By André Faust
We are living in a world that is data driven, however, some of that data collected includes personal information which can be sold, can be used to monitor behaviour, or be retain for future use good or bad.
As an individual, you should be able to get your personal information from whoever has collected, and in an ideal world that is the way it should be. In reality, that is not how it works.
The right to information and the protection of personal act does not go far enough, currently, it seems to focus more on government and its affiliated agencies. It doesn’t have too many teeth when it comes to private business when a person is requesting information about themselves. The only restriction that is placed on business is that they can not arbitrarily give out that information, however, there are circumstances that the law allows them to do so.
Included below is a primary on the protection of information (2001), that gives a good overview what information can be collected and what information cannot. While it is a bit antiquated there are still some concepts at are still useful.
To avoid andy confusion this is not intended as legal advice, It is always best to see a lawyer to get a legal explanation of any legal matters which you may encounter from time to time.
What is the Protection of Personal Information Act?
The Protection of Personal Information Act is one of the laws of New Brunswick. It sets standards that the provincial government must follow when it handles information about individuals. It is based on a model that was developed by the Canadian Standards Association. That model is becoming widely adopted across Canada.
What information does the Act apply to?
The Act applies to all “personal information.” It defines this as any “information about an identifiable individual, recorded in any form.” This is a broad definition. It includes everything from highly sensitive information (such as some medical records) to information that may be available from non-government sources already (for example, addresses and telephone numbers).
Does the Act apply to every government department?
In the provincial government, yes. It also applies to the regional hospital corporations, to N.B. Power, to the
N.B. Liquor Corporation, to the Workplace Health, Safety and Compensation Commission and to some smaller government agencies. The Act uses the term “public body” to describe the departments and other agencies to which it applies.
The Act does not apply to municipalities or universities, nor to the federal government or the private sector. For information about the federal government or the private sector you should contact the Federal Privacy Commissioner’s office at 1-800-282-1376, or by internet at privcan@fox.nstn.ca
What rules do provincial “public bodies” have to follow?
The major rules are the ten Principles that are printed at the end of this leaflet. The Act calls these a “Statutory Code of Practice.” Other parts of the Act provide some interpretation and explanation of the Principles.
From your point of view as an individual, the most important features of the Principles are probably these:
-
A public body should normally only collect, use or disclose information about you with your consent. (See Principles 3 and 5.) In some situations you may give or refuse your consent expressly. But consent can also sometimes be implied as long as the public body is only doing things that a person would be unlikely to disapprove of and should reasonably expect it to do.
Why only “normally”?
Because there are exceptions. For example, public bodies may sometimes need to collect or disclose information about you to protect the health or safety of others. Or they may withhold information from you if they are investigating an offence they think you may have committed. The exceptions are listed in the Protection of Personal Information Act.
Is this the only law that protects my personal information?
No. There are other laws that apply to particular kinds of personal information (for example, tax records, hospital records, young offender records). The Protection of Personal Information Act does not take away any protection that applies to personal information under another law.
How do I find out about my own personal information?
Start with the public body that is most likely to have the information you want. If they don’t have it, they may be able to tell you who does.
If they can’t, or if you don’t know where to start, call the Provincial Archives in Fredericton at 453-2122 or e-mail them at provarch@gnb.ca. Tell them what information you are trying to find. They will be able to tell you who to ask. They can also provide other general information about the Act.
If I have a complaint, where do I go?
Start with the public body that the complaint relates to. It will investigate your complaint, and you may be able to sort things out directly.
If you can’t, though, and you think the public body is doing something that the Act does not permit, you can complain to the Ombudsman (P.O. Box 6000, Fredericton, N.B. E3B 5H1; tel. 453-2789; fax, 453-5599; e-mail, nbombuds@gnb.ca).
Where can I get a copy of the Act?
The full text of the Act is available free on the internet (http://www.gnb.ca/justice/asrl ste.htm)(This link is no longer valid, use this link instead Right to Information and Protection of Privacy Act or for a small charge from the Queen’s Printer (P.O. Box 6000, Fredericton, N.B. E3B 5H1; tel. 453-2520; fax, 457-7899; e-mail, Queens.Printer@gnb.ca).
The “Statutory Code of Practice” under the
Protection of Personal Information Act
Principle 1: Accountability
A public body is responsible for personal information under its control. The chief executive officer of a public body, and his or her designates, are accountable for the public body’s compliance with the following principles.
Principle 2: Identifying Purposes
The purposes for which personal information is collected shall be identified by the public body at or before the time the information is collected.
Principle 3: Consent
The consent of the individual is required for the collection, use, or disclosure of personal information, except where inappropriate.
Principle 4: Limiting Collection
The collection of personal information shall be limited to that which is necessary for the purposes identified by the public body. Information shall be collected by fair and lawful means.
Principle 5: Limiting Use, Disclosure and Retention
Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required or expressly authorized by law. Personal information shall be retained only as long as necessary for the fulfilment of those purposes.
Principle 6: Accuracy
Personal information shall be as accurate, complete and up-to-date as is necessary for the purposes for which it is to be used.
Principle 7: Safeguards
Personal information shall be protected by safeguards appropriate to the sensitivity of the information.
Principle 8: Openness
A public body shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.
Principle 9: Individual Access
Upon request, an individual shall be informed of the existence, use and disclosure of his or her personal information and shall be given access to that information, except where inappropriate. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.
Principle 10: Challenging Compliance
An individual shall be able to address a challenge concerning compliance with the above principles to the individual or individuals accountable for the public body’s compliance.
Reference
Protection of Personal Information Act (2001): 1. An Introduction to the Protection of Personal Information Act. GNB, Feb. 2001. Web. 23 Nov. 2016. <http:// archives.gnb.ca/documents/POPI.pdf>.
The Left Eye 