Freedom of Information and Protection of Privacy Act
Ontario, Chapter F.31

PART III -- PROTECTION OF INDIVIDUAL PRIVACY


COLLECTION AND RETENTION OF PERSONAL INFORMATION

Application of Part
37. This Part does not apply to personal information that is maintained for the purpose of creating a record that is available to the general public. [R.S.O. 1990, c.F.31, s.37.]

Definition
38. (1) In this section and in section 39 , "personal information" includes information that is not recorded and that is otherwise defined as "personal information" under this Act.
Collection of personal information
(2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. [R.S.O. 1990, c.F.31, s.38.]

Manner of collection
39. (1) Personal information shall only be collected by an institution directly from the individual to whom the information relates unless,
(a) the individual authorizes another manner of collection;
(b) the personal information may be disclosed to the institution concerned under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act ;
(c) the Commissioner has authorized the manner of collection under clause 59(c) ;
(d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act;
(e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service;
(f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or tribunal;
(g) the information is collected for the purpose of law enforcement; or
(h) another manner of collection is authorized by or under a statute.
Notice to individual
(2) Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of,
(a) the legal authority for the collection;
(b) the principal purpose or purposes for which the personal information is intended to be used; and
(c) the title, business address and business telephone number of a public official who can answer the individual's questions about the collection.
Exception
(3) Subsection (2) does not apply where the head may refuse to disclose the personal information under subsection 14(1) or (2) (law enforcement). [R.S.O. 1990, c.F.31, s.39.]

Retention of personal information
40. (1) Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information.
Standard of accuracy
(2) The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date.
Exception
(3) Subsection (2) does not apply to personal information collected for law enforcement purposes.
Disposal of personal information
(4) A head shall dispose of personal information under the control of the institution in accordance with the regulations. [R.S.O. 1990, c.F.31, s.40.]

USE AND DISCLOSURE OF PERSONAL INFORMATION

Use of personal information
41. An institution shall not use personal information in its custody or under its control except,
(a) where the person to whom the information relates has identified that information in particular and consented to its use;
(b) for the purpose for which it was obtained or compile or for a consistent purpose; or
(c) for a purpose for which the information may be disclosed to the institution under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act . [R.S.O. 1990, c.F.31, s.41.]

Where disclosure permitted
42. An institution shall not disclose personal information in its custody or under its control except,
(a) in accordance with Part II ;
(b) where the person to whom the information relates has identified that information in particular and consented to its disclosure;
(c) for the purpose for which it was obtained or compiled or for a consistent purpose;
(d) where disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and where disclosure is necessary and proper in the discharge of the institution's functions;
(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament or a treaty, agreement or arrangement thereunder;
(f) where disclosure is by a law enforcement institution,
(i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or
(ii) to another law enforcement agency in Canada;
(g) where disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;
(h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;
(i) in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;
(j) to a member of the Legislative Assembly who has been authorized by a constituent to whom the information relates to make an inquiry on the constituent's behalf or, where the constituent is incapacitated, has been authorized by the next of kin or legal representative of the constituent;
(k) to a member of the bargaining agent who has been authorized by an employee to whom the information relates to make an inquiry on the employee's behalf or, where the employee is incapacitated, has been authorized by the next- of-kin or legal representative of the employee;
(l) to the responsible minister;
(m) to the Information and Privacy Commissioner; and
(n) to the Government of Canada in order to facilitate the auditing of shared cost programs. [R.S.O. 1990, c.F.31, s.42.]

Consistent purpose
43. Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41(b) and 42(c) only if the individual might reasonably have expected such a use or disclosure. [R.S.O. 1990, c.F.31, s.43.]

PERSONAL INFORMATION BANKS

Personal information banks
44. A head shall cause to be included in a personal information bank all personal information under the control of the institution that is organized or intended to be retrieved by the individual's name or by an identifying number, symbol or other particular assigned to the individual. [R.S.O. 1990, c.F.31, s.44.]

Personal information bank index
45. The responsible minister shall publish at least once each year an index of all personal information banks setting forth, in respect of each personal information bank,
(a) its name and location;
(b) the legal authority for its establishment;
(c) the types of personal information maintained in it;
(d) how the personal information is used on a regular basis;
(e) to whom the personal information is disclosed on a regular basis;
(f) the categories of individuals about whom personal information is maintained; and
(g) the policies and practices applicable to the retention and disposal of the personal information. [R.S.O. 1990, c.F.31, s.45.]

Inconsistent use or disclosure
46. (1) A head shall attach or link to personal information in a personal information bank,
(a) a record of any use of that personal information for a purpose other than a purpose described in clause 45(d) ; and
(b) a record of any disclosure of that personal information to a person other than a person described in clause 45(e) .
Record of use part of personal information
(2) A record retained under subsection (1) forms part of the personal information to which it is attached or linked.
Notice and publication
(3) Where the personal information in a personal information bank under the control of an institution is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled by the institution but the use is not one of the uses included under clauses 45(d) and (e) , the head shall,
(a) forthwith notify the responsible minister of the use or disclosure; and
(b) ensure that the use is included in the index. [R.S.O. 1990, c.F.31, s.46.]

RIGHT OF INDIVIDUAL TO WHOM PERSONAL INFORMATION RELATES TO ACCESS AND CORRECTION

Right of access to personal information
47. (1) Every individual has a right of access to,
(a) any personal information about the individual contained in a personal information bank in the custody or under the control of an institution; and
(b) any other personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to render it reasonably retrievable by the institution.
Right of correction
(2) Every individual who is given access under subsection (1) to personal information is entitled to,
(a) request correction of the personal information where the individual believes there is an error or omission therein;
(b) require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made; and
(c) require that any person or body to whom the personal information has been disclosed within the year before the time a correction is requested or a statement of disagreement is required be notified of the correction or statement of disagreement. [R.S.O. 1990, c.F.31, s.47.]

Request
48. (1) An individual seeking access to personal information about the individual shall make a request therefor in writing to the institution that the individual believes has custody or control of the personal information and shall identify the personal information bank or otherwise identify the location of the personal information.
Access procedures
(2) Subsections 10(2) and 24(2) and sections 25 , 26 , 27 , 28 and 29 apply with necessary modifications to a request made under subsection (1).
Manner of access
(3) Subject to the regulations, where an individual is to be given access to personal information requested under subsection (1), the head shall,
(a) permit the individual to examine the personal information; or
(b) provide the individual with a copy thereof.
Comprehensible form
(4) Where access to personal information is to be given, the head shall ensure that the personal information is provided to the individual in a comprehensible form and in a manner which indicates the general terms and conditions under which the personal information is stored and used. [R.S.O. 1990, c.F.31, s.48.]

Exemptions
49. A head may refuse to disclose to the individual to whom the information relates personal information,
(a) where section 12 , 13 , 14 , 15 , 16 , 17 , 18 , 19 , 20 or 22 would apply to the disclosure of that personal information;
(b) where the disclosure would constitute an unjustified invasion of another individual's personal privacy;
(c) that is evaluative or opinion material compiled solely for the purpose of determining suitability, eligibility or qualifications for employment or for the awarding of government contracts and other benefits where the disclosure would reveal the identity of a source who furnished information to the institution in circumstances where it may reasonably have been assumed that the identity of the source would be held in confidence;
(d) that is medical information where the disclosure could reasonably be expected to prejudice the mental or physical health of the individual;
(e) that is a correctional record where the disclosure could reasonably be expected to reveal information supplied in confidence; or
(f) that is a research or statistical record. [R.S.O. 1990, c.F.31, s.49.]

[ <== Part II - Freedom of Information ] [ Part IV - Appeal ]