Guidance on Preparing Information Sharing Agreements Involving Personal Information

• Previous Page
• Table of Contents
• Next Page

6. Detailed Explanatory Notes

6.1 Purpose of sharing

An organization requesting personal information should be able to clearly identify the purpose for which the information is needed.  For example, the information may be needed for a non-administrative purpose (where the information will not be used in a decision-making process that could affect the individuals involved) such as may be the case for:

• program evaluation;
• audit;
• research, or
• statistical analysis.

Conversely, the information may be needed for an administrative purpose where the information will be used in a decision-making process that will affect the individuals involved, such as for:

• Authentication and verification:  where personal information is compared and positively confirmed to identify individuals prior to granting access to programs and services, physical areas or information;
• Administration of a program or service:  where personal information is used for determining or verifying eligibility for programs, administering program payments or overpayments, issuing or denying permits/licences, processing appeals, etc.;
• Compliance/regulatory activities: for example, where the information is used for detecting fraud or possible abuses of programs or services, harassment, etc., (where the consequences are administrative in nature – e.g. fine, discontinuation of benefits, audit of personal files or claims, etc.);
• Criminal investigations and enforcement/national security: where the information is used for purposes related to investigations and enforcement in a criminal context or associated with national security or anti-terrorism activities (e.g. to investigate and prosecute offences, to facilitate the secure flow of people to Canada, to respond to the threat of terrorism, etc.).

6.2 Definition of "personal information"

Personal information is defined under section 3 of the Privacy Act as "information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing,

1. information relating to the race, national or ethnic origin, color, religion, age or marital status of the individual,
2. information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,
3. any identifying number, symbol or other particular assigned to the individual. 

The list of examples included in paragraphs 3(a) to (m) of the Act is not exhaustive.

Personal information also includes any information that can remotely be linked to a person, such as an account number; a certificate or license number, an Internet Protocol (IP) address, a biometric identifier, a photographic image; and any other number, characteristic, or code that could lead to the identification of an individual.  The person's name is not always the determining factor since personal information includes any recorded information that permits or leads to the possible identification ^[1] of an individual whether alone or when combined with information from sources "otherwise available", including public sources.

The use and disclosure of some types of personal information is not restricted by the Privacy Act.  These exceptions are outlined in section 3, paragraphs j) to m) and include certain information about public servant positions, functions, and business coordinates; certain information about individuals performing services under contract with a government institution; information about discretionary financial benefits; and information about individuals who have been dead for more than 20 years.  (The information is excluded from the definition for the purposes of sections 7, 8 and 26 of the Privacy Act and section 19 of the Access to Information Act.) ^[2]

Other types of personal information, as defined in sections 69, 69.1 and 70 of the Privacy Act, are also excluded from the scope of the Act.  Such information would not, therefore, be disclosed in response to a formal request made under the Privacy Act.  Sections 69 and 70 state that the Act does not apply to:

• library or museum material preserved solely for public reference or exhibition purposes;
• material placed in the Library and Archives of Canada, the National Gallery of Canada, the Canadian Museum of Civilization, the Canadian Museum of Nature or the National Museum of Science and Technology by or on behalf of persons or organizations other than government institutions;
• personal information that the Canadian Broadcasting Corporation collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose;
• Confidences of the Queen's Privy Council for Canada.

When in doubt about whether information is considered "personal" and what restrictions apply to that information, you should consult with your institution's Access to Information and Privacy Coordinator.

6.3 Alternatives to sharing personal information with other institutions

Sharing personal information means that one or both parties may be disclosing to, or collecting personal information from, one another.  Given the privacy implications involved, institutions should consider whether there are alternative approaches to sharing personal information with other institutions.   For example, the following methods may be considered:

• Sharing depersonalized information (removing all personal identifiers)

  Personal information that has been modified so that the identity of the subject individual can no longer be determined is referred to as de-personalized information.  This may be accomplished by removing identifiers such as a person's name, date of birth and other personal data that can be linked to the individual.  Whatever the means used to de-personalize the data, re-identification should be rendered impossible, i.e. the remaining data, even when combined with other sources, should not permit any link to the individual(s).

• Sharing aggregated data (such as a range of ages instead of specific ages)

  Information that has been generalized in such a way that it cannot be linked to an individual, such as using a range of ages rather than specific ages of individuals, is known as aggregated data. 

If the objective cannot be achieved by using non-identifiable personal information, institutions should explore alternative approaches to reduce or eliminate privacy risks.

Sharing information available within the institution:

Of course, rather than sharing with other institutions, consideration should first be given to using personal information that exists within the institution, but is held by another branch or program area.  The information may be shared between the programs:  

• with the consent of the individual to whom the information relates;
• if the purpose of the sharing is consistent with the purpose for which the information was originally obtained or compiled; or
• for another purpose if one of the conditions set out in sections 7 or 8 of the Privacy Act is met.

Even within the institution, legal authority (usually legislation) must exist to permit sharing personal information among its programs.  That said, although information sharing agreements are sometimes used when sharing personal information between programs of the same institution, written agreements are not required.  However, the sharing of such information must be in compliance with the Privacy Act, and must be accounted for in the institution's Personal Information Banks in the TBS Info Source publication. 

In some cases, other legislation can take precedence over the Privacy Act (e.g., enabling legislation) and thus permit uses or disclosures, within or outside the institution.  For example, the Income Tax Act, Statistics Act, and the Department of Human Resources and Skills Development Act contain specific authorities for the use or disclosure of personal information and thus override the application of use and disclosure provisions (sections 7 and 8) of the Privacy Act.

The program area that has control of the personal information to be shared can determine whether sharing is appropriate, with the advice of the departmental privacy and legal experts.

There may be other alternatives, but the benefits and privacy risks associated with a particular option should be compared and assessed before making a decision.

It is recommended that government officials document alternative approaches considered and the rationale for the option chosen.

