| |||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||
 |
| ||||||||||||||||||||||||||||||||||||
 |
|||||||||||||||||||||||||||||||||||||
|
Vol. 140, No. 14 — July 12, 2006
Registration PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT Regulations Amending the Regulations Specifying Investigative Bodies P.C. 2006-580 June 23, 2006 Her Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to paragraph 26(1)(a.01) of the Personal Information Protection and Electronic Documents Act (see footnote a), hereby makes the annexed Regulations Amending the Regulations Specifying Investigative Bodies. REGULATIONS AMENDING THE REGULATIONS SPECIFYING INVESTIGATIVE BODIES AMENDMENT 1. Section 1 of the Regulations Specifying Investigative Bodies (see footnote 1) is amended by striking out the word "and" at the end of paragraph (z.22) and by adding the following after paragraph (z.23): (z.24) Alberta Dental Association and College; (z.25) Association of Ontario Land Surveyors; (z.26) Board of Funeral Services; (z.27) Canadian Association of Insolvency and Restructuring Professionals; (z.28) College of Physicians and Surgeons of Manitoba; (z.29) College of Veterinarians of Ontario; (z.30) Ontario Association of Architects; (z.31) Ontario College of Teachers; (z.32) Ontario Motor Vehicle Industry Council; (z.33) Ontario Professional Foresters Association; (z.34) Association of Professional Engineers of Yukon; (z.35) Association of Professional Engineers and Geoscientists of the Province of British Columbia; (z.36) Association of Professional Engineers, Geologists and Geophysicists of Alberta; (z.37) Association of Professional Engineers, Geologists and Geophysicists of the Northwest Territories; (z.38) Association of Professional Engineers and Geoscientists of Saskatchewan; (z.39) Association of Professional Engineers and Geoscientists of the Province of Manitoba; (z.40) Association of Professional Engineers of Ontario; (z.41) Ordre des ingénieurs du Québec; (z.42) Association of Professional Engineers and Geoscientists of New Brunswick; (z.43) Association of Professional Engineers of the Province of Nova Scotia; (z.44) Association of Professional Engineers of Prince Edward Island; (z.45) Association of Professional Engineers and Geoscientists of Newfoundland; (z.46) Real Estate Council of Alberta; (z.47) Real Estate Council of Ontario; (z.48) Technical Standards & Safety Authority; (z.49) Travel Industry Council of Ontario; and (z.50) College of Registered Nurses of Nova Scotia. COMING INTO FORCE 2. These Regulations come into force on the day on which they are registered. REGULATORY IMPACT ANALYSIS STATEMENT (This statement is not part of the Regulations.) Description Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. The legislation requires an organization, which is disclosing personal information, to obtain the individual's consent in most circumstances. An exception to this rule is found in paragraphs 7(3)(d) and (h.2) of the Act which permit the disclosure of personal information to and by a private investigative body, without the knowledge or consent of the individual, if the investigative body is specified by the investigative bodies regulation. The purpose of this amendment to the investigative bodies regulation is to name additional investigative bodies for the purposes of paragraph 7(3)(d) or (h.2) of the Act. Many investigations into frauds and breaches of agreement are conducted by private sector organizations, either acting as or making use of independent, non-governmental investigative bodies. Should the investigation reveal grounds for suspecting that a fraud has been committed or a law contravened, the organization may then turn the findings over to a police or other law enforcement agency for further action or (as in the case of professional regulatory bodies such as a provincial association of Professional Engineers) may take appropriate disciplinary action pursuant to its own statutory authority. Paragraph 7(3)(d) of the Act allows an organization to disclose personal information, without the consent of the individual, to a private investigative body in order to instigate or facilitate an investigation. Paragraph 7(3)(h.2) of the Act allows an investigative body to disclose personal information to another private organization, including the client organization on whose behalf it is conducting the investigation. The disclosures are circumscribed as they must be related to investigations of a breach of an agreement or a contravention of the law and be reasonable. Paragraph 7(3)(h.2) of the Act completes the exception provided in paragraph 7(1)(b) of the Act for collection without consent for the purposes of the prevention of fraud by extending it to disclosure. Collection alone would be of limited use to those combating fraud and other breaches of agreement, unless the information could be disclosed to the parties that need the information. However, without paragraph 7(3)(h.2) of the Act, the flow of information could only go in one direction - from the organization to the investigative body. The investigative body would be unable to disclose the results of its investigation back to its client or other interested parties without consent. The ability to exchange personal information without consent for investigative purposes between or among private organizations is the only exception granted to these organizations by the regulation. Organizations and investigative bodies which exchange personal information will remain responsible for compliance with all other requirements of the Act for this information, and will be subject to oversight by the Privacy Commissioner of Canada. Individuals may also seek redress in the Federal Court of Canada. The general requirement that the Act imposes on all organizations to obtain consent before disclosing personal information is not altered by virtue of granting an organization status as an investigative body. Organizations with investigative body status would be able to disclose personal information in their investigations without the consent of the individual only in those exceptional circumstances in which obtaining consent is impossible, impractical or undesirable because it would frustrate the conduct of the investigation. During the initial preparation of the regulation, Industry Canada developed a set of criteria that would be used in the assessment of candidates for investigative bodies. These criteria were intended to cover privacy concerns associated with allowing organizations to disclose personal information without consent for investigative purposes. All of the criteria would not necessarily be applicable to each investigative body. The criteria include:
Industry Canada will continue to exercise care in the naming of additional investigative bodies because these bodies are allowed to collect, use and disclose personal information without consent in certain circumstances, contrary to the general regime of the Act. Generally, only an organization which actually conducts investigations will be considered for investigative body status - those that do not will not be considered. Applications that seek investigative body status for an organization when only some of the organization's work is investigative will raise concerns about the potential for the misuse of the authority. Applications that seek to grant investigative body status to a large number of small organizations will raise concerns about effective oversight. Industry Canada would also like to emphasize that the current criteria for investigative body status are meant to be read within the overall compliance regime of the Act. This means that an investigative body would be expected to conduct its operations with the minimum privacy impairment that is necessary for the carrying out of its investigative function. It also means that the public interest in the organization's investigative activity should outweigh the harm caused to associated privacy interests. Finally, organizations that are specified by name or by class in the regulation as investigative bodies should understand that the designation applies only to the part of the organization that requires the exception and only to the investigative activities conducted by that part of the organization. For example, when the designation is granted to a professional regulatory body such as a provincial association of Professional Engineers, only the corporately defined entities and activities that relate directly to the investigation functions of the association have investigative body status and the status applies only to the investigative work that they do. Part 1 of the Act was implemented in two stages. On January 1, 2001, it applied to the personal information of the customers and employees of the federally regulated private sector, including telephone and transportation companies, broadcasters, and banks. It also applied to organizations that sell personal information across provincial borders, e.g., companies selling or renting mailing lists. On January 1, 2004, the Act applied to all personal information collected, used or disclosed in the course of commercial activity. Due to the phased introduction of the legislation and the fact that it is new to the private sector, it was expected that additions to the list of investigative bodies in the regulation would be necessary. For this reason, the Department has indicated that it would continue to consider applications on a case by case basis in the future. The Department would also like to underline the fact that the behavior of organizations receiving investigative body status will continue to be monitored by Industry Canada once the designation has been given. Should concerns be raised regarding the compliance of an investigative body with all of the requirements of PIPEDA, e.g., through findings issued by the Privacy Commissioner of Canada, then the investigative body designation will be withdrawn by an amendment to the regulation. Industry Canada has now completed its review of new applications. The applicants consist of various professional regulatory bodies with a statutory authority to investigate professional misconduct on the part of their members. These include the organizations representing the engineers and insolvency and restructuring professionals of Canada, the land surveyors, architects, foresters, teachers and veterinarians of Ontario and other organizations in Ontario which regulate the funeral service, motor vehicle, real estate and travel industries, and various industry safety standards. The professional bodies which regulate the dentists and the real estate industry of Alberta, the physicians and surgeons of Manitoba and the registered nurses of Nova Scotia have also applied. On the basis of the documentation submitted, describing their operation and investigative activities, Industry Canada has concluded that the regulation should be amended by adding the organizations listed. Copies of their submissions may be obtained by contacting Industry Canada. Alternatives The legislative framework in Part 1 of the Act provides that an investigative body, for the purposes of paragraph 7(3)(d) or (h.2) of the Act, must be specified by regulation. There are no alternatives to deal with the collection, use and disclosure of this information without consent. Benefits and Costs The professional disciplinary bodies investigate the conduct of their members to prevent incompetent, unethical and unauthorized practices, which is to the general benefit of all persons who make use of their professional services. Costs The Regulation should not impose significant additional costs on the organizations to which it applies as it merely permits the continuation of previous information sharing relationships between organizations and the specified investigative bodies. For some of the organization which are not themselves subject to PIPEDA, such as the professional regulatory bodies, there could be some administrative costs associated with, e.g., developing a CSA compliant privacy code. The Regulation will have no impact on Department resources. Consultation No comments were received in response to the pre-publication of the Regulation in the Canada Gazette, Part I. Compliance and Enforcement Individuals may make complaints about the practices of an organization to the Privacy Commissioner of Canada who will investigate the matter and deliver a report to the parties. The Commissioner may make recommendations to an organization concerning its practices and whether they are considered to comply with Part 1 of the Act but the Commissioner does not have the power to issue binding orders on the organization. The individual or the Privacy Commissioner, or both acting together, may take unresolved complaints to the Federal Court of Canada which has the power to order an organization to change a practice and to pay damages to the individual. Contact
Mr. Richard Simpson S.C. 2000, c. 5 SOR/2001-6 |
||||||||||||||||||||||||
|
NOTICE:
|
|||||||||||||||||||||||||
