

Section 17 presently reads in part: 17 An organization may use personal information about an individual without the consent of the individual but only if one or more of the following are applicable:

10 (ii) a regulation of Alberta or a regulation of Canada, (iii) a bylaw of a local government body, or (iv) a legislative instrument of a professional regulatory organization; (b.1) the use of the informati on is for the purpose for which the information was collected pursuant to a form that is approved or otherwise provided for under a statute of Alberta or a regulation of Alberta; (

b) by adding the following after clause (c): (c.1) the use of the information is necessary to comply with a collective agreement that is binding on the organization under

section 128 of the Labour Relations Code; (c.2) the use of the information is necessary to comply with an audit or inspection of or by the organization where the audit or inspection is authorized or required by (

i) a statute of Alberta or of Canada, or (ii) a regulation of Alberta or a regulation of Canada; (c.3) the use of the information is for the purposes of an audit of or by the organization, other than an audit referred to in clause (c.2), and it is not practicable to use non-identifying information for the purposes of the audit; (

c) in clause (

e) by adding “as prescribed or otherwise determined by the regulations” after “publicly available”; (

d) by adding the following after clause (l): (

m) the use of the information is in accordance with

section 18 or 22. 11

Section 18 is repealed and the following is substituted:

10 Explanatory Notes (

b) the use of the information is pursuant to a statute or regulation of Alberta or Canada that authorizes or requires the use; (

e) the information is publicly available; 11

Section 18 presently reads: 18(1) Notwithstanding anything in this Act other than subsection (2), an organization may use personal employee information about an individual without the consent of the individual if

11 Use of personal employee information 18(1) An organization may use personal employee information about an individual without the consent of the individual if (

a) the information is used solely for the purposes of (

i) establishing, managing or terminating an employment or volunteer-work relationship, or (ii) managing a post-employment or post-volunteer-work relationship, between the organization and the individual, (

b) it is reasonable to use the information for the particular purpose for which it is being used, and (

c) in the case of an individual who is a current employee of the organization, the organization has, before using the information, provided the individual with reasonable notification that personal employee information about the individual is going to be used and of the purposes for which the information is going to be used.

(2) Nothing in this

section is to be construed so as to restrict or otherwise affect an organization’s ability to use personal information under

section 17. 12

Section 20 is amended (

a) by repealing clause (

b) and substituting the following: (

b) the disclosure of the in formation is authorized or required by (

i) a statute of Alberta or of Canada, (ii) a regulation of Alberta or a regulation of Canada, (iii) a bylaw of a local government body, or (iv) a legislative instrument of a professional regulatory organization;

11 Explanatory Notes (

a) the individual is an empl oyee of the organization, or (

b) the use of the information is for the purpose of recruiting a potential employee.

(2) An organization shall not use personal information about an individual under subsection (1) without the consent of the individual unless (

a) the use is reasonable for the purposes for which the information is being used, (

b) the information consists only of information that is related to the employment or volunteer work relationship of the individual, and (

c) in the case of an indivi dual who is an employee of the organization, the organization has, before using the information, provided the individual with reasonable notification that the information is going to be used and of the purposes for which the information is going to be used.

(3) Nothing in this

section is to be construed so as to restrict or otherwise affect an organization’s ability to use personal information under

section 17. 12

Section 20 presently reads in part: 20 An organization may disclose personal information about an individual without the consent of the individual but only if one or more of the following are applicable: (

b) the disclosure of the information is pursuant to a statute or regulation of Alberta or Canada that authorizes or requires the disclosure; (

j) the information is publicly available; (

n) the disclosure of the info rmation is for the purposes of protecting against, or for the prevention, detection or suppression of, fraud, market manipulation or unfair trading practices and the organization that is disclosing the information or to which the information is being disclosed is

12 (b.1) the disclosure of the information is for a purpose for which the information was collected pursuant to a form that is approved or otherwise provided for under a statute of Alberta or a regulation of Alberta; (

b) by adding the following after clause (c): (c.1) the disclosure of the info rmation is necessary to comply with a collective agreement that is binding on the organization under

section 128 of the Labour Relations Code; (c.2) the disclosure of the info rmation is necessary to comply with an audit or inspection of or by the organization where the audit or inspection is authorized or required by (

i) a statute of Alberta or of Canada, or (ii) a regulation of Alberta or a regulation of Canada; (c.3) the disclosure of the information is (

i) to an organization conducting an audit, other than an audit referred to in clause (c.2), by the organization being audited, or (ii) by an organization conducting an audit, other than an audit referred to in clause (c.2), to the organization being audited for a purpose relating to the audit and it is not practicable to disclose non-identifying information for the purposes of the audit. (

c) in clause (

j) by adding “as prescribed or otherwise determined by the regulations” after “publicly available”; (

d) by repealing clause (

n) a nd substituting the following: (

n) the disclosure of the information is for the purposes of protecting against, or for the prevention, detection or suppression of, fraud, and the information is disclosed to or by

