| |||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
 |
| ||||||||||||||||||||||||||||||||||||
 |
|||||||||||||||||||||||||||||||||||||
|
Vol. 139, No. 25 — December 14, 2005 Registration PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT Health Information Custodians in the Province of Ontario Exemption Order P.C. 2005-2224 November 28, 2005 Whereas the Governor in Council is satisfied that the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Schedule A, of the Province of Ontario, which is substantially similar to Part 1 of the Personal Information Protection and Electronic Documents Act (see footnote a), applies to the health information custodians referred to in the annexed Order; Therefore, Her Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to paragraph 26(2)(b) of the Personal Information Protection and Electronic Documents Act (see footnote b), hereby makes the annexed Health Information Custodians in the Province of Ontario Exemption Order. HEALTH INFORMATION CUSTODIANS IN THE PROVINCE OF ONTARIO EXEMPTION ORDER EXEMPTION 1. Any health information custodian to which the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Schedule A, applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act in respect of the collection, use and disclosure of personal information that occurs within the Province of Ontario. COMING INTO FORCE 2. This Order comes into force on the day on which it is registered. REGULATORY IMPACT ANALYSIS STATEMENT (This statement is not part of the Order.) Description Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. Part 1 of the Act was implemented in two stages. On January 1, 2001, the Act applied to the collection, use and disclosure of personal information in connection with the operation of federal works, undertakings or businesses and to the disclosure of personal information for consideration outside a province. On January 1, 2004, the Act's reach was extended to all collections, uses and disclosures of personal information in the course of commercial activity, either within, or outside a province. Pursuant to paragraph 26(2)(b) of the Act, the Governor in Council may, by order, if satisfied that legislation of a province that is substantially similar to PIPEDA applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of PIPEDA in respect of the collection, use and disclosure of personal information within the province. Under the trade and commerce power conferred on Parliament by subsection 91(2) of the Constitution Act, 1867, PIPEDA establishes a set of economy-wide principles and rules for the protection of personal information. The Act helps to build trust and confidence in the Canadian marketplace, while encouraging provinces and territories to develop their own privacy laws in a manner that addresses their particular needs and circumstances. To this end, the Government of Canada included provisions in PIPEDA to exempt from the federal Act organizations or activities subject to provincial or territorial laws that are deemed to be substantially similar. On August 3, 2002, Industry Canada published the policy and criteria used to determine whether provincial or territorial legislation would be considered as substantially similar to the PIPEDA. The federal Act provides a standard around which provinces can legislate. Under the policy, laws that are substantially similar: provide privacy protection that is consistent with and equivalent to that in the federal Act; incorporate the ten principles in the National Standard of Canada entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96, found in Schedule 1 of PIPEDA; provide for an independent and effective oversight and redress mechanism with powers to investigate; and restrict the collection, use and disclosure of personal information to purposes that are appropriate or legitimate. In recognizing such laws as substantially similar, PIPEDA provides a common standard for privacy protection across both federal and provincial domains. The Ontario Personal Health Information Protection Act, 2004 (PHIPA) which came into force on November 1, 2004, sets rules that health information custodians must abide by when collecting, using and disclosing personal health information within the Ontario health care system. The provisions of the PHIPA that apply to health information custodians meet the above-noted criteria for recognition as substantially similar to PIPEDA. The purpose of this Order is thus to exempt from PIPEDA those health information custodians, as defined in PHIPA, in respect of the collection, use and disclosure of personal health information that occurs within the province of Ontario, in the course of commercial activity. It is the intent of Industry Canada that this Order also applies to agents of health information custodians. PIPEDA will continue to apply to the collection, use and disclosure of personal health information outside the province, in the course of commercial activity. PIPEDA may also apply to personal health information collected, used or disclosed by entities other than health information custodians. Alternatives The legislative framework in Part 1 of PIPEDA requires that exemptions for organizations, classes of organizations or an activity or class of activities subject to provincial or territorial laws that are substantially similar to the federal Act be done through Order in Council. There are no alternatives to exempt from PIPEDA health information custodians subject to the Ontario PHIPA. Benefits and Costs Benefits The alignment of federal and provincial/territorial legislative regimes for the protection of privacy makes