| Copyright (c) Queen's Printer, Victoria, British Columbia, Canada | License Disclaimer |
| This archived statute consolidation is current to May 30, 2014 and includes changes enacted and in force by that date. For the most current information, click here. | |||
| This Act has "Not in Force" sections. See the Table of Legislative Changes. |
Part 3 — Protection of Privacy
Division 1 — Collection, Protection and Retention of Personal Information by Public Bodies
26 A public body may collect personal information only if
(a) the collection of the information is expressly authorized under an Act,
(b) the information is collected for the purposes of law enforcement,
(c) the information relates directly to and is necessary for a program or activity of the public body,
(d) with respect to personal information collected for a prescribed purpose,
(i) the individual the information is about has consented in the prescribed manner to that collection, and
(ii) a reasonable person would consider that collection appropriate in the circumstances,
(e) the information is necessary for the purposes of planning or evaluating a program or activity of a public body,
(f) the information is necessary for the purpose of reducing the risk that an individual will be a victim of domestic violence, if domestic violence is reasonably likely to occur,
(g) the information is collected by observation at a presentation, ceremony, performance, sports meet or similar event
(i) at which the individual voluntarily appears, and
(ii) that is open to the public, or
(h) the information is personal identity information that is collected by
(i) a provincial identity information services provider and the collection of the information is necessary to enable the provincial identity information services provider to provide services under section 69.2, or
(ii) a public body from a provincial identity information services provider and the collection of the information is necessary to enable
(A) the public body to identify an individual for the purpose of providing a service to the individual, or
(B) the provincial identity information services provider to provide services under section 69.2.
27 (1) A public body must collect personal information directly from the individual the information is about unless
(a) another method of collection is authorized by
(ii) the commissioner under section 42 (1) (i), or
(a.1) the collection of the information is necessary for the medical treatment of an individual and it is not possible
(i) to collect the information directly from that individual, or
(ii) to obtain authority under paragraph (a) (i) for another method of collection,
(b) the information may be disclosed to the public body under sections 33 to 36,
(c) the information is collected for the purpose of
(i) determining suitability for an honour or award including an honorary degree, scholarship, prize or bursary,
(ii) a proceeding before a court or a judicial or quasi judicial tribunal,
(iii) collecting a debt or fine or making a payment,
(v) reducing the risk that an individual will be a victim of domestic violence, if domestic violence is reasonably likely to occur,
(d) the information is transferred to the public body from another public body in accordance with section 27.1,
(e) the collection of the information is necessary for delivering or evaluating a common or integrated program or activity,
(f) the information is about an employee, other than a service provider, and the collection of the information is necessary for the purposes of managing or terminating an employment relationship between a public body and the employee, or
(g) the information is personal identity information that is collected by a provincial identity information services provider and the collection of the information is necessary to enable the provincial identity information services provider to provide services under section 69.2.
(2) A public body must ensure that an individual from whom it collects personal information is told
(a) the purpose for collecting it,
(b) the legal authority for collecting it, and
(c) the title, business address and business telephone number of an officer or employee of the public body who can answer the individual's questions about the collection.
(3) Subsection (2) does not apply if
(a) the information is about law enforcement or anything referred to in section 15 (1) or (2),
(b) the minister responsible for this Act excuses a public body from complying with it because doing so would
(i) result in the collection of inaccurate information, or
(ii) defeat the purpose or prejudice the use for which the information is collected,
(i) is not required, under subsection (1), to be collected directly from the individual the information is about, and
(ii) is not collected directly from the individual the information is about, or
(d) the information is collected by observation at a presentation, ceremony, performance, sports meet or similar event
(i) at which the individual voluntarily appears, and
(ii) that is open to the public.
(4) A public body must notify an employee, other than a service provider, that it will be collecting personal information under subsection (1) (f) unless it is reasonable to expect that the notification would compromise
(a) the availability or the accuracy of the information, or
(b) an investigation or a proceeding related to the employment of the employee.
27.1 (1) Personal information that is received by a public body is not collected by the public body for the purposes of this Act if
(a) the information does not relate to a program or activity of the public body, and
(b) the public body takes no action with respect to the information other than to
(i) read all or a part of it and then delete, destroy or return it, or
(ii) read all or a part of it and then transfer it in accordance with subsection (2).