12 Explanatory Notes permitted or otherwise empow ered or recognized under an enactment of Alberta or Canada or of another province of Canada to carry out any of those purposes;

13 (

i) an organization that is permitted or otherwise empowered or recognized to carry out any of those purposes under (

A) a statute of Alberta or of Canada or of another province of Canada, (

B) a regulation of Alberta, a regulation of Canada or similar subordinate legislation of another province of Canada that, if enacted in Alberta, would constitute a regulation of Alberta, or (

C) an order made by a Minister under a statute or regulation referred to in paragraph (

A) or (B), (ii) Investigative Services , a division of the Insurance Bureau of Canada, or (iii) the Canadian Bankers Association, Bank Crime Prevention and Investigation Office; (

e) by adding the following after clause (q): (

r) the disclosure is in accordance with

section 21 or 22. 13

Section 21 is repealed and the following is substituted: Disclosure of personal employee information 21(1) An organization may disclose personal employee information about an individual without the consent of the individual if (

a) the information is disclosed solely for the purposes of (

i) establishing, managing or terminating an employment or volunteer-work relationship, or (ii) managing a post-employment or post-volunteer-work relationship, between the organization and the individual, (

b) it is reasonable to disclose the information for the particular purpose for which it is being disclosed, and

13 Explanatory Notes 13

Section 21 presently reads: 21(1) Notwithstanding anything in this Act other than subsection (2), an organization may disclose personal employee information about an individual without the consent of the individual if (

a) the individual is or was an employee of the organization, or (

b) the disclosure of the information is for the purpose of recruiting a potential employee.

(2) An organization shall not disclose personal information about an individual under subsection (1) without the consent of the individual unless (

a) the disclosure is reasonable for the purposes for which the information is being disclosed,

14 (

c) in the case of an individual who is a current employee of the organization, the organization has, before disclosing the information, provided the individual with reasonable notification that personal employee information about the individual is going to be disclosed and of the purposes for which the information is going to be disclosed.

(2) An organization may disclose personal information about an individual who is a current or former employee of the organization to a potential or current employer of the individual without the consent of the individual if (

a) the personal information that is being disclosed was collected by the organization as personal employee information, and (

b) the disclosure is reasonab le for the purpose of assisting that employer to determine the individual’s eligibility or suitability for a position with that employer.

(3) Nothing in this

section is to be construed so as to restrict or otherwise affect an organization’s ability to disclose personal information under

section 20. 14

Section 22(2) is amended by striking out “Notwithstanding anything in this Act other than this section, an” and substituting “An”. 15

Section 24 is amended (

a) by repealing subsection (1) and substituting the following: Access to records and provision of information 24(1) An individual may, in accordance with

section 26, request an organization (

a) to provide the individual with access to personal information about the individual, or

14 Explanatory Notes (

b) the information consists only of information that is related to the employment or volunteer work relationship of the individual, and (

c) in the case of an indivi dual who is an employee of the organization, the organization has, before disclosing the information, provided the individual with reasonable notification that the information is going to be disclosed and of the purposes for which the information is going to be disclosed.

(3) Nothing in this

section is to be construed so as to restrict or otherwise affect an organization’s ability to disclose personal information under

section 20. 14

Section 22(2) presently reads:

(2) Notwithstanding anything in this Act other than this section, an organization may, for the purposes of a business transaction between itself and one or more other organizations, collect, use and disclose personal information in accordance with this section. 15

Section 24 presently reads in part: 24(1) Subject to subsections (2) to (4), on the request of an individual for access to personal information about the individual and taking into consideration what is reasonable, an organization must provide the individual with access to the following: (

a) the individual’s personal information where that information is contained in a record that is in the custody or under the control of the organization;

15 (

b) to provide the individual with information about the use or disclosure of personal information about the individual.

(1.1) Subject to subsections (2) to (4), on the request of an applicant made under subsection (1)(

a) and taking into consideration what is reasonable, an organization must provide the applicant with access to the applicant’s personal information where that information is contained in a record that is in the custody or under the control of the organization.

(1.2) On the request of an applicant made under subsection (1)(b), and taking into consideration what is reasonable, an organization must, if the organization has in its custody or under its control a record containing personal information about the applicant described in the request, provide the applicant with (

a) information about the purposes for which the personal information has been and is being used by the organization, and (

b) the names of the persons to whom and circumstances in which the personal information has been and is being disclosed. (

b) by repealing subsection (2)(

e) and substituting the following: (

e) the information was collected by a mediator or arbitrator or was created in the conduct of a mediation or arbitration for which the mediator or arbitrator was appointed to act (

i) under an agreement, (ii) under a statute of Alberta or of Canada or of another province of Canada, (iii) under a regulation of Alberta, a regulation of Canada or similar subordinate legislation of another province of Canada that, if enacted in Alberta, would constitute a regulation of Alberta,

15 Explanatory Notes (

b) the purposes for which the personal information referred to in clause (

a) has been and is being used by the organization; (

c) the names of the persons to whom and circumstances in which the personal information referred to in clause (

a) has been and is being disclosed.

