| Copyright (c) Queen's Printer, Victoria, British Columbia, Canada |
IMPORTANT INFORMATION |
Part 3 — Protection of Privacy
Division 1 — Collection, Protection and Retention of Personal Information by Public Bodies
26 No personal information may be collected by or for a public body unless
(a) the collection of that information is expressly authorized
(b) that information is collected for the purposes of law enforcement, or
(c) that information relates directly to and is necessary for an operating program or activity of the public body.
27 (1) A public body must collect personal information or cause personal information to be collected directly from the individual the information is about unless
(a) another method of collection is authorized by
(i) that individual,
(ii) the commissioner under section 42 (1) (i), or
(iii) another enactment,
(a.1) the collection of the information is necessary for the medical treatment of an individual and it is not possible
(i) to collect the information directly from that individual, or
(ii) to obtain authority under paragraph (a) (i) for another method of collection,
(b) the information may be disclosed to the public body under sections 33 to 36, or
(c) the information is collected for the purpose of
(i) determining suitability for an honour or award including an honorary degree, scholarship, prize or bursary,
(ii) a proceeding before a court or a judicial or quasi judicial tribunal,
(iii) collecting a debt or fine or making a payment, or
(iv) law enforcement.
(2) A public body must ensure that an individual from whom it collects personal information or causes personal information to be collected is told
(a) the purpose for collecting it,
(b) the legal authority for collecting it, and
(c) the title, business address and business telephone number of an officer or employee of the public body who can answer the individual's questions about the collection.
(3) Subsection (2) does not apply if
(a) the information is about law enforcement or anything referred to in section 15 (1) or (2),
(b) the minister responsible for this Act excuses a public body from complying with it because doing so would
(i) result in the collection of inaccurate information, or
(ii) defeat the purpose or prejudice the use for which the information is collected, or
(c) the information
(i) is not required, under subsection (1), to be collected directly from the individual the information is about, and
(ii) is not collected directly from the individual the information is about.
28 If
(a) an individual's personal information is in the custody or under the control of a public body, and
(b) the personal information will be used by or on behalf of the public body to make a decision that directly affects the individual,
the public body must make every reasonable effort to ensure that the personal information is accurate and complete.
29 (1) An applicant who believes there is an error or omission in his or her personal information may request the head of the public body that has the information in its custody or under its control to correct the information.
(2) If no correction is made in response to a request under subsection (1), the head of the public body must annotate the information with the correction that was requested but not made.
(3) On correcting or annotating personal information under this section, the head of the public body must notify any other public body or any third party to whom that information has been disclosed during the one year period before the correction was requested.
(4) On being notified under subsection (3) of a correction or annotation of personal information, a public body must make the correction or annotation on any record of that information in its custody or under its control.
30 A public body must protect personal information in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.
30.1 A public body must ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada, unless one of the following applies:
(a) if the individual the information is about has identified the information and has consented, in the prescribed manner, to it being stored in or accessed from, as applicable, another jurisdiction;
(b) if it is stored in or accessed from another jurisdiction for the purpose of disclosure allowed under this Act;
(c) if it was disclosed under section 33.1 (1) (i.1).
30.2 (1) In this section:
"foreign demand for disclosure" means a subpoena, warrant, order, demand or request that is
(a) from a foreign court, an agency of a foreign state or another authority outside Canada, and
(b) for the unauthorized disclosure of personal information to which this Act applies;
"unauthorized disclosure of personal information" means disclosure of, production of or the provision of access to personal information to which this Act applies, if that disclosure, production or access is not authorized by this Act.
(2) If a public body, an employee of a public body or an employee or associate of a service provider
(a) receives a foreign demand for disclosure,
(b) receives a request to disclose, produce or provide access to personal information to which this Act applies, if the public body, employee or other person receiving the request
(i) knows that the request is for the purpose of responding to a foreign demand for disclosure, or
(ii) has reason to suspect that it is for such a purpose, or
(c) has reason to suspect that unauthorized disclosure of personal information has occurred in response to a foreign demand for disclosure,
the head of the public body, the employee or other person must immediately notify the minister responsible for this Act.
(3) The notice under subsection (2) must include, as known or suspected,
(a) the nature of the foreign demand for disclosure,
(b) who made the foreign demand for disclosure,
(c) when the foreign demand for disclosure was received, and
(d) what information was sought by or disclosed in response to the foreign demand for disclosure.