6.4 Determining the need

A federal government institution may need to share or exchange personal information for a variety of reasons with one of the following government organizations or agencies:

• another federal government institution;
• the government of a province or territory in Canada;
• a municipal or regional government in Canada;
• the government of a foreign state;
• an international organization of states or an international organization established by the governments of states; and
• other organizations when required, e.g. the council of a First Nation.

There are particular circumstances, such as a health epidemic, when the provision of personal information to another jurisdiction is mandatory.  For example, section 40.2 of the Quarantine Act (2005) is an example of federal legislation that requires personal health information to be disclosed in certain situations.  However, most disclosures of personal information from one government institution to another are discretionary. 

Institutions should consider discretionary disclosures only in circumstances where it is authorized by a federal law and there is a clear and justifiable purpose.  In this context, the recipient's need to obtain the information should not be confused with administrative convenience.  The "collecting government institution" should be able to demonstrate that it has the necessary authority to collect the personal information in the circumstances.  Likewise, the "disclosing government institution" should be able to demonstrate that the personal information can be disclosed for a lawful purpose.  

Arguments of public interest or benefit to the individual may also be invoked to justify disclosure.  In all cases, the disclosure should be limited to the minimum amount of information necessary for the legally authorized purpose.

6.5 Defining the scope of the agreement

Institutions should always strive to ensure that they only disclose the minimum amount of personal information required for the stated purpose of an ISA, and that the disclosure is duly authorized under section 8 of the Privacy Act.  The ISA should include a list of the personal data elements that will be exchanged along with the purpose for each and specific restrictions that may apply to any of the elements (i.e. the parties may wish to require that more sensitive data elements be encrypted, or impose more stringent conditions on subsequent use or disclosure, for example, if the Social Insurance Number is shared).

Institutions should also make every reasonable effort to ensure that all data elements disclosed are relevant and as accurate, up-to-date, and complete as possible in relation to the lawful purpose for which they are being shared with the receiving organization.  The type, extent, quality and reliability of the personal information to be shared, as well as the method of transmitting the data, need to be clearly established by the parties before information is shared. 

It is also a best practice for the institution to clearly identify upfront all purposes for which the personal information may be used or disclosed, including secondary uses.  Any prohibitions on secondary use(s) or further disclosure(s) of the information may also have to be carefully scrutinized and agreed upon by the parties to the agreement to avoid any conflicts or misunderstandings with the applicable legislation of each jurisdiction, including access and privacy laws and other relevant laws.

6.6 Ensuring Legal Compliance

When first considering a data sharing initiative, institutions should satisfy themselves that it is lawful.  This means that once an organization has defined what, how, why and with whom it wants to share personal information, it should then conduct an analysis of all applicable federal laws, including regulations, to ensure that it has the legal authority to do so.  The recipient would also be required to ensure that it has its own statutory authority to carry out the proposed data sharing activity. 

The sharing of personal information can bring into play the Canadian Charter of Rights and Freedoms.  The fact that a disclosure is specifically authorized under the Privacy Act or another Act of Parliament does not automatically ensure compliance with the Canadian Charter of Rights and Freedoms.  Consideration of these laws, the Canadian Charter of Rights and Freedoms and the ancillary jurisprudence establish the legal framework that should be reviewed to determine whether there are any statutory restrictions on the data sharing activity proposed.  It is recognized that the interrelationship between these areas of law is quite complex and specialist legal advice will often be necessary. 

The following provides a general overview of the legal context within which an institution's decision to share personal information should be made. 

6.6.1 Canadian Charter of Rights and Freedoms

The federal government is subject to the Canadian Charter of Rights and Freedoms and must ensure that its legislation, policies, and actions do not offend its protections. 

Canadian courts have clearly established that sections 7 and 8 of the Canadian Charter of Rights and Freedoms protect the right to privacy under certain circumstances.  The Supreme Court of Canada has determined that section 8 of the Canadian Charter of Rights and Freedoms guarantees the right to enjoy a reasonable expectation of privacy and protects individuals from arbitrary intrusion by the government into their private lives.  This extends to the collection, use or disclosure of personal information.  The closer the information is to one's  "biographical core"- such as information about one's health, genetic characteristics, sexual orientation, employment, social or religious views, friendships and associations—the greater is the obligation on government to respect and protect the individual's privacy. 

In addition to the privacy rights under sections 7 and 8 of the Canadian Charter of Rights and Freedoms, section 7 rights to life, liberty and security of the person may be engaged when information is shared with other countries. For more information in that regard, see sections 6.9.1 and 6.9.4. 

It is recommended that government institutions consult their legal services to determine whether or not the proposed information sharing initiative may contravene the Canadian Charter of Rights and Freedoms. 

The Canadian Charter of Rights and Freedoms compliance is contextual and needs to be reviewed on a case-by-case basis.  The Legal Services units, as well as specialized groups within the Department of Justice, provide advice on constitutional law, administrative law, the Canadian Charter of Rights and Freedoms, international law, and criminal law in relation to national security and intelligence.

6.6.2 Other Acts of Parliament

The Privacy Act is not the single source of law that regulates the powers that a federal government institution has to collect, use and disclose personal information.  There are other Acts of Parliament that contain statutory provisions that specifically authorize, prohibit or regulate the sharing of personal information.  For example, the Statistics Act authorizes Statistics Canada to enter into agreements with provincial statistical agencies, federal, provincial or municipal government institutions or other corporations.  The Department of Human Resources and Skills Development Act and the Income Tax Act
are other examples of such legislation.

The decision to disclose personal information must be exercised by the designated decision maker in conformity with the lawful authority provided in the particular statute authorizing the disclosure. 

The disclosures provided under subsection 8(2) of the Privacy Act are "Subject to other Acts of Parliament."  The subsection 8(2) disclosures generally do not apply where a statute specifically forbids disclosure of information except in the circumstances provided for by that statute.  

6.6.3 Privacy Act

Assuming the Canadian Charter of Rights and Freedoms and other Acts of Parliament do not prohibit the proposed information-sharing project, an institution should then ensure that the proposed disclosure and/or collection of personal information are in compliance with the Privacy Act.