(2) An organization may refuse to provide access to personal information under subsection (1) if (

e) the information was collected by a mediator or arbitrator or was created in the conduct of a mediation or arbitration for which the mediator or arbitrator was appointed to act (

i) under an agreement, (ii) under an enactment, or (iii) by a court;

(4) If, in respect of a record, an organization is reasonably able to sever the information referred to in subsection (2)(

b) or (3)(a), (

b) or (

c) from a copy of the record that contains personal information about the individual who requested it, the organization must provide the individual with access to the record after the information referred to in subsection (2)(

b) or (3)(a), (

b) or (

c) has been severed.

16 (iv) under a legislative instrument of a professional regulatory organization, or (

v) by a court; (

c) by repealing subsection (4) and substituting the following:

(4) If an organization is reasonably able to sever the information referred to in subsection (2)(

b) or (3)(a), (

b) or (

c) from a copy of the record that contains personal information about the applicant, the organization must provide the applicant with access to the part of the record containing the personal information after the information referred to in subsection (2)(

b) or (3)(a), (

b) or (

c) has been severed. 16

Section 25(1) is amended by adding “, in accordance with

section 26,” after “may”. 17

Section 26 is repealed and the following is substituted: How to make a request 26(1) A request under

section 24(1) or 25(1) must (

a) be in writing, and (

b) include sufficient detail to enable the organization, with a reasonable effort, to identify any record in the custody or under the control of the organization containing the personal information in respect of which the request is made.

(2) An applicant who is requesting access to personal information under

section 24(1)(

a) may ask for a copy of the record containing the personal information or to examine the record.

16 Explanatory Notes 16

Section 25 presently reads in part: 25(1) An individual may request an organization to correct an error or omission in the personal information about the individual that is under the control of the organization. 17

Section 26 presently reads: 26(1) For an individual to obtain access to personal information about that individual or make a request for a correction to personal information about that individual, the individual must make a written request to the organization setting out sufficient detail to enable the organization, with a reasonable effort, to identify the information in respect of which the written request is made.

(2) The applicant may ask for a copy of the record, or ask to examine the record, that contains personal information about the applicant.

17 18

Section 27 is amended (

a) in subsection (1)(

b) by adding “making a request under

section 24(1)(a)” after “an applicant”; (

b) in subsection (2) by striking out “applicant’s personal information” and substituting “applicant making a request under

section 24(1)(a)”. 19

Section 28 is amended (

a) by adding the following after subsection (2):

(2.1) The failure of an organization to respond to a request in accordance with subsection (1) is to be treated as a decision to refuse the request. (

b) in subsection (4) by striking out “or a refusal to excuse the payment of all or part of the fee required by the organization”. 20

Section 29 is amended (

a) by renumbering it as

section 29(1);

17 Explanatory Notes 18

Section 27 presently reads: 27(1) An organization must (

a) make every reasonable effort (

i) to assist applicants, and (ii) to respond to each applicant as accurately and completely as reasonably possible, and (

b) at the request of an applicant provide, if it is reasonable to do so, an explanation of any term, code or abbreviation used in any record provided to the applicant or that is referred to.

(2) An organization must, with respect to an applicant’s personal information, create a record for the applicant if (

a) the record can be created from a record that is in electronic form and that is under the control of the organization, using its normal computer hardware and software and technical expertise, and (

b) creating the record would not unreasonably interfere with the operations of the organization. 19

Section 28(4) presently reads:

(4) If an applicant asks the Commissioner under

section 46 to review a fee estimate or a refusal to excuse the payment of all or part of the fee required by the organization, the 45-day period referred to in subsection (1) does not include the period from the start of the day in which the applicant asks for the review to the end of the day in which the decision is made by the Commissioner with respect to the review. 20

Section 29 presently reads: 29 In a response to a request made under

section 24, the organization must inform the applicant

18 (

b) in subsection (1) by striking out “section 24” and substituting “section 24(1)(a)”; (

c) by adding the following after subsection (1):

(2) In response to a request made under

section 24(1)(b), the organization must (

a) provide the applicant with (

i) information about the purposes for which the personal information has been and is being used by the organization, and (ii) the names of the persons to whom and circumstances in which the personal information has been and is being disclosed, or (

b) if the organization refuses to provide the information referred to in clause (a), inform the applicant (

i) of the name of the person who can answer on behalf of the organization the applicant’s questions about the refusal, and (ii) that the applicant may ask for a review under

section 46.

(3) In response to a request made under

section 25(1), the organization must inform the applicant (

a) of the action taken under

section 25, (

b) of the name of the person who can answer on behalf of the organization the applicant’s questions about the request for correction, and (

c) that the applicant may ask for a review under

section 46.