30.3 An employer, whether or not a public body, must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee of the employer, or deny that employee a benefit, because
(a) the employee, acting in good faith and on the basis of reasonable belief, has notified the minister responsible for this Act under section 30.2,
(b) the employee, acting in good faith and on the basis of reasonable belief, has disclosed to the commissioner that the employer or any other person has contravened or is about to contravene this Act,
(c) the employee, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene this Act,
(d) the employee, acting in good faith and on the basis of reasonable belief, has refused to do or stated an intention of refusing to do anything that is in contravention of this Act, or
(e) the employer believes that an employee will do anything described in paragraph (a), (b), (c) or (d).
30.4 A person referred to in section 31.1 who has access, whether authorized or unauthorized, to personal information in the custody or control of a public body, must not disclose that information except as authorized under this Act.
31 If an individual's personal information
(a) is in the custody or under the control of a public body, and
(b) is used by or on behalf of the public body to make a decision that directly affects the individual,
the public body must ensure that the personal information is retained for at least one year after being used so that the affected individual has a reasonable opportunity to obtain access to that personal information.
31.1 The requirements and restrictions established by this Part also apply to
(a) the employees, officers and directors of a public body, and
(b) in the case of an employee that is a service provider, all employees and associates of the service provider.
Division 2 — Use and Disclosure of Personal Information by Public Bodies
32 A public body must ensure that personal information in its custody or under its control is used only
(a) for the purpose for which that information was obtained or compiled, or for a use consistent with that purpose (see section 34),
(b) if the individual the information is about has identified the information and has consented, in the prescribed manner, to the use, or
(c) for a purpose for which that information may be disclosed to that public body under sections 33 to 36.
33 A public body must ensure that personal information in its custody or under its control is disclosed only as permitted under section 33.1 or 33.2.
33.1 (1) A public body may disclose personal information referred to in section 33 inside or outside Canada as follows:
(a) in accordance with Part 2;
(b) if the individual the information is about has identified the information and consented, in the prescribed manner, to its disclosure inside or outside Canada, as applicable;
(c) in accordance with an enactment of British Columbia or Canada that authorizes or requires its disclosure;
(c.1) if it is made available to the public in British Columbia under an enactment, other than this Act, that authorizes or requires the information to be made public;
(d) in accordance with a provision of a treaty, arrangement or written agreement that
(i) authorizes or requires its disclosure, and
(ii) is made under an enactment of British Columbia or Canada;
(e) to an individual who is a minister, an officer of the public body or an employee of the public body other than a service provider, if
(i) the information is necessary for the performance of the duties of the minister, officer or employee, and
(ii) in relation to disclosure outside Canada, the outside disclosure is necessary because the individual is temporarily travelling outside Canada;
(e.1) to an individual who is a service provider of the public body, or an employee or associate of such a service provider, if
(i) the information is necessary for the performance of the duties of the individual in relation to the public body, and
(ii) in relation to disclosure outside Canada,
(A) the individual normally receives such disclosure only inside Canada for the purpose of performing those duties, and
(B) the outside disclosure is necessary because the individual is temporarily travelling outside Canada;
(f) to an officer or employee of the public body or to a minister, if the information is immediately necessary for the protection of the health or safety of the officer, employee or minister;
(g) to the Attorney General or legal counsel for the public body, for use in civil proceedings involving the government or public body;
(h) to the minister responsible for the Coroners Act or a person referred to in
(i) if
(i) the disclosure is for the purposes of collecting amounts owing to the government of British Columbia or a public body by
(A) an individual, or
(B) a corporation of which the individual the information is about is or was a director or officer, and
(ii) in relation to disclosure outside Canada, there are reasonable grounds for believing that
(A) the individual the information is about is in, resides in or has assets in the other jurisdiction, or
(B) if applicable, the corporation was incorporated in, is doing business in or has assets in the other jurisdiction;
(i.1) for the purposes of
(i) a payment to be made to or by the government of British Columbia or a public body,
(ii) authorizing, administering, processing, verifying or canceling such a payment, or
(iii) resolving an issue regarding such a payment;
(j) in the case of the Insurance Corporation of British Columbia, if
(i) the information was obtained or compiled by that public body for purposes of insurance provided by the public body, and
(ii) disclosure of the information is necessary to investigate, manage or settle a specific insurance claim;
(k) for the purposes of
(i) licensing or registration of motor vehicles or drivers, or
(ii) verification of motor vehicle insurance, motor vehicle registration or drivers licences;
(l) for the purposes of licensing, registration, insurance, investigation or discipline of persons regulated inside or outside Canada by governing bodies of professions and occupations;
(m) if
(i) the head of the public body determines that compelling circumstances exist that affect anyone's health or safety, and
(ii) notice of disclosure is mailed to the last known address of the individual the information is about, unless the head of the public body considers that giving this notice could harm someone's health or safety;
(n) so that the next of kin or a friend of an injured, ill or deceased individual may be contacted;
(o) in accordance with section 36 (disclosure for archival or historical purposes);
(p) the disclosure
(i) is necessary for
(A) installing, implementing, maintaining, repairing, trouble shooting or upgrading an electronic system or equipment that includes an electronic system, or
(B) data recovery that is being undertaken following failure of an electronic system
that is used in Canada by the public body or by a service provider for the purposes of providing services to a public body, and
(ii) in the case of disclosure outside Canada,
(A) is limited to temporary access and storage for the minimum time necessary for that purpose, and
(B) in relation to data recovery under subparagraph (i) (B), is limited to access and storage only after the system failure has occurred.