privacy laws easier for individuals to understand and simpler for organizations to implement. The establishment of privacy rules that apply to Ontario health information custodians whether or not they are engaged in commercial activity creates a consistent and seamless set of rules with regard to the protection of personal health information, thereby increasing the efficiency with which they collect, use and disclose personal health information as part of their care and treatment activities. Costs The Order will have no adverse cost impact on the activities of health information custodians in Ontario. To the extent that they collect, use and disclose personal health information within the Ontario health-care system, health information custodians are expected to comply with the privacy rules established by PHIPA. These privacy requirements are based on the national standard set in the CSA Model Code for the Protection of Personal Information, CAN/CSA-Q830-96 that is embedded in PIPEDA and in the Ontario PHIPA. Both laws establish a set of 10 fair information principles, and both have set up an independent oversight and redress mechanism. Consultation Provincial and territorial governments, along with the general public, the health-care sector and the business community have already been made aware of the federal government's commitment to exempt from PIPEDA, organizations subject to provincial/territorial laws that incorporate the national standard established by PIPEDA. During Parliamentary consideration of the legislation, which included extensive hearings before the Standing Committee on Industry and the Senate Standing Committee on Social Affairs, Science and Technology, taking place between October 1998 and April 2000, and through speeches, press releases and other communications to the public, the Government of Canada has clearly indicated its intention to encourage provinces and territories to develop substantially similar privacy legislation. It further confirmed that PIPEDA would not apply to organizations subject to these laws in respect of the collection, use and disclosure of personal information, including personal health information, taking place within a province or territory. Information was also provided to the general public when Industry Canada published its policy and criteria for determining substantially similar provincial and territorial legislation in the Canada Gazette, Part I, on August 3, 2002. To facilitate public comments concerning the Order, Industry Canada notified the privacy community and other interested organizations via electronic mail at the time of pre-publication in the Canada Gazette. Information was also made available on the Industry Canada PIPEDA website (http://strategis.ic.gc.ca/privacy). Following pre-notification, the Order was pre-published in the Canada Gazette, Part I, on February 5, 2005 for a 15-day period of public comment. Responses from 12 organizations and individuals were received, including from the Information and Privacy Commissioner of Ontario and the Ontario Ministry of Health and Long-Term Care. All but two respondents supported the proposed Order. Two responses were not in favour of the Order and communicated concerns with the level of privacy protection being offered by the PHIPA in respect of that Act's research provisions. The 10 respondents who supported the Order requested that it be broadened to include a wider range of entities that are subject to PHIPA, including agents of health information custodians, regulatory colleges, researchers, "section 45 entities" and "prescribed registries" as defined in the PHIPA. However, most of the entities for which an extension of the Order is requested are subject to provisions in the PHIPA that do not incorporate the ten principles contained in the National Standard of Canada entitled Model Code for the Protection of Personal Information (CAN/CSA-Q830-96). As well, a number of these entities, such as the regulatory colleges, are not engaged in commercial activity. For these reasons, the Order is to remain intact and will not be expanded in scope. The concerns of the two respondents respecting the PHIPA's research provisions are thus addressed by the existing Order. In respect of the requests to expand the scope of the Order to include agents of health information custodians, it is the intent of Industry Canada that this Order applies to them, as noted earlier in this document. Compliance and Enforcement This Order will confirm that Ontario health information custodians will not be subject to PIPEDA in respect of the collection, use and disclosure of personal health information. Compliance with privacy rules and enforcement of the Ontario PHIPA is delivered through the Information and Privacy Commissioner of Ontario. Following the issuance of this Order, complaints and investigations about the practices of health information custodians in respect of the collection, use and disclosure of personal health information taking place within the province in the course of commercial activity will be handled by the Ontario Information and Privacy Commissioner. The Privacy Commissioner of Canada will continue to be responsible for providing oversight in relation to the collection, use and disclosure of personal health information that crosses provincial boundaries in the course of commercial activity. She may also continue to be responsible for personal health information collected, used or disclosed by non health information custodians. Contact Mr. Richard Simpson S.C. 2000, c. 5 S.C. 2000, c. 5 |
||||||||||||||||||||
|
NOTICE:
|
|||||||||||||||||||||