18 Explanatory Notes (

a) as to whether or not the applicant is entitled to or will be given access to all or part of his or her personal information, (

b) if the applicant is entitled to or will be given access, when access will be given, and (

c) if access to all or part of the applicant’s personal information is refused, (

i) of the reasons for the refusa l and the provision of this Act on which the refusal is based, (ii) of the name of the pers on who can answer on behalf of the organization the applicant’s questions about the refusal, and (iii) that the applicant may ask for a review under

section 46.

19 21

Section 30 is repealed and the following is substituted: How access will be given 30 Where an applicant is informed under

section 29(1) that access to the applicant’s personal information will be given, the organization must, (

a) if the applicant has asked for a copy of the applicant’s personal information and the information can reasonably be reproduced, (

i) provide with the response a copy of the record or the part of the record containing the information, or (ii) give the applicant reasons for the delay in providing the information or record, or (

b) if the applicant has as ked to examine the record containing the applicant’s personal information or if the record cannot reasonably be reproduced, (

i) permit the applicant to examine the record or part of the record, or (ii) give the applicant access in accordance with the regulations. 22

Section 31(1) is amended (

a) by striking out “section 24” and substituting “section 24(1)(

a) or (b)”; (

b) by repealing clause (

a) a nd substituting the following: (

a) the applicant does not give sufficient detail to enable the organization to identify the record containing the personal information, (

c) by repealing clause (

d) a nd substituting the following: (

d) more time is needed to consult with another organization, a public body or a government or an

19 Explanatory Notes 21

Section 30 presently reads: 30 Where an applicant is informed under

section 29 that access will be given, the organization must, (

a) if an applicant has asked for a copy of the applicant’s personal information and the information can reasonably be reproduced, (

i) provide with the response a copy of the information or the record or part of the record relating to the information, or (ii) give the applicant reasons for the delay in providing the information or record, or (

b) if an applicant has asked to examine the record relating to the applicant’s personal information or if the record cannot reasonably be reproduced, (

i) permit the applicant to examine the record or part of the record, or (ii) give the applicant ac cess in accordance with the regulations. 22

Section 31(1) presently reads in part: 31(1) An organization may, with respect to a request made under

section 24, extend the time period for responding to the request by up to an additional 30 days or, with the Commissioner’s permission, to a longer period, if (

a) the applicant does not give enough detail to enable the organization to identify the personal information or the record relating to the information, (

d) more time is needed to consult with another organization or with a public body before the organization is able to determine whether or not to give the applicant access to the requested personal information or record relating to the information.

20 agency of a government of a jurisdiction in Canada before the organization is able to determine whether or not to give the applicant access to the requested personal information or to provide information about the use or disclosure of the personal information. 23

Section 32 is amended (

a) by repealing subsection (1) and substituting the following: Fees 32(1) Subject to subsection (1.1), an organization may charge an applicant who makes a request under

section 24(1)(

a) or (

b) a reasonable fee for access to the applicant’s personal information or for information about the use or disclosure of the applicant’s personal information. (

b) by adding the following after subsection (1):

(1.1) An organization may not charge a fee in respect of a request for personal employee information. (

c) by repealing subsection (2) and substituting the following:

(2) An organization may not charge a fee in respect of a request made under

section 25(1). 24

Section 33 is amended by adding “to the extent that is reasonable for the organization’s purposes in collecting, using or disclosing the information” after “accurate and complete”. 25 The following is added after

section 34: Notification of loss or unauthorized access or disclosure 34.1(1) An organization having personal information under its control must, without unreasonable delay, provide notice to the Commissioner of any incident involving the loss of or

20 Explanatory Notes 23

Section 32 presently reads: 32(1) An organization may charge an applicant who makes a request under

section 24 a reasonable fee for access to the applicant’s personal information or a record relating to the information.

(2) Subject to the regulations, a fee is not payable by an applicant in respect of a request made under

section 25.

(3) If an organization is intending to charge an applicant a fee for a service, the organization (

a) must give the applicant a written estimate of the total fee before providing the service, and (

b) may require the applicant to pay a deposit in the amount determined by the organization. 24

Section 33 presently reads: 33 An organization must make a reasonable effort to ensure that any personal information collected, used or disclosed by or on behalf of an organization is accurate and complete. 25 Notification of loss or unauthorized access or disclosure.

21 unauthorized access to or disclosure of the personal information where a reasonable person would consider that there exists a real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure.

(2) A notice to the Commissioner under subsection (1) must include the information prescribed by the regulations. 26

Section 35 is repealed and the following is substituted: Retention and destruction of information 35(1) An organization may retain personal information only for as long as the organization reasonably requires the personal information for legal or business purposes.

