Prior versions are unavailable on CanLII In force Disposal of Personal Information , RRO , Reg General , RRO , Reg No amending legislation available on CanLII You can search for documents citing this statute on CanLII Noteup any citation to this statute Noteup a specific section or subsection from this statute: Citing or noting up a specific section or subsection If the present statute has a "Show Table of Contents" button, you will see that each section and subsection number is displayed with a link offering you convenient citation and noteup tools that are specific to each provision. You may want to use these tools instead of the above search box. Last amendment: , c. Purposes 1 The purposes of this Act are, a to provide a right of access to information under the control of institutions in accordance with the principles that, i information should be available to the public, ii necessary exemptions from the right of access should be limited and specific, and iii decisions on the disclosure of government information should be reviewed independently of government; and b to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information. Limited application re Assembly 1.
|Published (Last):||6 January 2013|
|PDF File Size:||10.92 Mb|
|ePub File Size:||19.39 Mb|
|Price:||Free* [*Free Regsitration Required]|
Public bodies governed by the Document Disposal Act must obtain authorization from the government records retention and disposition authority prior to disposal of any records. Public bodies should ensure their record retention and disposal schedules include a retention period for surveillance videotapes and other non-written recorded personal information, where applicable. If it is the policy within a public body that unsolicited resumes are not considered, the retention requirements of section 31 do not apply to resumes received in that fashion.
If the public body receives a request for access to personal information during the one-year retention period, the personal information requested must be retained for at least one year beyond the date on which the access request was closed.
If a public body or persons acting on its behalf does not use the personal information to make a decision directly affecting the individual, the Act does not require the personal information to be retained. Disposal may occur in accordance with regular retention regulations for the public body.
Example If a public body or persons acting on its behalf uses personal client information to evaluate program effectiveness within a target demographic and does not subsequently use that information to affect an individual, then the retention requirements of section 31 do not apply. The retention requirements of the Document Disposal Act still apply to this information however, and disposal activities must be in accordance with approved disposal schedules.
In cases where information has been used solely for research or statistical purposes and where no decision, adverse or otherwise, has been made about the respondents, section 31 does not apply. Example Personal information gathered in a survey is used to study trends or gather opinions. The personal information is usually rendered anonymous and rolled up into an aggregate form.
In these cases, the questionnaires or other collection instruments may be destroyed as soon as the desired information has been extracted, according to the requirements of the Document Disposal Act. Public bodies subject to the Document Disposal Act should determine what obligations they may have under that act.
Retention and disposition schedules established under the Document Disposal Act may apply. This section specifies the minimum period of time that personal information must be retained. It does not excuse public bodies from any longer retention period that may be required. Interpretation Interpretation Note 1: " Makes a decision" A public body or persons acting on its behalf "makes a decision" about a person when it uses personal information in its custody or under its control in some way that has an effect on the person concerned, for example, to determine whether or not a person is qualified for a job or entitled to a benefit or to a service.
A hospital uses personal information about a patient to determine the level and type of care to give the person. Interpretation Note 2: Retention To "retain" personal information is to keep control or custody of it, to maintain possession of it. Section 31 instructs public bodies or persons acting on their behalf to retain personal information, which means not disposing of it in any way for at least one year. This requirement gives people time to exercise their right of access to their personal information.
Retention of records for public bodies under the Document Disposal Act is controlled by retention and disposition schedules approved under that Act. Longer retention permitted Public bodies or persons acting on their behalf may keep personal information longer than one year, depending on their operational needs and as determined in approved retention and disposal schedules.
Public bodies or persons acting on their behalf should not, however, retain personal information indefinitely as this increases the potential that out-of-date and incomplete information would be available for use. The opportunities for unauthorized access or disclosure would also increase. Scheduling of records Each public body subject to the Document Disposal Act should schedule all personal information for retention and disposal in accordance with applicable policies and standards.
Storage elsewhere Section 31 does not prevent the public body or persons acting on its behalf from storing personal information in another location for the retention period, as long as it can retrieve the information readily to respond to a request for access.
A " reasonable opportunity" is a chance [to obtain access] that is within the limits of reason or which is suitable under the circumstances. The Act recognizes that people may not request access to their personal information immediately upon being informed of a decision that affects them. At the same time, the Act does not oblige public bodies to keep large quantities of personal information for excessive periods, with all the problems such indefinite retention would entail.
Last updated: July 20, Permanent link to page:.
Freedom of Information and Protection of Privacy Act
Encrypting cell phones, laptops, USBs Locking the keyboard when stepping away from the computer Mobile phone password lock Role-based security access based on need to know Transport Layer Security for transmission of files between organizations Usernames and passwords Can I contract with a third party outside Canada for appointment and recall services? Physicians are discouraged from letting personal information of patients leave Canada, even though there is no requirement under PIPA. If you do want to use a service provider that is outside Canada, you can obtain consent from the patient to use their email address for appointment and recall services. Please contact our office to make an appointment. Can I contract with a third party outside Canada for transcription services? If you do want to use a service provider that is outside Canada, you can anonymize the data by using initials instead of name or by using an ID number that is not associated with their government-issued IDs. Can I grant remote access to a third party outside Canada for transcription services?
Section 31 - Retention of personal information
FOIPPA Policy & Procedures Manual