(2) For the purpose of subsection (1) (b) (ii), a public body may transfer personal information to
(b) a government institution subject to the Privacy Act (Canada)
if the public body determines the information relates to a program or activity of the other public body or government institution referred to in paragraph (a) or (b).
28 If
(a) an individual's personal information is in the custody or under the control of a public body, and
(b) the personal information will be used by or on behalf of the public body to make a decision that directly affects the individual,
the public body must make every reasonable effort to ensure that the personal information is accurate and complete.
29 (1) An applicant who believes there is an error or omission in his or her personal information may request the head of the public body that has the information in its custody or under its control to correct the information.
(2) If no correction is made in response to a request under subsection (1), the head of the public body must annotate the information with the correction that was requested but not made.
(3) On correcting or annotating personal information under this section, the head of the public body must notify any other public body or any third party to whom that information has been disclosed during the one year period before the correction was requested.
(4) On being notified under subsection (3) of a correction or annotation of personal information, a public body must make the correction or annotation on any record of that information in its custody or under its control.
30 A public body must protect personal information in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.
30.1 A public body must ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada, unless one of the following applies:
(a) if the individual the information is about has identified the information and has consented, in the prescribed manner, to it being stored in or accessed from, as applicable, another jurisdiction;
(b) if it is stored in or accessed from another jurisdiction for the purpose of disclosure allowed under this Act;
"foreign demand for disclosure" means a subpoena, warrant, order, demand or request that is
(a) from a foreign court, an agency of a foreign state or another authority outside Canada, and
(b) for the unauthorized disclosure of personal information to which this Act applies;
"unauthorized disclosure of personal information" means disclosure of, production of or the provision of access to personal information to which this Act applies, if that disclosure, production or access is not authorized by this Act.
(2) If the head of a public body or an employee, officer or director of a public body or an employee or associate of a service provider
(a) receives a foreign demand for disclosure,
(b) receives a request to disclose, produce or provide access to personal information to which this Act applies, if the public body, employee or other person receiving the request
(i) knows that the request is for the purpose of responding to a foreign demand for disclosure, or
(ii) has reason to suspect that it is for such a purpose, or
(c) has reason to suspect that unauthorized disclosure of personal information has occurred in response to a foreign demand for disclosure,
the head of the public body, the employee or other person must immediately notify the minister responsible for this Act.
(3) The notice under subsection (2) must include, as known or suspected,
(a) the nature of the foreign demand for disclosure,
(b) who made the foreign demand for disclosure,
(c) when the foreign demand for disclosure was received, and
(d) what information was sought by or disclosed in response to the foreign demand for disclosure.
30.3 An employer, whether or not a public body, must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee of the employer, or deny that employee a benefit, because
(a) the employee, acting in good faith and on the basis of reasonable belief, has notified the minister responsible for this Act under section 30.2,
(b) the employee, acting in good faith and on the basis of reasonable belief, has disclosed to the commissioner that the employer or any other person has contravened or is about to contravene this Act,
(c) the employee, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene this Act,
(d) the employee, acting in good faith and on the basis of reasonable belief, has refused to do or stated an intention of refusing to do anything that is in contravention of this Act, or
(e) the employer believes that an employee will do anything described in paragraph (a), (b), (c) or (d).
30.4 An employee, officer or director of a public body or an employee or associate of a service provider who has access, whether authorized or unauthorized, to personal information in the custody or control of a public body, must not disclose that information except as authorized under this Act.
30.5 (1) In this section, "unauthorized disclosure of personal information" has the same meaning as in section 30.2 (1).
(2) An employee, officer or director of a public body, or an employee or associate of a service provider, who knows that there has been an unauthorized disclosure of personal information that is in the custody or under the control of the public body must immediately notify the head of the public body.
31 If an individual's personal information
(a) is in the custody or under the control of a public body, and
(b) is used by or on behalf of the public body to make a decision that directly affects the individual,
the public body must ensure that the personal information is retained for at least one year after being used so that the affected individual has a reasonable opportunity to obtain access to that personal information.