(2) Within a reasonable period of time after an organization no longer reasonably requires personal information for legal or business purposes, the organization must (

a) destroy the records containing the personal information, or (

b) render the personal information non-identifying so that it can no longer be used to identify an individual. (3) Subsection (1) applies notwithstanding any withdrawal or variation of the consent of the individual that the personal information is about under

section 9. 27

Section 36(2) is amended by adding the following after clause (e): (e.1) notification of an incident described in

section 34.1 has not been provided in accordance with this Act;

21 Explanatory Notes 26

Section 35 presently reads: 35 Notwithstanding that a consent has been withdrawn or varied under

section 9, an organization may for legal or business purposes retain personal information as long as is reasonable. 27

Section 36(2) presently reads:

(2) Without limiting subsection (1), the Commissioner may investigate and attempt to resolve complaints that (

a) a duty imposed by

section 27 has not been performed; (

b) an extension of a time period under

section 31 for responding to a request is not justified; (

c) a fee estimated or required by an organization under this Act is inappropriate; (

d) a correction of personal info rmation requested under

section 25 has been refused without justification;

22 28 The following is added after

section 37: Power to require notification 37.1(1) Where an organization suffers a loss of or unauthorized access to or disclosure of personal information that the organization is required to provide notice of under

section 34.1, the Commissioner may require the organization to notify individuals to whom there is a real risk of significant harm as a result of the loss or unauthorized access or disclosure (

a) in a form and manner prescribed by the regulations, and (

b) within a time period determined by the Commissioner.

(2) If the Commissioner requires an organization to notify individuals under subsection (1), the Commissioner may require the organization to satisfy any terms or conditions that the Commissioner considers appropriate in addition to the requirements under subsection (1).

(3) The Commissioner must establish an expedited process for determining whether to require an organization to notify individuals under subsection (1) in circumstances where the real risk of significant harm to an individual as a result of the loss or unauthorized access or disclosure is obvious and immediate.

(4) The Commissioner may require an organization to provide any additional information that the Commissioner considers necessary to determine whether to require the organization (

a) to notify individuals under subsection (1), or (

b) to satisfy terms and conditions under subsection (2).

(5) An organization must comply with a requirement (

a) to provide additional information under subsection (4), (

b) to notify individuals under subsection (1), or

22 Explanatory Notes (

e) personal information has been collected, used or disclosed by an organization in contravention of this Act or in circumstances that are not in compliance with this Act; (

f) an organization is not in compliance with this Act. 28 Power to require notification.

23 (

c) to satisfy terms and conditions under subsection (2).

(6) The Commissioner has exclusive jurisdiction to require an organization (

a) to provide additional information under subsection (4), (

b) to notify individuals under subsection (1), or (

c) to satisfy terms or conditions under subsection (2).

(7) Nothing in this

section is to be construed so as to restrict an organization’s ability to notify individuals on its own initiative of the loss of or unauthorized access to or disclosure of personal information. 29 The following is added after

section 38: Legal privilege not affected 38.1 If a legal privilege, including solicitor-client privilege, applies to information disclosed to the Commissioner on the Commissioner’s request under

section 37.1 or

section 38, the legal privilege is not affected by the disclosure. 30

Section 39 is amended (

a) by adding the following after subsection (1):

(1.1) The Commissioner and anyone acting for or under the direction of the Commissioner shall not give or be compelled to give evidence in a court or in any other proceeding in respect of any information obtained in performing their duties, powers and functions under this Act, except in the circumstances set out in subsection (1)(

a) to (c). (

b) in subsection (2) by striking out “Subsection (1) applies” and substituting “Subsections (1) and (1.1) apply”; (

c) by adding the following after subsection (2): (3) Subsection (2) is not to be construed so as to restrict an individual’s ability to commence an action under

section 60.

23 Explanatory Notes 29 Legal privilege not affected. 30

Section 39 presently reads: 39(1) A statement made or an answer given by a person during an investigation or inquiry by the Commissioner is inadmissible in evidence in court or in any other proceeding, except (

a) in a prosecution for perjury in respect of sworn testimony, (

b) in a prosecution for an of fence under this Act, or (

c) in an application for judicial review or an appeal from a decision with respect to an application for judicial review. (2) Subsection (1) applies also in respect of evidence of the existence of proceedings conducted before the Commissioner.

24 31

Section 41 is amended (

a) in subsection (3) by striking out “section 24” and substituting “section 24(1)(a)”; (

b) by adding the following after subsection (3):

(3.1) Subject to subsection (3.2), the Commissioner may disclose to the Minister of Justice and Attorney General information relating to the commission of an offence under an enactment of Alberta or Canada if the Commissioner considers there is evidence of an offence.

(3.2) The Commissioner shall not disclose information under subsection (3.1) if the information is subject to solicitor-client privilege. 32

Section 47 is amended (

a) by repealing subsection (1) and substituting the following: How to ask for a review or initiate a complaint 47(1) To ask for a review or initiate a complaint under this Part, an individual must, (

a) in the case of a request for a review, deliver a written request for review to the Commissioner, or (

b) in the case of a complaint, deliver a written complaint to the Commissioner.

24 Explanatory Notes 31

Section 41 presently reads: 41(1) The Commissioner and anyone acting for or under the direction of the Commissioner shall not disclose any information obtained in performing their duties, powers and functions under this Act, except as provided in subsections (2) to (4).