The Privacy Act and associated TBS policies imposes the following standards relating to collection, accuracy, use, disclosure, retention, and disposition of personal information. 

6.6.3.1 Collection of personal information

The collection of personal information plays an essential role in the administration of government programs and activities.  The general approach of the Privacy Act is to create silos of personal information between federal government programs, and between federal institutions and other jurisdictions, to protect the informational privacy of individuals.  This means that the personal information holdings of each government institution are segregated on a program or activity basis. 

The collection of personal information by federal government institutions subject to the Privacy Act is limited by certain criteria imposed by sections 4 and 5 of the Privacy Act. They are prohibited from collecting personal information unless "directly related to a program or activity of the government institution." Government institutions must collect personal information to be used for an administrative purpose directly from the individual unless an exception in subsections 5(1) and (3) of the Act apply.  Where the personal information is collected directly from the individual, the institution must generally inform the individual of the purpose of the collection (subsection 5 (2).           

Subsections 5(1) and (3) of the Act allow for indirect collection of personal information to be used for an administrative purpose but only in specific and limited circumstances.  The exceptions include where:

1. the individual authorizes the indirect collection of personal information;
2. direct collection is not possible;
3. a government institution can collect personal information from another government organization that is authorized to disclose the personal information to the institution under subsection 8(2); and
4. direct collection might result in the collection of inaccurate information or defeat the purpose, or prejudice the use, for which the personal information is collected.

Though the principle of "minimal collection" is not expressly referred to in the legislation, it is a tenet of the Privacy Act that an institution should collect only the minimum amount of personal information necessary for the intended program or activity.  Institutions should have administrative controls in place to ensure that they do not collect any more personal information than is necessary for the related programs or activities.  They must have parliamentary authority for the relevant program or activity, and a demonstrable need for each piece of personal information collected in order to carry out the program or activity. 

Parliamentary authority will usually be found in an Act of Parliament or subsequent regulations. 

6.6.3.2 Determining the need for consent or notification

Although not the case for the collection of personal information, obtaining the individual's consent for the sharing of personal information is an option that should be considered, where possible.  Many of the privacy issues surrounding disclosure can be avoided if the consent of the individual is obtained beforehand.  This is because consent allows government institutions to use or disclose personal information for any purpose consented to by the individual.  In other words, it removes the need to rely on a specific disclosure provision. 

In some cases, consent may not be needed, for example, under many federal-provincial social programs, it may be necessary that personal information be shared between jurisdictions to determine eligibility to particular program benefits. In such circumstances, it is appropriate to notify the program participants upfront about the sharing as a condition of program enrolment. 

Several factors may need to be weighed before making a determination to seek consent or to notify an individual before disclosing his/her personal information to another organization.  Consent should generally only be sought when there is a genuine opportunity to refuse and there is no legitimate and compelling reason for disclosing without consent.  Moreover, if there are reasonable grounds to suspect that seeking consent or notifying the individual could undermine the legitimate purpose for which the information is being sought, it might be inappropriate to seek consent or to notify the individual in question about the disclosure.  Legal advice should be sought in any case of doubt. 

Disclosure without consent must only be made in accordance with subsection 8(2) of the Privacy Act. It is recommended that the following factors, which are based on the invasion-of-privacy test found in the Treasury Board Manual on Privacy and Data Protection, be considered when making a determination to disclose without consent.

1) Expectations of the individual:  The conditions which governed the original collection of the personal information and the expectations of the individual to whom it relates are important criteria to consider before making a decision to disclose the information.  Was the information compiled or obtained under guarantees which preclude some or all types of disclosures?  Or, on the other hand, can the information be considered to have been unsolicited or given freely or voluntarily with little expectation of it being maintained in total confidence?  Has the individual made a version of the information generally available to the public and thus waived the right to privacy in these circumstances?

2) Sensitivity of the information:  It should be determined what type of information is involved in the information-sharing project.  Is it obviously of a highly sensitive personal nature or does it appear to be fairly innocuous information?  Is the information very current and for that reason more sensitive, or has the passage of time possibly reduced that sensitivity so that disclosure under specific circumstances would lead to no measurable injury to the individual's privacy?  On the other hand, could disclosure of the information after a passage of time simply re-open old wounds?

3) Probability of injury:  If the information is considered sensitive, can it be surmised that the particular disclosure carries with it the probability of causing measurable injury?  Injury should be interpreted as any harm or embarrassment that will have direct negative effects on an individual's career, reputation, financial position, safety, health or well-being.  As well, the organization may wish to take into account whether the intended disclosure would make the personal information available for a decision-making process by a government institution beyond that for which it is being disclosed.

It is a good practice to adequately document in the agreement the justification for not seeking consent or the procedures for obtaining consent, or for notifying individuals of a disclosure. 

6.6.3.3 Accuracy of personal information

Subsection 6(2) of the Privacy Act requires a government institution to take all reasonable steps to ensure that the personal information it collects for an administrative purpose is as accurate, up-to-date, and as complete as possible.  This is to minimize the possibility that a decision affecting an individual, for example determining clients' eligibility for benefits, would be made on the basis of inaccurate, obsolete, or incomplete information

It is important that parties to an agreement base administrative actions on current personal information.  To this end, the agreement could contain a provision that imposes an obligation that each party notify the other without delay, if it becomes aware personal information shared is not accurate, complete, and up-to-date.  This is especially important where the impact on individuals might be high.  In this regard, the agreement could contain a provision whereby the parties consent to review any administrative actions taken on the basis of the incorrect information provided.

6.6.3.4 Use of personal information

Once collected, section 7 of the Privacy Act permits personal information to be used by a federal government institution:

• with the consent of the individual to whom the information relates;
• for the purpose for which it was collected or consistent use; or
• for another purpose if section 8 (2) of the Privacy Act is met.