(2) In addition to the authority under any other provision of this section or section 33.2, a public body that is a law enforcement agency may disclose personal information referred to in section 33
(a) to another law enforcement agency in Canada, or
(b) to a law enforcement agency in a foreign country under an arrangement, a written agreement, a treaty or provincial or Canadian legislative authority.
(3) The minister responsible for this Act may, by order, allow disclosure outside Canada under a provision of section 33.2 in specific cases or specified circumstances, subject to any restrictions or conditions that the minister considers advisable.
33.2 A public body may disclose personal information referred to in section 33 inside Canada as follows:
(a) for the purpose for which it was obtained or compiled or for a use consistent with that purpose (see section 34);
(b) to comply with a subpoena, warrant or order issued or made by a court, person or body in Canada with jurisdiction to compel the production of information;
(c) to an officer or employee of the public body or to a minister, if the information is necessary for the performance of the duties of the officer, employee or minister;
(d) to an officer or employee of a public body or to a minister, if the information is necessary for the delivery of a common or integrated program or activity and for the performance of the duties of the officer, employee or minister to whom the information is disclosed;
(e) to an officer or employee of a public body or to a minister, if the information is necessary for the protection of the health or safety of the officer, employee or minister;
(f) to the auditor general or any other prescribed person or body for audit purposes;
(g) to a member of the Legislative Assembly who has been requested by the individual the information is about to assist in resolving a problem;
(h) to a representative of the bargaining agent, who has been authorized in writing by the employee whom the information is about, to make an inquiry;
(i) to a public body or a law enforcement agency in Canada to assist in a specific investigation
(i) undertaken with a view to a law enforcement proceeding, or
(ii) from which a law enforcement proceeding is likely to result;
(j) to the archives of the government of British Columbia or the archives of a public body, for archival purposes;
(k) in accordance with section 35 (disclosure for research or statistical purposes).
34 (1) A use of personal information is consistent under section 32 or 33.2 with the purposes for which the information was obtained or compiled if the use
(a) has a reasonable and direct connection to that purpose, and
(b) is necessary for performing the statutory duties of, or for operating a legally authorized program of, the public body that uses or discloses the information or causes the information to be used or disclosed.
(2) [Repealed 2002-13-8.]
35 A public body may disclose personal information or may cause personal information in its custody or under its control to be disclosed for a research purpose, including statistical research, only if
(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form or the research purpose has been approved by the commissioner,
(a.1) the information is disclosed on condition that it not be used for the purpose of contacting a person to participate in the research,
(b) any record linkage is not harmful to the individuals that information is about and the benefits to be derived from the record linkage are clearly in the public interest,
(c) the head of the public body concerned has approved conditions relating to the following:
(i) security and confidentiality;
(ii) the removal or destruction of individual identifiers at the earliest reasonable time;
(iii) the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of that public body, and
(d) the person to whom that information is disclosed has signed an agreement to comply with the approved conditions, this Act and any of the public body's policies and procedures relating to the confidentiality of personal information.
36 The archives of the government of British Columbia, or the archives of a public body, may disclose personal information or cause personal information in its custody or under its control to be disclosed for archival or historical purposes if
(a) the disclosure would not be an unreasonable invasion of personal privacy under section 22,
(b) the disclosure is for historical research and is in accordance with section 35,
(c) the information is about someone who has been dead for 20 or more years, or
(d) the information is in a record that has been in existence for 100 or more years.
Contents | Part 1 | Part 2 | Part 3 | Part 4 | Part 5 | Part 6 | Schedule 1 | Schedule 2 | Schedule 3
Copyright (c) Queen's Printer, Victoria, British Columbia, Canada