Privacy Protection

The Act creates a privacy protection scheme which the government must follow to protect an individual’s right to privacy. The scheme includes rules regarding the collection, retention, use, disclosure and disposal of personal information in the government’s custody or control. If an individual feels his or her privacy has been compromised by a government organization governed by the Act, he or she may complain to the Information and Privacy Commissioner, who may investigate the complaint. Individuals who are given access to their personal information have the right to request correction of that information where they believe there is an error or omission.

Where this request is refused, individuals may require that a statement of disagreement be attached to the information. Individuals may also require that all parties to whom the information has been disclosed in the preceding year be notified of the correction or statement of disagreement. An individual may appeal a government organization’s response to a correction request to the Information and Privacy Commissioner.

Requesting Access to Records

If you want access to government records, begin by contacting the government organization that has the information. If you do not obtain the information you want, make a written request under the Act. Please note: Section 52 of the Act outlines some specific types of records that are not subject to the Act. Additionally, the Act sets out mandatory and discretionary exemptions to access which are listed below.

Mandatory exemptions require a government organization to refuse to disclose certain kinds of records, including:

• Information received in confidence from other governments;
• Third party information if supplied in confidence and where disclosure could prejudice the interests of a third party;
• Personal information about individuals other than the requester.

Discretionary exemptions allow a government organization to decide whether to disclose certain other kinds of records, including:

• Draft bylaws, draft private bills and records of meetings that are authorized by statute to be held in the absence of the public;
• Advice or recommendations within the organization;
• Law enforcement information;
• Information which could prejudice the financial or other specified interests of the organization;
• Information subject to solicitor-client privilege;
• Information which could endanger the health or safety of an individual;
• Information already available to the public or soon to be published.

Government organizations must:

• Design and implement records systems which adequately protect personal privacy;
• Assist in locating records requested;
• Determine if the requested record might contain personal information or third party information that affects the interests of someone other than the requester and, if so, allow the affected person to make representations about the disclosure of this information before granting access;
• Within 30 days of receipt of an access request, make records available, deny access or notify the requester of any delay because of a need to obtain representations from affected persons or because of extraordinary circumstances;
• Give written reason for any denial of access;
• Inform the person being denied access of his or her right to appeal to the Information and Privacy Commissioner within 30 days of receiving the government organization’s response.