For example, if an organization collected personal information from another organization for a particular purpose (i.e. program "A"), it should not use it for another purpose (i.e. program "B") without the individual's consent or evidence that it is for the same purpose, a consistent use (discussed below) or the other purpose comes within the terms of subsection 8(2) of the Privacy Act.

6.6.3.5 Disclosure of personal information

Section 8 of the Privacy Act states that subject to other Acts of Parliament, personal information under the control of a government institution cannot be disclosed without the consent of the individual to whom the information relates, unless the disclosure is permitted under subsection 8(2).  This subsection of the Act outlines thirteen circumstances where personal information may be disclosed without consent.  All subsection 8(2) disclosure provisions are discretionary.

Although a number of responsibilities under the Privacy Act  may be delegated, such delegation must be approved by the head of the government institution.  An institution's Designation Order should list the positions of the officials within the institution who have been delegated such responsibilities. 

As for those sections of the Privacy Act that authorize disclosure and which do not specify who must make the decision, the Interpretation Act provides that the decision must be made by an "appropriate" official.  Although there is no particular rule about who the appropriate official should be, it is important that an appropriate official be identified as having made the decision to authorize the disclosure, for the purposes of accountability and transparency.

Where a government institution or the appropriate designated official has decided to make a disclosure, it should respect the security policy principle that only persons with a need to know the information are permitted to have access to the information. 

The following describes the most commonly cited provisions of subsection 8(2) that are used by government institutions to share personal information with another level of government without the consent of the individual concerned.

Paragraph 8(2) (a) – Original purpose and consistent use:  This paragraph gives government institutions the discretion to disclose personal information where it is necessary to accomplish the purpose for which the information was obtained or compiled or for a use consistent with that purpose. 

A test of whether a proposed use or disclosure is consistent is whether it would be reasonable for the individual who provided the information to expect that it would be used in the proposed manner.  This means that the original purpose and the proposed purpose are so closely related that the individual would expect that the information would be used for the consistent purpose, even if the use is not spelled out. 

Section 11 of the Privacy Act requires that the description of personal information banks contained in Info Source include a statement of the consistent uses for which the information may be used or disclosed.  Subsection 9(4) of the Act requires that institutions notify the federal Privacy Commissioner whenever personal information is used or disclosed in a manner consistent with the purpose(s) for which the information was obtained or compiled, but which is not included in Info Source.  This subsection also requires that the institution ensure the consistent use is added to the relevant personal information bank description in Info Source.

Paragraph 8(2)(b) – Act of Parliament or regulations:  This paragraph provides that personal information may be disclosed for any purpose in accordance with any Act of Parliament or any regulations made thereunder that authorizes the disclosure.  This paragraph encompasses all other authorities for the disclosure of personal information contained in federal statutes.  For example, the Bankruptcy and Insolvency Act allows the Superintendent of Bankruptcy to maintain a public record of bankruptcies and to provide the information upon request and payment of the prescribed fee. Where personal information has been disclosed under a statutory authority, it is recommended that the description of the relevant PIB in Info Source include or be amended to include:

1. a reference to the statutory authority and/or regulations governing disclosure;
2. a brief description of the type of information disclosed;
3. the purpose of the disclosure;
4. who has received the information; and
5. any conditions respecting the use of the information.

Paragraph 8(2)(f) – Provinces, foreign states and international bodies:  This paragraph allows personal information to be shared with provincial and foreign governments and international bodies for administering or enforcing any law or carrying out any lawful investigation, when the sharing is carried out under the terms of an agreement or arrangement. 

For example, this provision may accommodate practices whereby personal information is exchanged between police forces, security and investigative bodies and their counterparts, both domestically and internationally, for law-enforcement purposes.  The provision also aids in administering laws. 

Where an institution will regularly exchange personal information under this provision, it is recommended that a written agreement be established. 

There are other discretionary disclosures provisions under subsection 8(2) that may be used to disclose personal information to another government organization.  These types of disclosure may be handled and documented on a case-by-case basis:

• Paragraph 8(2)(c) - Subpoenas, warrants, court orders and rules of procedure of the courts of law:  This paragraph permits a federal government institution to disclose personal information "for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body with jurisdiction to compel the production of information."  Government institutions should consult with legal advisors to ensure the validity of the subpoena and the proper form of compliance.  When such records do not become part of the court's records, the government institution should request their return, either for proper disposition or re-integration into its filing system.
• Paragraph 8(2)(j) – Research and statistical purpose:  This paragraph authorizes the head of a government institution to disclose personal information to any person or body for research or statistical purposes, if the head of the government institution having control of the records is satisfied that it is essential for the purpose of the research project.  The researcher, in turn, is required to sign a written undertaking that the information will not subsequently be disclosed in a form that could reasonably be expected to identify the individuals to whom it relates. ^[3]

When considering the discretion to disclose personal information under paragraph 8(2)(j), it is recommended that government institutions take into account the sensitivity of the information and other factors set out in the invasion-of-privacy test found in chapter 2-4 of  the Treasury Board Manual on Privacy and Data Protection 

The Treasury Board Manual on Privacy and Data Protection (refer to chapter2-4)recommends that research privileges be withdrawn from any person or body discovered to be improperly disclosing personal information obtained or produced as a result of a disclosure under the research and statistical purposes provision in paragraph 8(2)(j) of the Privacy Act.  This may mean taking immediate steps to prevent further disclosure of the personal information. 

• Paragraph 8(2(k) – Native claims research:  This paragraph provides that personal information may be disclosed to any aboriginal government, association of aboriginal people, Indian band, government institution or part thereof, or to any person acting on behalf of such government, association, band, institution or part thereof, for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada.

This permits the disclosure of personal information to researchers acting on behalf of the entities listed where they are involved in the process of settling native claims.  Researchers must be accredited to undertake such research and must sign a written agreement holding them formally accountable for the protection of individual privacy.  The Research Application and Undertaking Form may be used as an ISA for that purpose. 

In exercising discretion to disclose personal information under the native claim research provision, it is recommended that government institutions take into account the sensitivity of the information and other factors set out in the invasion-of-privacy test.  A version of the test is available in chapter 2-4 of the Treasury Board Manual on Privacy and Data Protection.