(2) The Commissioner may disclose, or may authorize anyone acting for or under the direction of the Commissioner to disclose, information that is necessary for the purposes of (

a) conducting an investigation or inquiry under this Act, or (

b) establishing the grounds for findings and recommendations contained in a report under this Act.

(3) In conducting an investigation or inquiry under this Act and in a report under this Act, the Commissioner and anyone acting for or under the direction of the Commissioner must take every reasonable precaution to avoid disclosing, and shall not disclose, any information that an organization would be required or permitted to refuse access to if access to personal information were requested under

section 24.

(4) The Commissioner may disclose, or may authorize anyone acting for or under the direction of the Commissioner to disclose, information in the course of a prosecution, application or appeal referred to in

section 39. 32

Section 47 presently reads: 47(1) To ask for a review or to initiate a complaint under this Part, an individual must, as soon as reasonable, deliver a written request to the Commissioner.

(2) A written request to the Commissioner for a review of a decision of an organization must be delivered within (a) 30 days from the day that th e individual asking for the review is notified of the decision, or (

b) a longer period allo wed by the Commissioner.

(3) A written request to the Commissioner initiating a complaint must be delivered within a reasonable time.

25 (

b) in subsection (2) by adding “for review” after “written request”; (

c) by repealing subsection (3) and substituting the following:

(3) A written complaint to the Commissioner about an organization must be delivered within a reasonable time. (

d) in subsection (4) by adding “to a request for access to personal information” after “respond”. 33

Section 48 is amended (

a) in subsection (2) (

i) by striking out “written request initiating a complaint” and substituting “written complaint”; (ii) by striking out “the written request” and substituting “the written complaint”; (

b) by repealing subsection (3) and substituting the following:

(3) The Commissioner may sever any information contained in a written request for review or written complaint that the Commissioner considers appropriate before giving a copy of the written request for review or written complaint to an organization or other person under subsection (1) or (2). 34 The following is added after

section 49: Refusal to conduct or continue investigation or review 49.1(1) Without limiting

section 36(2), the Commissioner may refuse to conduct an investigation or review or may discontinue an investigation or review if the Commissioner is of the opinion that

25 Explanatory Notes

(4) The time limit in subsection (2)(

a) does not apply to delivering a written request for a review concerning an organization’s failure to respond within a required time period. 33

Section 48 presently reads: 48(1) On receiving a written request for a review, the Commissioner must give a copy of the written request to (

a) the organization concerned, and (

b) any other person that the Commissioner considers appropriate.

(2) On receiving a written request initiating a complaint, the Commissioner may give a copy of the written request to (

a) the organization concerned, and (

b) any other person that the Commissioner considers appropriate.

(3) Notwithstanding subsection (1)(

a) or (2)(a), the Commissioner may sever any information contained in the written request that the Commissioner considers appropriate before giving a copy of the written request to the organization or any other person affected by the request. 34 Refusal to conduct or continue investigation or review.

26 (

a) the written request for revi ew or the written complaint is frivolous or vexatious or is not made in good faith, or (

b) the circumstances warrant refusing to conduct or to continue an investigation or review.

(2) The Commissioner must give written notice of a decision under subsection (1) to (

a) the individual who requested the review or initiated the complaint, (

b) the organization concerned, if the organization was given a copy of the written request for review or written complaint by the Commissioner under

section 48, and (

c) any other person to whom the Commissioner gave a copy of the written request for review or written complaint under

section 48. Records relating to an investigation 49.2 An organization must retain records relating to an investigation under

section 36 for one year after the conclusion of the investigation or any longer period specified by the Commissioner. 35

Section 50 is amended (

a) in subsection (1) by striking out “or” at the end of clause (b), by adding “or” at the end of clause (

c) and by adding the following after clause (c): (

d) is not the subject of a notice under

section 49.1(2), (

b) in subsection (3) by striking out “for the review or initiating the” and substituting “for review or written”; (

c) by repealing subsection (5) and substituting the following:

(5) An inquiry into a matter that is the subject of a written request for review or written complaint referred to in

section 47 must be completed within one year from the day that the written request for review or written complaint was received by the Commissioner unless the Commissioner

26 Explanatory Notes 35

Section 50 presently reads: 50(1) If a matter under review or relating to a complaint (

a) is not referred to mediation, (

b) is not settled pursuant to mediation under

section 49, or (

c) is not resolved, the Commissioner may conduct an inquiry and decide all questions of fact and law arising in the course of the inquiry.

(2) An inquiry under subsection (1) may be conducted in private.

(3) An individual who asks for a review or initiates a complaint, the organization concerned and any person given a copy of the written request for the review or initiating the complaint

27 (

a) notifies the individual who made the written request for review or written complaint, the organization concerned and any other person given a copy of the written request for review or written complaint that the Commissioner is extending that period, and (

b) provides an anticipated date for the completion of the inquiry. 36

Section 51 is amended (

a) by repealing clause (

a) a nd substituting the following: (

a) access to all or part of a record containing personal information about the individual, or (

b) by striking out “collection,” wherever it appears.