31.1 The requirements and restrictions established by this Part also apply to
(a) the employees, officers and directors of a public body, and
(b) in the case of an employee that is a service provider, all employees and associates of the service provider.
Division 2 — Use and Disclosure of Personal Information by Public Bodies
32 A public body may use personal information in its custody or under its control only
(a) for the purpose for which that information was obtained or compiled, or for a use consistent with that purpose (see section 34),
(b) if the individual the information is about has identified the information and has consented, in the prescribed manner, to the use, or
(c) for a purpose for which that information may be disclosed to that public body under sections 33 to 36.
33 A public body may disclose personal information in its custody or under its control only as permitted under section 33.1, 33.2 or 33.3.
33.1 (1) A public body may disclose personal information referred to in section 33 inside or outside Canada as follows:
(a) in accordance with Part 2;
(a.1) if the information or disclosure is of a type described in section 22 (4) (e), (f), (h), (i) or (j);
(b) if the individual the information is about has identified the information and consented, in the prescribed manner, to its disclosure inside or outside Canada, as applicable;
(c) in accordance with an enactment of British Columbia, other than this Act, or Canada that authorizes or requires its disclosure;
(c.1) if it is made available to the public in British Columbia under an enactment, other than this Act, that authorizes or requires the information to be made public;
(d) in accordance with a provision of a treaty, arrangement or written agreement that
(i) authorizes or requires its disclosure, and
(ii) is made under an enactment of British Columbia, other than this Act, or Canada;
(e) to an individual who is a minister, an officer of the public body or an employee of the public body other than a service provider, if
(i) the information is necessary for the performance of the duties of the minister, officer or employee, and
(ii) in relation to disclosure outside Canada, the outside disclosure is necessary because the individual is temporarily travelling outside Canada;
(e.1) to an individual who is a service provider of the public body, or an employee or associate of such a service provider, if
(i) the information is necessary for the performance of the duties of the individual in relation to the public body, and
(ii) in relation to disclosure outside Canada,
(A) the individual normally receives such disclosure only inside Canada for the purpose of performing those duties, and
(B) the outside disclosure is necessary because the individual is temporarily travelling outside Canada;
(f) to an officer or employee of the public body or to a minister, if the information is immediately necessary for the protection of the health or safety of the officer, employee or minister;
(g) to the Attorney General or legal counsel for the public body, for the purpose of preparing or obtaining legal advice for the government or public body or for use in civil proceedings involving the government or public body;
(h) to the minister responsible for the Coroners Act or a person referred to in section 31 (1) of that Act, for the purposes of that Act;
(i) the disclosure is for the purposes of collecting amounts owing to the government of British Columbia or a public body by
(B) a corporation of which the individual the information is about is or was a director or officer, and
(ii) in relation to disclosure outside Canada, there are reasonable grounds for believing that
(A) the individual the information is about is in, resides in or has assets in the other jurisdiction, or
(B) if applicable, the corporation was incorporated in, is doing business in or has assets in the other jurisdiction;
(i) a payment to be made to or by the government of British Columbia or a public body,
(ii) authorizing, administering, processing, verifying or canceling such a payment, or
(iii) resolving an issue regarding such a payment;
(i) licensing or registration of motor vehicles or drivers, or
(ii) verification of motor vehicle insurance, motor vehicle registration or drivers licences;
(l) for the purposes of licensing, registration, insurance, investigation or discipline of persons regulated inside or outside Canada by governing bodies of professions and occupations;
(i) the head of the public body determines that compelling circumstances exist that affect anyone's health or safety, and
(ii) notice of disclosure is mailed to the last known address of the individual the information is about, unless the head of the public body considers that giving this notice could harm someone's health or safety;
(m.1) for the purpose of reducing the risk that an individual will be a victim of domestic violence, if domestic violence is reasonably likely to occur;
(n) so that the next of kin or a friend of an injured, ill or deceased individual may be contacted;
(o) in accordance with section 36 (disclosure for archival or historical purposes);
(A) installing, implementing, maintaining, repairing, trouble shooting or upgrading an electronic system or equipment that includes an electronic system, or
(B) data recovery that is being undertaken following failure of an electronic system
that is used in Canada by the public body or by a service provider for the purposes of providing services to a public body, and
(ii) in the case of disclosure outside Canada,
(A) is limited to temporary access and storage for the minimum time necessary for that purpose, and
(B) in relation to data recovery under subparagraph (i) (B), is limited to access and storage only after the system failure has occurred.