• Sub-paragraph 8(2)(m)(i) – Public Interest, or 8(2)(m)(ii) – Individual Benefit:  As a supplement to the specific disclosure provisions described above, personal information may be disclosed for any purpose where, in the opinion of the head of an institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure (sub-paragraph 8(2)(m)(i)), or the disclosure would clearly benefit the individual to whom the information relates (sub-paragraph 8(2)(m)(ii)). 

These disclosure provisions should be used with a good deal of restraint and their use should be recorded carefully.

Heads of a federal government institution who receive requests for disclosure of personal information under this provision should consider the matter by weighing the public interest in disclosure against any invasion of privacy that could result from the disclosure.  The decision whether or not to disclose information should balance the public interest in disclosure against the threat to an individual's privacy.  This balancing should be based on an invasion-of-privacy test. A version of the test is available in chapter 2-4 of the Treasury Board Manual on Privacy and Data Protection.

Under subsection 8(5) of the Privacy Act, the institution must notify the Privacy Commissioner that it will be disclosing personal information in the public interest.  The Commissioner may express concerns with the proposed disclosure and may, if the Commissioner thinks it appropriate, notify the individual whose information will be disclosed.  However, the decision to release the information in the public interest, and how much to release, rests solely with the head of the institution (or the designate under section 73).  The Privacy Commissioner has no authority to prevent the disclosure.

Additional guidance about this provision, including some examples of limited and specific situations where it might be used, is available in chapter 2-4 of the Treasury Board Manual on Privacy and Data Protection. 

6.6.3.6 Retention and disposition of personal information

Retention of personal information:  In accordance with subsection 6(1) of the
Privacy Act and subsection 4(1) of the Regulations, personal information that has been used by a government institution for an administrative purpose shall be retained by that government institution for at least two years following the last use of the information, unless the subject individual consents to its earlier disposition.  The Act also requires that where a request for access to personal information has been received, the institution should retain the information until such time as the individual has had the opportunity to exercise all rights under the law (e.g. rights to complain, to apply for judicial review, etc.).  The obligation to retain personal records would equally apply where the records are relevant to an Access to Information Act request. 

Similarly, where a request for disclosure of personal information to federal investigative bodies specified in the Privacy Regulations has been made under paragraph 8(2) (e) of the Privacy Act, subsection 8(4) of the Act and section 7 of the Regulations require that any information disclosed in response to the request be retained for a minimum of two years following the date the request was received by the disclosing institution.  A separate PIB in Info Source must be maintained for all such records of disclosure and the records must be made available to the Privacy Commissioner on request. 

There are exceptions to the principle of retention.  For example, where an emergency exists at a diplomatic or consular mission abroad, the officer in charge could be authorized to order the destruction of personal information to prevent the removal of the information from the control of the institution.  As well, the disposition of personal information prior to the expiration of the minimum retention period could be allowed with the written consent of the individual to whom the information relates.  This might occur, for example, if the information were determined to be incorrect and if the most appropriate means of correction were disposition, or if the information were no longer required. 

In accordance with the Library and Archives of Canada Act, the Librarian and Archivist of Canada authorizes the disposition of government records by issuing one of the following types of Records Disposition Authorities (RDAs):

• Multi-Institutional Disposition Authorities (MIDA) relate to records managed by all or a multiple number of government institutions, and allow the institutions to dispose of records under certain terms and conditions;
• Institution-Specific Disposition Authorities (ISDAs) relate to records managed by a single government institution, and allow the institution to dispose of their records under certain terms and conditions.

The Records Disposition Authorities Control System (RDACS) is an information system that contains summary descriptions of Records Disposition Authorities granted by the Librarian and Archivist to federal institutions, as well as online copies of relevant documentation.  It includes descriptions of more than 2,200 authorities. RDACS is available to federal institutions at http://rdacs-syscad.lac-bac.gc.ca/index_en.html.

The Librarian and Archivist of Canada may determine that records containing personal information have archival or historical value.  In such cases, procedures should be established to ensure the retention and transfer of those records to Library and Archives Canada.

Disposition of personal information: The disposition of personal information is regulated by subsection 6(3) of the Privacy Act and the Library and Archives of Canada Act. 

Subsection 6(3) provides that a government institution shall dispose of personal information "in accordance with the regulations and in accordance with any directives or guidelines issued by the designated minister in relation to the disposition of such information." 

In addition to the requirements of the Library and Archives of Canada Act and the Privacy Act regarding the retention and disposition of records containing personal information, the Access to Information Act makes it an offence to destroy or conceal a record with intent to deny a right of access under this Act.  Under subsection 67.1(1) of the Act "No person shall, with intent to deny a right of access under this Act,

1. destroy, mutilate or alter a record;
2. falsify a record or make a false record;
3. conceal a record; or
4. direct, propose, counsel or cause any person in any manner to do anything mentioned in any of paragraphs (a) to (c)."

The Privacy Regulations require that personal information used for an administrative purpose be retained for a minimum of two years.  There may be other retention obligations, for example, if a person files a request for information either under the Access to Information Act or the Privacy Act, the information cannot be disposed of until such time as the person has had the opportunity to exercise all of his/her rights under that Act.

The disposition methods chosen will depend on factors such as the sensitivity of the information, how much information is to be destroyed, and the form in which it is recorded.

6.6.4 Protection of personal information

In accordance with the Privacy Act ^[4] and Regulations and related Treasury Board Secretariat policies, a federal government institution must take every reasonable precaution to protect the security and confidentiality of personal information under its control by ensuring that organizational, physical and technological safeguards and controls have been put in place and are maintained.

The nature of the safeguards used to protect personal information from both external and internal sources will vary depending on the sensitivity of the information that has been collected; the amount, distribution and format of the information; the method of storage; and the harm or injury that would arise from a breach of security.  More sensitive information will be safeguarded by a higher level of protection.  To this end, government institutions should follow the requirements of the Policy on Government Security and other associated standards and directives, if applicable. Other institutions should refer to their own internal security policies and procedures.   