27 Explanatory Notes (

a) must be given an opportunity to make representations to the Commissioner during the inquiry, and (

b) may be represented at the inquiry by a lawyer or an agent.

(4) The Commissioner may decide (

a) whether representations are to be made orally or in writing, and (

b) whether a person is entitled to be present during or to have access to or to comment on representations made to the Commissioner by another person.

(5) An inquiry into a matter that is the subject of a written request referred to in

section 47 must be completed within 90 days from the day that the written request was received by the Commissioner unless the Commissioner (

a) notifies the person who made the written request, the organization concerned and any other person given a copy of the written request that the Commissioner is extending that period, and (

b) provides an antici pated date for the completion of the review. 36

Section 51 presently reads: 51 At an inquiry into a decision under which an individual was refused (

a) access to all or part of the personal information about the individual or a record relating to the information, or (

b) information respecting the co llection, use or disclosure of personal information about the individual, it is up to the organization to establish to the satisfaction of the Commissioner that the individual has no right of access to the personal information about the individual or no right to the information requested respecting the collection, use or disclosure of the personal information about the individual.

28 37

Section 52(2) is repealed and the following is substituted:

(2) If the inquiry relates to a decision of an organization under

section 24 to give or to refuse to give an individual access to all or part of a record containing personal information about the individual that is in the custody or under the control of the organization or to provide or to refuse to provide information about the use or disclosure of personal information about the individual, the Commissioner may (

a) by order do one of the following: (

i) direct the organization to give the individual access to all or part of the record containing personal information about the individual or to provide the individual with information about the organization’s use or disclosure of personal information about the individual if the Commissioner determines that the organization is not permitted under this Act to refuse access or to refuse to provide the information, as the case may be; (ii) either confirm the deci sion of the organization or require the organization to reconsider its decision as to whether to give access to all or part of the record containing personal information or to provide information about the use or disclosure of personal information if the Commissioner determines that the organization may under this Act refuse access or refuse to provide information, as the case may be; (iii) direct the organization to refuse to give the individual access to all or part of the record containing personal information about the individual if the Commissioner determines that the organization is required under this Act to refuse access, or (

b) make an order that the Commissioner considers appropriate if, in the circumstances, an order under clause (

a) would not be applicable.

28 Explanatory Notes 37

Section 52(2) presently reads:

(2) If the inquiry relates to a decision of an organization to give or refuse to give access to all or part of the personal information about the individual or a record relating to the information, the Commissioner must, by order, do one of the following: (

a) direct the organization to give the individual access to all or part of the personal information about the individual or any record relating to the information that is under the control of the organization if the Commissioner determines that the organization is not permitted under this Act to refuse access; (

b) either confirm the decision of the organization or require the organization to reconsider its decision concerning access if the Commissioner determines that the organization may under this Act refuse access; (

c) direct the organization to refuse the individual access to all or part of the personal information about the individual or any record relating to the information if the Commissioner determines that the organization is required under this Act to refuse access.

29 38

Section 54 is amended (

a) in subsection (2) by striking out “subsection (3)” and substituting “section 54.1”; (

b) by repealing subsections (3) to (5). 39 The following is added after

section 54: Judicial review 54.1(1) An application to the Court of Queen’s Bench for judicial review of a Commissioner’s order must be made not later than 45 days from the day that the person making the application is given a copy of the order.

(2) If an application for judicial review is made pursuant to subsection (1), the Commissioner’s order is stayed until the application is dealt with by the court. 40

Section 55(1)(

c) and (

d) are repealed.

29 Explanatory Notes 38

Section 54 presently reads in part:

(2) An organization must not take any steps to comply with a Commissioner’s order until the period for bringing an application for judicial review under subsection (3) ends.

(3) An application to a court for judicial review of a Commissioner’s order must be made not later than 45 days from the day that the person making the application is given a copy of the order.

(4) If an application for judicial review is made pursuant to subsection (3), the Commissioner’s order is stayed until the application is dealt with by the court.

(5) Notwithstanding subsection (3), the court may, on application made either before or after the expiry of the period referred to in subsection (3), extend that period if the court considers it appropriate to do so. 39 Judicial review. 40

Section 55(1)(

c) and (

d) presently read: 55(1) In this section, (c) “professional Act” means an enactment under which a professional or occupational group or discipline is organized and that provides for the membership in and the regulation of the members of the professional or occupational group or discipline, including the registration, competence, conduct, practice and discipline of its members;