(q) if the information was collected by observation at a presentation, ceremony, performance, sports meet or similar event
(i) at which the individual voluntarily appeared, and
(ii) that was open to the public;
(i) was disclosed on a social media site by the individual the information is about,
(ii) was obtained or compiled by the public body for the purpose of enabling the public body to engage individuals in public discussion or promotion respecting proposed or existing initiatives, policies, proposals, programs or activities of the public body or respecting legislation relating to the public body, and
(iii) is disclosed for a use that is consistent with the purpose described in subparagraph (ii);
(s) in accordance with section 35[disclosure for research or statistical purposes];
(t) to comply with a subpoena, a warrant or an order issued or made by a court, person or body in Canada with jurisdiction to compel the production of information.
(2) In addition to the authority under any other provision of this section or section 33.2, a public body that is a law enforcement agency may disclose personal information referred to in section 33
(a) to another law enforcement agency in Canada, or
(b) to a law enforcement agency in a foreign country under an arrangement, a written agreement, a treaty or provincial or Canadian legislative authority.
(3) The minister responsible for this Act may, by order, allow disclosure outside Canada under a provision of section 33.2 in specific cases or specified circumstances, subject to any restrictions or conditions that the minister considers advisable.
(4) In addition to the authority under any other provision of this section or section 33.2, the Insurance Corporation of British Columbia may disclose personal information if
(a) the information was obtained or compiled by that public body for the purposes of insurance provided by the public body, and
(b) disclosure of the information is necessary to investigate, manage or settle a specific insurance claim.
(5) In addition to the authority under any other provision of this section or section 33.2, a provincial identity information services provider may disclose personal identity information
(a) to enable the provincial identity services provider to provide services under section 69.2, or
(b) to a public body if the disclosure is necessary to enable the public body to identify an individual for the purpose of providing a service to the individual.
(6) In addition to the authority under any other provision of this section or section 33.2, a public body may disclose personal identity information to a provincial identity information services provider if the disclosure is necessary to enable
(a) the public body to identify an individual for the purpose of providing a service to the individual, or
(b) the provincial identity information services provider to provide services under section 69.2.
(7) Without limiting the authority under any other provision of this section or section 33.2, a public body may disclose personal information to the individual the information is about if
(a) the individual has initiated contact with the public body about a matter and the public body is responding to that contact,
(b) the public body discloses information only in respect of the matter, and
(i) the same communication method used by the individual to initiate contact, or
(ii) another communication method authorized by the individual.
33.2 A public body may disclose personal information referred to in section 33 inside Canada as follows:
(a) for the purpose for which it was obtained or compiled or for a use consistent with that purpose (see section 34);
(c) to an officer or employee of the public body or to a minister, if the information is necessary for the performance of the duties of the officer, employee or minister;
(d) to an officer or employee of
or to a minister, if the information is necessary for the delivery of a common or integrated program or activity and for the performance of the duties, respecting the common or integrated program or activity, of the officer, employee or minister to whom the information is disclosed;
(e) to an officer or employee of a public body or to a minister, if the information is necessary for the protection of the health or safety of the officer, employee or minister;
(f) to the auditor general or any other prescribed person or body for audit purposes;
(g) to a member of the Legislative Assembly who has been requested by the individual the information is about to assist in resolving a problem;
(h) to a representative of the bargaining agent, who has been authorized in writing by the employee whom the information is about, to make an inquiry;
(i) to a public body or a law enforcement agency in Canada to assist in a specific investigation
(i) undertaken with a view to a law enforcement proceeding, or
(ii) from which a law enforcement proceeding is likely to result;
(j) to the archives of the government of British Columbia or the archives of a public body, for archival purposes;
(l) to an officer or employee of a public body or to a minister, if the information is necessary for the purposes of planning or evaluating a program or activity of a public body.