For example, the methods of protection could include the following:

• Administrative measures: policies and procedures to protect the privacy and security of personal information, staff training on privacy, limiting access to information on a "need-to-know" basis, and the reliability of employees having access to the information.
• Technical measures: passwords, audit trails, encryption, firewalls and other technical security safeguards to minimize the risk of unauthorized individuals accessing personal information.
• Physical measures: such as locked files, restricted access to offices and other areas where personal information is stored.

Moreover, the safeguards should take into account actions that may need to be taken to respond to security or privacy breaches, including the notification of affected parties.  For more information in that regard, please consult the TBS Guidelines for Privacy Breaches.

6.7 Ensuring policy compliance

6.7.1 TBS Policy on Privacy Protection

The TBS Policy on Privacy Protection states that heads of government institutions, or their delegates, are responsible for:

• establishing measures, when personal information is involved, to ensure that the government institution meets the requirements of the Privacy Act when contracting with private sector organizations, or when establishing agreements or arrangements with public sector organizations; and
• ensuring that appropriate privacy protection clauses are included in contracts or agreements that may involve intergovernmental or transborder flows of personal information.

The Policy also requires that institutions establish a privacy protocol for the collection, use or disclosure of personal information for non-administrative purposes, including research, statistical, audit, and evaluation purposes.  Such a protocol could be used in information sharing initiatives for non-administrative purposes, between federal government institutions or programs of the same institution, as well as other government jurisdictions, within and outside of Canada.

6.7.2 TBS Directive on Privacy Impact Assessment

The TBS Directive on Privacy Impact Assessment supports the President of the Treasury Board's responsibilities by ensuring that privacy implications will be appropriately identified, assessed and resolved before a new or substantially modified program or activity involving personal information is implemented.

The Directive requires that an institution conduct a Privacy Impact Assessment (PIA): 

• when personal information is used for or is intended to be used as part of a decision-making process that directly affects the individual;
• upon substantial modifications to existing programs or activities where personal information is used or intended to be used for an administrative purpose; and
• when contracting out or transferring a program or activities to another level of government or the private sector results in substantial modifications to the program or activities.

The sharing of personal information with other organizations will trigger the requirement for a PIA unless the sharing is intended for a non-administrative purpose, in which case the institution could follow an internal protocol for the collection, use or disclosure of personal information for non-administrative purposes.  

Government institutions must submit their final PIA reports to the Office of the Privacy Commissioner (OPC).  The OPC may provide comments and recommendations to the institution.  However, the final decision on whether or not to implement any OPC recommendations rests with the institution.

6.7.3 TBS Directive on the Social Insurance Number (SIN)

The Privacy Act does not expressly refer to the Social Insurance Number and does not create special rules for its collection, use and disclosure compared with other types of personal information.  However, like any other identifying number, the Social Insurance Number falls within the definition of personal information under the Privacy Act.

If the Social Insurance Number is to be used to permit the exchange of personal information between parties, such a use must be lawful and in compliance with the TBS Directive on the Social Insurance Number, which outlines specific restrictions on the collection, use, and disclosure of the Social Insurance Number by government institutions and specifies the processes for establishing policy authorization for a new collection or use. 

6.7.4 TBS Directive on Privacy Practices

Under the Policy on Privacy Protection, heads of government institutions are to establish practices for the management and protection of personal information under their control to ensure that the Privacy Act is administered in a consistent and fair manner.  The TBS Directive on Privacy Practices supports the policy by setting out the requirements for sound privacy practices and management of personal information.  Taken together, the Policy on Privacy Protection and its related directives and guidelines are the instruments upon which a sound privacy management strategy within government institutions is structured.

The Directive specifies that institutions adhere to the following requirements when personal information is being disclosed to another public or private sector institution, including another government institution:

• The privacy notice reflects, as appropriate, the disclosure;
• An agreement or arrangement with appropriate safeguards has been established between the government institution and the public sector entity, whether that entity is international, federal, provincial or territorial, or municipal.

6.7.5 Government's Treaty Policy

In February 2008, the Government announced its Treaty Policy, which can be found at http://www.treaty-accord.gc.ca/procedure.asp.  The objective of the policy is to ensure that all instruments governed by public international law, between Canada and other states or international organizations, are tabled in the House of Commons following their signature or adoption by other procedure and prior to Canada formally notifying that it is bound by the Instrument. 

The policy makes all departments responsible 'for informing the Treaty Section of the Department of Foreign Affairs and International Trade before beginning any negotiations with another State, whether with its government as such or with one of its agencies, or with an international organization.  In this way a proper distinction between treaties and other international instruments that are not binding in public international law can be maintained.  If a treaty is to be negotiated, a Memorandum to Cabinet to obtain a negotiating mandate will be required. Departments are responsible for ensuring the Treaty Division has sufficient lead time to verify the texts in all languages and to ensure that proper government authority is obtained before Canada signs the treaty or expresses its consent to be bound by it.

The Legal Branch of the Department of Foreign Affairs and International Trade provides advice on international law, including treaty law, and is responsible for ensuring compliance with the Government's Tabling of Treaties in Parliament Policy. Departments are responsible for ensuring that legal advice is sought.

6.8 Assessing the risks

In addition to ensuring that they have the legal authority to carry out their proposed information-sharing projects, federal government institutions should also ensure that any privacy and security risks that may be associated with such initiatives are addressed, mitigated, or eliminated before entering into any agreements to share personal information.

Assessing privacy and security risks can be done in a systemic and consistent manner though the completion of a Privacy Impact Assessment (PIA) or a Threat and Risk Assessment (TRA) where applicable.  These risk management tools, which are described hereunder, have proven to be effective in ensuring this is achieved.