30 41

Section 59 is amended (

a) in subsection (1) (

i) in clauses (

a) and (

b) by striking out “wilfully”; (ii) by repealing clause (

c) and substituting the following: (

c) disposes of or alters, falsifies, conceals or destroys, or directs another person to dispose of, alter, falsify, conceal or destroy, a record containing personal information or a record containing information about the use or disclosure of personal information (

i) after receiving a request under

section 24(1)(

a) or (b), or (ii) in circumstances in which a reasonable person would consider that it was likely that a request under

section 24(1)(

a) or (

b) would be made; (iii) by repealing clause (

d) and substituting the following: (

d) obstructs the Commissioner or an authorized delegate of the Commissioner in the performance of the Commissioner’s duties, powers or functions under this Act, including but not limited to obstructing the Commissioner or authorized delegate by disposing of, altering, falsifying, concealing or destroying evidence relevant to an investigation or inquiry by the Commissioner; (iv) by repealing clause (

e) and substituting the following: (

e) makes a false statement to the Commissioner or an authorized delegate of the Commissioner, or misleads or attempts to mislead the Commissioner or authorized delegate, in the course of the performance

30 Explanatory Notes (d) “professional regulatory organization” means an organization incorporated under a professional Act. 41

Section 59 presently reads: 59(1) Subject to subsections (3) and (4), a person commits an offence if the person (

a) wilfully collects, uses or discloses personal information in contravention of

Part 2; (

b) wilfully attempts to gain or gains access to personal information in contravention of this Act; (

c) disposes of or al ters, falsifies, conceals or destroys personal information or any record relating to personal information, or directs another person to do so, with an intent to evade a request for access to the information or the record; (

d) obstructs the Commissioner or an authorized delegate of the Commissioner in the performance of the Commissioner’s duties, powers or functions under this Act; (

e) knowingly makes a false st atement to the Commissioner, or knowingly misleads or attempts to mislead the Commissioner, in the course of the Commissioner’s performance of the Commissioner’s duties, powers or functions under this Act; (

f) fails to comply with an order made by the Commissioner under this Act.

(2) A person who commits an offence under subsection (1) is liable, (

a) in the case of an individua l, to a fine of not more than $10 000, and (

b) in the case of a person other than an individual, to a fine of not more than $100 000.

(3) No person is liable to prosecution for an offence against this or any other Act by reason only of complying with a requirement of the Commissioner under this Act.

(4) Neither an organization nor an individual is guilty of an offence under this Act if it is established to the satisfaction of the court that

31 of the Commissioner’s duties, powers or functions under this Act; (

v) by adding the following after clause (e): (e.1) fails to provide notice to the Commissioner under

section 34.1; (e.2) contravenes

section 58; (

b) by adding the following after subsection (4):

(5) A prosecution under this Act may be commenced within 2 years after the commission of the alleged offence, but not afterwards. 42

Section 60(1) is amended by striking out “an order under this Act” and substituting “an order under

section 52”. 43

Section 62(1) is amended (

a) by adding the following after clause (i): (i.1) exempting organizations from the application of all or part of

section 13.1; (

b) by adding the following after clause (l): (

m) prescribing the information that must be included with a notice under

section 34.1; (

n) prescribing the form and manner of notification of individuals under

section 37.1.

31 Explanatory Notes the organization or individual, as the case may be, acted reasonably in the circumstances that gave rise to the offence. 42

Section 60(1) presently reads: 60(1) If the Commissioner has made an order under this Act against an organization and the order has become final as a result of there being no further right of appeal, an individual affected by the order has a cause of action against the organization for damages for loss or injury that the individual has suffered as a result of the breach by the organization of obligations under this Act or the regulations. 43 New regulation-making powers.

32 44

Section 63 is repealed and the following is substituted: Review of Act 63(1) A special committee of the Legislative Assembly must begin a comprehensive review of this Act and the regulations made under it (

a) by July 1, 2015, and (

b) thereafter, every 6 years after the date on which the previous special committee submits its final report under subsection (2).

(2) A special committee must submit a final report to the Legislative Assembly within 18 months after beginning a review under subsection (1).

(3) The report of a special committee may include the special committee’s recommendations for amendments to this Act, the regulations made under this Act or any other enactment. 45 This Act comes into force on Proclamation.

32 Explanatory Notes 44

Section 63 presently reads: 63(1) A special committee of the Legislative Assembly must begin a comprehensive review of this Act by July 1, 2006 and at least once every 3 years after that, and must submit a report to the Legislative Assembly within 18 months after beginning the review.

(2) A report submitted under subsection (1) may include any amendments to this Act or any other Act that are recommended by the committee. 45 Coming into force.

RECORD OF DEBATE Stage Date Member From To Questions and Comments From To Stage Date Member From To Questions and Comments From To Stage Date Member From To Questions and Comments From To Stage Date Member From To Questions and Comments From To Title: 2009 (27th, 2nd) Bill 54, Personal Information Protection Amendment Act, 2009

Document details

Collection	Alberta — Bills
Citation	L27 S2 1450
Type	bill
Volume / chapter	L27 S2 1450
Language	en
Format	json
Source	PROVINCIAL
Identifier	badb3e1d56e339ad21f561ba6a0a55509ea14415

Source file is stored in the law ingest library (json).