This chapter relates to the forms used in the processing of requests under
the Privacy Act as well as forms related to the use or disclosure of personal
information for other purposes and the administration of the Privacy Act within
the institution.
In most cases, the use of the specified form is not mandatory as long as the
minimum content requirements are satisfied.
A consent for use or disclosure form must contain:
- a description of the type of personal information to which the consent refers;
- a statement of the intended new use or disclosure of that information;
- a listing of the government institutions, persons, groups of persons or organizations to which disclosure will be made, if applicable;
- instructions that the acceptance or refusal of consent must be indicated appropriately on the form and that the form must be signed and returned;
- a statement that refusal to consent will not result in any adverse decision about the individual in conjunction with the purposes being served by the new use; and
- an indication that the individual has the right to examine the record and to request correction of his or her record.
A Research Application and Undertaking Form should contain:
- the name and address of the researcher and, where applicable, his or her institutional or organizational affiliation;
- a general description of the research project;
- a description of the type or class of information to which access is requested;
- an undertaking that no subsequent disclosure of the information in a form that could reasonably be expected to identify the individual to whom it relates will be made to any other person or third party which is not participating in the research project;
- a statement that no further personal information will be provided to the researcher if this agreement is violated; and
- the signature of the researcher.
In cases where particularly sensitive and/or current personal information is
being used for research or statistical purposes, the government institution may
wish to attach an addenda to the Research Application and Undertaking Form
comprised of:
- a statement concerning the access conditions and criteria imposed on
researchers using the information, including:
- an undertaking that the information will be rendered anonymous (i.e. coded,
name-stripped) at the earliest time possible;
- a list of any data linkages which have been approved and an undertaking
not to perform other matches without written authorization; and
- an undertaking not to contact the data subjects unless specifically
authorized to do so. If the researchers are so authorized, to guarantee any
additional information obtained from those individuals the same level of
confidentiality as maintained for the original data;
- a statement regarding the location where data or copies of the records
will be consulted or used:
- if within a federal government institution, a statement regarding the
various Acts and regulations to be complied with and any oaths to be sworn
by the researcher(s) should be included.
- if in another institution or organization, the conditions governing the
transfer and secure storage of the data should be stipulated.
- a statement regarding the conditions governing disposal of
identifiable personal data stored outside a federal government institution and,
if desirable and applicable, the archival arrangements for working data and the
relevant programs, codes and guides;
- a statement providing the institution with the right to examine any
results or reports in order to verify that there has been no compromise of the
personal information; and
- the signature of the appropriate officer(s) in the government
institution(s) and all principals involved in the research or statistical
project.
Such agreements must contain:
- a description of the personal information to be shared;
- the purposes for which the information is being shared and is being used;
- a statement of all the administrative, technical and physical safeguards
required to protect the confidentiality of the information, especially in
regard to its use and disclosure
- a statement specifying whether information received by the federal
government will be subject to the provisions of the Privacy Act (ie. whether
access to the information may be given to the subject individuals, and, if
not, what exemption the supplier would recommend);
- a statement specifying whether information disclosed by the federal
government would be subject to the provisions of the Privacy Act (ie.
whether the receiving institution may give the subject individuals access to
the information);
- a statement that the sharing of the information shall cease if the
recipient is discovered to be improperly disclosing the shared personal
information; and
- the names, titles and signatures of the appropriate officials in both the
supplying and receiving institutions and the date of the agreement.
A request by an investigative body (as specified in the regulations) for
disclosure of personal information under paragraph 8(2)(e) of the Privacy Act
will normally be made on the form entitled "Request for Disclosure to
Federal Investigative Bodies" (TBC 350-56 (83/2)) (Appendix C). If the form
is not used, the request must include:
- the name of the investigative body;
- the name of the individual who is the subject of the request, or some
other personal identifier;
- a description of the requested information;
- the section of the federal or provincial statute under which the
investigative activity is being undertaken; and
- the name, title and signature of the requesting member of the
investigative body.
The institution receiving the request for disclosure must indicate clearly on
the request whether the request has been accepted or refused, the date, the
personal information banks in which the disclosed information is held, the name,
title and signature of the official who is responding to the request, and the
name of the institution.