Privacy Impact Assessment (PIAs):

A PIA is first and foremost a tool that provides decision makers with a logical framework to: 

• identify potential privacy issues relating to a given proposal by assessing the proposal's compliance with privacy protection legislation, policies and principles;
• forecast the probable impacts associated with issues or non-compliance; and
• identify actions and strategies to eliminate or reduce privacy risks.

As previously indicated, under the TBS Directive on Privacy Impact Assessment, institutions are required to conduct a PIA under certain circumstances, including when personal information is shared between programs, institutions or jurisdictions.  The Privacy Impact Assessment will help to ensure that the information-sharing activity is compliant with the Privacy Act and that measures are implemented to mitigate potential privacy risks, including the establishment of an ISA, which contains clauses to that end.  

Threat and Risk Assessment (TRA):

When sharing personal data, the parties should strive to maintain administrative, technical and physical safeguards to protect the privacy of individuals and the confidentiality of their personal information.  The conduct of a TRA is a recognized process used by federal government institutions to determine any potential threat or hazard that may endanger the confidentiality, security, or integrity of the personal data to be shared.  TRAs can be short and simple or far more detailed and rigorous, depending on the sensitivity, criticality, and complexity of the program, system or service being assessed.  When warranted, the other parties involved in the information-sharing project could also be required to conduct a similar risk assessment process to evaluate the potential threats and risks to the information, as a pre-condition of sharing.

Once a threat and risk assessment has been completed, the parties to the agreement should normally take the necessary steps to develop or adopt, implement, or maintain the administrative, technical, and physical safeguards necessary to protect the personal data to be shared.  As a best practice, these measures should be implemented before any information is shared.  To this end, organizations may wish to require confirmation that such safeguards are implemented and periodically reviewed to ensure protection of the information.

6.9 Trans-border considerations

6.9.1 Increased privacy risks

Personal information is well protected in the public sector in Canada.  The federal government and all of Canada's provinces and territories have respective privacy legislation that applies to the collection, use and disclosure of personal information under their control.  Most municipalities are subject to provincial or territorial privacy legislation.  These various acts are largely based on common privacy principles and standards.  Although not all regimes within provinces and territories have equivalent privacy provisions to those given under the federal Privacy Act, all offer privacy protection when exchanging personal information with federal, provincial, territorial, and municipal government institutions in Canada.

However, Canadian privacy laws do not apply to personal information once it has been disclosed to a foreign government organization (referred to as trans-border data flows).  It is understood that this will involve negotiation but it is crucial that written agreements with international partners take into consideration the protection of personal information. Privacy risks associated with the sharing of personal information with foreign countries are generally considered higher risks than when sharing personal information with a Canadian party.  Such risks are particularly significant when the foreign organization is not bound by privacy legislation or a binding scheme that is substantially similar to the federal Privacy Act.   

Before disclosing personal data, federal institutions may wish to satisfy themselves that the receiving country will provide an adequate level of protection.  The adequacy of the level of privacy protection afforded by the other country may be determined by an examination of a number of factors including, the nature and sensitivity of the data, the purpose of the disclosure, the rules of law, and security measures which will be used to protect the information in the other country. 

Since there may be laws in the other jurisdiction that have legal implications on trans-border data flows, it is recommended that federal government institutions consult with their legal services to ensure that the type of ISA to be entered into with a foreign country conforms to Canadian law and practices.  In addition, the Department of Foreign Affairs and International Trade must be consulted prior to beginning any negotiations with another State, whether with its government as such or with one of its agencies, or with an international organization, in order to ensure any agreement or arrangement is consistent with Canadian foreign policy objectives and with Canada's obligations under international law, including international human rights law, as well as to ensure a proper distinction between treaties and other international instruments that are not binding in public international law.

Similarly, Canadian Charter of Rights and Freedoms implications may be involved.  Although the Canadian Charter of Rights and Freedoms does not generally apply extraterritorially (i.e. its protections are lost in respect of subsequent uses of the information by foreign officials), it does apply to constrain the actions of Canadian officials involved in the information sharing process.  The reasonably foreseeable consequences of sharing information with foreign officials may raise Canadian Charter of Rights and Freedoms issues in respect of the actions of the Canadian officials involved if, for example, the sharing could result in potential human rights violations such as torture, unlawful detention, or unwarranted additions to no-fly lists.  It is therefore recommended that Canadian Charter of Rights and Freedoms experts also be consulted before entering into ISAs with foreign countries. 

6.9.2 Existing international agreements 

Canada is a signatory to numerous bila teral or multilateral international treaties with other countries, dealing with such subjects as extradition, mutual legal assistance in criminal matters, taxation, pensions, and immigration.  These treaties often involve the exchange of personal information between the respective governments. 

The Treaty Section of the Department of Foreign Affairs and International Trade provides an on-line resource for researching treaties for which Canada is a signatory.  The on-line resource also provides detailed information on the Government's Treaty Policy, including the steps Departments need to take to obtain an appropriate mandate to negotiate an agreement or arrangement with a foreign state.   

As an example, the Canadian Security Intelligence Service Act permits the Service (known as CSIS), if it has the approval of the appropriate Minister and after consultation with the Minister of Foreign Affairs, to enter arrangements or cooperate with the government of a foreign state, an institution of that state, or an international organization of states.  Clearly, this cooperation could involve the transfer of personal information about Canadians. 

In addition, many foreign government authorities use mutual legal assistance treaties and other trans-national information sharing mechanisms in order to obtain the information from a federal government institution.  A Mutual Legal Assistance Treaty (MLAT) permits law enforcement authorities of one country to request assistance from another to obtain records and other evidence relating to an investigation or the prosecution of offences.  Canada's Mutual Legal Assistance in Criminal Matters Act (MLACMA) came into force in 1990. 

6.9.3 Potential privacy risks posed by anti-terrorism legislation

Another issue arising out of international ISAs is that there may be potential privacy risks posed by anti-terrorism legislation in the foreign country.  This could mean, for example, that a foreign law could circumvent restrictions or caveats imposed by the disclosing organization on further use or disclosure of personal information.  Many foreign countries have anti-terrorism laws and security measures that contain powers similar to those of the USA PATRIOT Act.  In such cases, a federal institution may wish to impose added conditions on the recipient, such as segregating the shared data from its other records or advising Canada whenever the information is to be disclosed under foreign law, if that is possible.