33.3 (1) A public body may disclose to the public a record that is within a category of records established under section 71 (1).
(2) A ministry may disclose to the public a record that is within a category of records established under section 71.1 (1).
34 For the purposes of section 32 (a), 33.1 (1) (r) (iii) or 33.2 (a), or paragraph (b) of the definition of "data linking" in Schedule 1, a use of personal information is consistent with the purpose for which the information was obtained or compiled if the use
(a) has a reasonable and direct connection to that purpose, and
(b) is necessary for performing the statutory duties of, or for operating a program or activity of, the public body that uses or discloses the information.
35 (1) A public body may disclose personal information in its custody or under its control for a research purpose, including statistical research, only if
(a) the research purpose cannot reasonably be accomplished unless that information is provided in individually identifiable form or the research purpose has been approved by the commissioner,
(a.1) subject to subsection (2), the information is disclosed on condition that it not be used for the purpose of contacting a person to participate in the research,
(b) any data linking is not harmful to the individuals that information is about and the benefits to be derived from the data linking are clearly in the public interest,
(c) the head of the public body concerned has approved conditions relating to the following:
(i) security and confidentiality;
(ii) the removal or destruction of individual identifiers at the earliest reasonable time;
(iii) the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authorization of that public body, and
(d) the person to whom that information is disclosed has signed an agreement to comply with the approved conditions, this Act and any of the public body's policies and procedures relating to the confidentiality of personal information.
(2) Subsection (1) (a.1) does not apply in respect of research in relation to health issues if the commissioner approves
(b) the use of disclosed information for the purpose of contacting a person to participate in the research, and
(c) the manner in which contact is to be made, including the information to be made available to persons contacted.
36 (1) In addition to the authority under sections 33.1, 33.2 and 33.3, the archives of the government of British Columbia, or the archives of a public body, may disclose personal information in its custody or under its control for archival or historical purposes if
(a) the disclosure would not be an unreasonable invasion of personal privacy under section 22,
(b) the disclosure is for historical research and is in accordance with section 35,
(c) the information is about someone who has been dead for 20 or more years, or
(d) the information is in a record that has been in existence for 100 or more years.
(2) For the purposes of subsection (3), "institution" means a museum, an archives or a similar institution that is or forms part of a public body or an organization, as the latter is defined in the Personal Information Protection Act.
(3) A board or a francophone education authority, as those are defined in the School Act, may disclose personal information in its custody or under its control to an institution if
(a) the disclosure would not be an unreasonable invasion of personal privacy under section 22,
(b) the disclosure is for historical research and is in accordance with section 35,
(c) the information is about someone who has been dead for 20 or more years, or
(d) the information is in a record that has been in existence for 100 or more years.
Division 3 — Data-linking Initiatives
36.1 (1) A public body participating in a new or significantly revised data-linking initiative must comply with the regulations, if any, prescribed for the purposes of this subsection.
(2) If all the participants in a new or significantly revised data-linking initiative are a health care body, the ministry of the minister responsible for the administration of the Ministry of Health Act or a health-related organization as prescribed, then subsection (1) does not apply to the participants.
(3) For the purposes of subsections (1) and (2), a public body is participating in
(a) a new data-linking initiative if the data-linking initiative is implemented after the date this section comes into force, or
(b) a significantly revised data-linking initiative if the data-linking initiative is an existing data-linking initiative and a public body participating in that data-linking initiative expands it by doing one or more of the following:
(i) adding a public body or an agency that is not already a participant in the data-linking initiative;
(ii) adding a database that is not already a part of the data-linking initiative;
(iii) undertaking a purpose that is not already a purpose of the data-linking initiative;
(iv) using a type of technology that is not already a part of the data-linking initiative.
(4) Despite subsection (3) (a), a public body is not participating in a new data-linking initiative if, before the date this section comes into force, the public body has completed a written project plan respecting the data-linking initiative that states
(a) the objectives of the project,
Contents | Part 1 | Part 2 | Part 3 | Part 4 | Part 5 | Part 6 | Schedule 1 | Schedule 2 | Schedule 3
Copyright (c) Queen's Printer, Victoria, British Columbia, Canada