If you are or will be a contractor that handles personal information while working with the Province, you need to be aware of additional responsibilities and training associated with that contract.
In British Columbia, the collection, use, disclosure, and/or storage of personal information by government or other public bodies is protected under the Freedom of Information and Protection of Privacy Act (FOIPPA), to ensure that personal information is handled appropriately.
Under FOIPPA, when government ministries or other public bodies enter into a contract involving personal information, the contractor is bound by the same obligations under FOIPPA as the ministry or other public body. Therefore, specific requirements apply to contractors regarding what they can and cannot do with that personal information, and how they should protect that information. These requirements are summarized in the Privacy Protection Schedule.
What Is Personal Information?
Personal information is recorded information about an identifiable individual, other than business contact information. Examples of personal information include, but are not limited to: an individual’s home address, date of birth, medical conditions, financial situation, criminal record, etc. Images of an identifiable individual are also personal information. Click here for further non-exhaustive examples of what could be considered personal information.
What Are the Obligations Regarding Personal Information?
If you are considering entering into a contract where you will be handling personal information, you are responsible for fully understanding your obligations regarding that information. Your obligations may vary, depending on the nature of the personal information and how much control you have over that information.
Contracts where the contractor is handling personal information will include privacy related obligations. For example, the contract will include a Privacy Protection Schedule that describes exactly how you are required to manage personal information. If you have or are interested in this type of contract, be sure you understand what you will be required to do; ask the solicitation’s government contact person clarifying questions if you require further information.
This resource on Protecting Personal Information may help you to better understand what is required in this situation.
Mandatory Contractor Training
If you enter into a contract with a government ministry where you will be handling personal information, any of your and/or your subcontractors' staff involved in handling that information will be required to take privacy training before work can begin. Refer to Privacy Training for more information, including a step-by-step guide for contractors.
Refer to the Privacy Protection heading under Records Management and the FOIPPA and to Privacy & Personal Information in the Public Sector for information provided to ministry staff on privacy protection.