PART II -- PROTECTION OF INDIVIDUAL PRIVACY

COLLECTION AND RETENTION OF PERSONAL INFORMATION

Application of Part

27. This Part does not apply to personal information that is maintained for the purpose of creating a record that is available to the general public. [R.S.O. 1990, c. M.56, s. 27.]

Definition

28. (1) In this section and in section 29 , "personal information" includes information that is not recorded and that is otherwise defined as "personal information" under this Act.

Collection of personal information

(2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. [R.S.O. 1990, c.M.56, s.28.]

Manner of collection

29. (1) An institution shall collect personal information only directly from the individual to whom the information relates unless,

(a) the individual authorizes another manner of collection;

(b) the personal information may be disclosed to the institution concerned under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act ;

(c) the Commissioner has authorized the manner of collection under clause 46(c) ;

(d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act;

(e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service;

(f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or judicial or quasi- judicial tribunal;

(g) the information is collected for the purpose of law enforcement; or

(h) another manner of collection is authorized by or under a statute.

Notice to individual

(2) If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of,

(a) the legal authority for the collection;

(b) the principal purpose or purposes for which the personal information is intended to be used; and

(c) the title, business address and business telephone number of an officer or employee of the institution who can answer the individual's questions about the collection.

Exception

(3) Subsection (2) does not apply if,

(a) the head may refuse to disclose the personal information under subsection 8(1) or (2) (law enforcement);

(b) the Minister waives the notice; or

(c) the regulations provide that the notice is not required. [R.S.O. 1990, c.M.56, s.29.]

Retention of personal information

30. (1) Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information.

Standard of accuracy

(2) The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date.

Exception

(3) Subsection (2) does not apply to personal information collected for law enforcement purposes.

Disposal of personal information

(4) A head shall dispose of personal information under the control of the institution in accordance with the regulations. [R.S.O. 1990, c.M.56, s.30.]

USE AND DISCLOSURE OF PERSONAL INFORMATION

Use of personal information

31. An institution shall not use personal information in its custody or under its control except,

(a) if the person to whom the information relates has identified that information in particular and consented to its use;

(b) for the purpose for which it was obtained or compiled or for a consistent purpose; or

(c) for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act . [R.S.O. 1990, c.M.56, s.31.]

Where disclosure permitted

32. An institution shall not disclose personal information in its custody or under its control except,

(a) in accordance with Part I ;

(b) if the person to whom the information relates has identified that information in particular and consented to its disclosure;

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

(d) if the disclosure is made to an officer or employee of the institution who needs the record in the performance of his or her duties and if the disclosure is necessary and proper in the discharge of the institution's functions;

(e) for the purpose of complying with an Act of the Legislature or an Act of Parliament, an agreement or arrangement under such an Act or a treaty;

(f) if disclosure is by a law enforcement institution,

(i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or

(ii) to another law enforcement agency in Canada;

(g) if disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;

(h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification is mailed to the last known address of the individual to whom the information relates;

(i) in compassionate circumstances, to facilitate contact with the next of kin or a friend of an individual who is injured, ill or deceased;

(j) to the Minister;

(k) to the Information and Privacy Commissioner;

(l) to the Government of Canada or the Government of Ontario in order to facilitate the auditing of shared cost programs. [R.S.O. 1990, c.M.56, s.32.]

Consistent purpose

33. The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31(b) and 32(c) only if the individual might reasonably have expected such a use or disclosure. [R.S.O. 1990, c.M.56, s.33.]

PERSONAL INFORMATION BANKS

Personal information bank index

34. (1) A head shall make available for inspection by the public an index of all personal information banks in the custody or under the control of the institution setting forth, in respect of each personal information bank,

(a) its name and location;

(b) the legal authority for its establishment;

(c) the types of personal information maintained in it;

(d) how the personal information is used on a regular basis;

(e) to whom the personal information is disclosed on a regular basis;

(f) the categories of individuals about whom personal information is maintained; and

(g) the policies and practices applicable to the retention and disposal of the personal information.

Ensure accuracy

(2) The head shall ensure that the index is amended as required to ensure its accuracy. [R.S.O. 1990, c.M.56, s.34.]

Inconsistent use or disclosure

35. (1) A head shall attach or link to personal information in a personal information bank,

(a) a record of any use of that personal information for a purpose other than a purpose described in clause 34(1)(d) ; and

(b) a record of any disclosure of that personal information to a person other than a person described in clause 34(1)(e) .

Idem

(2) A record of use or disclosure under subsection (1) forms part of the personal information to which it is attached or linked. [R.S.O. 1990, c.M.56, s.35.]

RIGHT OF INDIVIDUALS TO WHOM PERSONAL INFORMATION RELATES TO ACCESS AND CORRECTION

Right of access to personal information

36. (1) Every individual has a right of access to,

(a) any personal information about the individual contained in a personal information bank in the custody or under the control of an institution; and

(b) any other personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to render it reasonably retrievable by the institution.

Right of correction

(2) Every individual who is given access under subsection (1) to personal information is entitled to,

(a) request correction of the personal information if the individual believes there is an error or omission;

(b) require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made; and

(c) require that any person or body to whom the personal information has been disclosed within the year before the time a correction is requested or a statement of disagreement is required be notified of the correction or statement of disagreement. [R.S.O. 1990, c.M.56, s.36.]

Request

37. (1) An individual seeking access to personal information about the individual shall make a request for access in writing to the institution that the individual believes has custody or control of the personal information and shall identify the personal information bank or otherwise identify the location of the personal information.

Access procedures

(2) Subsections 4(2) and 17(2) and sections 18 , 19 , 20 , 21 , 22 and 23 apply with necessary modifications to a request made under subsection (1).

Comprehensible form

(3) If access to personal information is to be given, the head shall ensure that the personal information is provided to the individual in a comprehensible form and in a manner that indicates the general conditions under which the personal information is stored and used. [R.S.O. 1990, c.M.56, s.37.]

Exemptions

38. A head may refuse to disclose to the individual to whom the information relates personal information,

(a) if section 6 , 7 , 8 , 9 , 10 , 11 , 12 , 13 or 15 would apply to the disclosure of that personal information;

(b) if the disclosure would constitute an unjustified invasion of another individual's personal privacy;

(c) that is evaluative or opinion material compiled solely for the purpose of determining suitability, eligibility or qualifications for employment or for the awarding of contracts and other benefits by an institution if the disclosure would reveal the identity of a source who furnished information to the institution in circumstances where it may reasonably have been assumed that the identity of the source would be held in confidence;

(d) that is medical information if the disclosure could reasonably be expected to prejudice the mental or physical health of the individual; or

(e) that is a research or statistical record. [R.S.O. 1990, c.M.56, s.38.]