6.9.4 Human rights considerations

There is no doubt that federal government institutions must share or exchange personal information with other countries on law enforcement and national security matters.  However, this does not mean that the collection, use and disclosure of such information have to affect individuals unfairly or put them at risk.  Canada must consider whether information received from a foreign country is the result of human rights violations under domestic or international law and whether personal information disclosed to that country results in such abuses.  If such questions arise, institutions should contact their departmental legal services unit. 

The relevance of domestic and international laws affecting personal information and human rights may need to be taken into account when sharing personal information with a foreign country.  For example, prior to collecting any information from a foreign country, federal government institutions may wish to ascertain whether the personal data to be collected has been obtained and processed by that organization in a manner consistent with Canada's domestic and international human rights obligations and values and with adequate notice or consent. 

Moreover, although the primary Canadian Charter of Rights and Freedoms issues that arise out of ISAs relate to privacy rights under section 8, where information is shared with states that have weaker human rights protections in place than Canada, the rights to life, liberty and security of the person under section 7 may also be triggered.  The Canadian Charter of Rights and Freedoms does not generally apply extraterritorially (i.e. its protections are lost in respect of subsequent uses of the information by foreign officials); however, it does apply to constrain the actions of Canadian officials involved in the information sharing process.  The reasonably foreseeable consequences of sharing information with foreign officials may raise Canadian Charter of Rights and Freedoms issues in respect of the actions of the Canadian officials involved if, for example, the sharing could result in potential human rights violations such as torture, unlawful detention or unwarranted additions to no-fly lists.  It is therefore recommended that Canadian Charter of Rights and Freedoms experts be consulted in such cases.  Further, information sharing may give rise to considerations under international human rights law.  The Department of Foreign Affairs and International Trade should be consulted with respect to Canada's international human rights obligations in this regard.  

Information sharing with foreign countries has been one of the topics studied in depth by the Commission of Inquiry into the Actions of Canadian Officials in Relation to
Maher Arar.  Some of the issues described by the Commission may be worth considering both in determining whether to share personal information and what possible restrictions to include in an ISA with a foreign country. 

In Chapter IX of his September 2006 Report on the Events relating to Maher Arar: Analysis and Recommendations, Justice O'Connor made several recommendations respecting the process to be followed when Canadian officials deal with countries with questionable human rights practices.  For example, he recommended that decisions to receive information from such a country be made on a case-by-case basis, in a manner that allows for accountability.  Canadian officials should always exercise caution to avoid taking action that appears to condone or encourage human rights abuses. 

In its report entitled Main Report of the Special Senate Committee on the Anti-Terrorism Act released in February 2007, the Special Senate Committee on the Anti-Terrorism Act recommended that the government put ISAs in relation to national security investigations in writing; ensure that Canadian law enforcement and security agencies attach written caveats regarding the use of shared information; require Canadian agencies to make formal complaints to foreign agencies regarding the misuse of shared information; and produce annual reports assessing the human rights records of various countries (recommendation #25). 

More specifically, the Committee would like the government to implement recommendations 2, 9, 12 and 13 of Justice O'Connor's September 2006 report, not only with respect to information sharing by the Royal Canadian Mounted Police, but with respect to information sharing by any Canadian agency involved in protecting national security.  These recommendations are paraphrased hereunder.

• Recommendation 2 of Justice O'Connor's September 2006 report suggests that co-operative or integrated arrangements in relation to national security investigations be reduced to writing. 
• Recommendation 9 states that the Royal Canadian Mounted Police should never share information in a national security investigation without attaching written caveats respecting who can have access to the information and how the information is to be used. 
• Recommendation 12 states that where Canadian agencies become aware that foreign agencies have made improper use of information provided by Canadian agencies, they should file a formal objection. 
• Finally, Recommendation 13 states that the Department of Foreign Affairs and International Trade should provide annual reports to the Royal Canadian Mounted Police and Canadian Security Intelligence Service assessing the human rights records of various countries, to assist these organizations in evaluating whether, and on what basis, they should continue to share information with agencies of these countries.

Once personal information has been shared or exchanged with a country that does not have any laws that protect privacy, human rights or civil liberties, it may become difficult, if not impossible, to ensure treatment of that information in a manner consistent with Canadian constitutional rights and values.  The legal power of Canadian courts and the federal government to require respect of constitutional rights and freedoms under the Canadian Charter of Rights and Freedoms can only be legally exercised within Canada's territorial borders. 

6.10 Audit provisions

Auditing processes help ensure that parties to an agreement adhere to the terms and conditions of the agreements.  While it may be impractical for the Canadian government to perform audits of another country's personal information management practices, it is not unreasonable to request that the other country provide information to the other detailing the internal controls adopted for protecting personal information and/orperform privacy and security audits and provide copies of its audit reports at fixed regular intervals.  Some institutions may even wish to request specific audits, according to a pre-determined schedule.

6.11 Other provisions

The agreement may include other provisions that are not directly related to privacy issues but should nevertheless be addressed / considered.  The following items are meant as examples only.

6.11.1 Conflict resolution

In the event of questions, challenges or disagreements related to any issue connected to an agreement, it is recommended that clauses be included to provide a mechanism for conflict resolution.  

For example, the agreement may also include a clause that allows for the appointment of a conciliator to resolve disputes.  Additional clauses may be used if the parties wish to have a legally-binding agreement that is enforceable in a court of law.  In such a case, the institution should consult its legal services.

Of course, before using a formal mechanism, it is recommended that the parties involved try to resolve issues between senior officials of their respective organizations.

6.11.2 Signatures

An agreement should include the date, names, titles, and signatures of the authorized officials of all parties involved in the sharing initiative.

• Previous Page
• Table of Contents
• Next Page