Information Privacy & Security (FOIPPA)

Effective: December 1, 2003

For the purposes of this topic, a client includes a former client of the Ministry.

Effective: December 6, 2010

In all cases where collection or disclosure of a client’s personal information is determined to be appropriate, staff must do all of the following:

• clearly establish, prior to the collection or release of information, the identity of the person from whom the information is being requested, and to whom it will be disclosed
• record in writing the information collected or disclosed
• contact the Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts] if there are any doubts regarding the collection or disclosure of a client’s personal information
• review all records before release to ensure that third party information or information leading to the identity of another person is not disclosed [see Policy – Review for Information of a Third Party or Other Person].

Effective: February 27, 2017

The Employment and Assistance Act and the Employment and Assistance for Persons with Disabilities Act (Section 10) authorize the ministry to require or seek verification of any information provided by a client. In order to confirm past or ongoing eligibility, it may be necessary to disclose information about an applicant or recipient to a third party.

The ministry may withhold benefits if client refuses to provide or permit verification of the information provided (Section 10 (4) EA and EAPWD Acts).

The Application for Assistance – Consents (Part 1 HR0080B) is signed by the client and authorizes the ministry to obtain or disclose information to verify information provided by that client. If the application is completed as a supported intake, the Application for Assistance – Verbal Consent (HR0080A) authorizes the ministry to obtain or disclose information to verify information provided by that client, for five business days. The client is required to sign in person the Application for Assistance – Consents (Part 1 HR0080B).

Effective: December 6, 2010

Ministry staff who release information must review all records before release to ensure that third party information or information leading to the identity of another person is not disclosed.  In some cases the circumstances alone may identify a third party or other person, even if they are not named. Any information that would lead to the identity of another person, for example, an information source, must be removed.  This includes words that, taken alone, would not necessarily lead to the identity, but put together or in the context of a client’s case could identify another person, for example, words such as “female,” “sister,” “neighbour,” “I heard.”

Staff should contact the Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts] if they are uncertain about anything relating to third party information in a specific case.

Effective: March 29, 2011

Release of Information by the Employment and Assistance Office or Health Assistance 

Once a client’s identity is clearly established, his or her personal information can be released to the client by the Employment and Assistance Office (EAO) or Health Assistance (HA) only if the request is for any of the following:

• a copy of a record that was submitted by the client to the ministry, for example, a doctor's letter, a pay stub, a Monthly Report (HR0081) form
• a copy of a record that was previously provided by the ministry to the client, for example, a letter from an Employment and Assistance Worker
• calculation of assistance in a tax year (T5007 information)

Release of Information relating to a Reconsideration or Appeal

When a client has submitted an Employment and Assistance Request for Reconsideration (HR0100), his or her requests for information on which the ministry decision was based are to be referred to the Reconsideration and Appeals Section, SDPR-MCFD Legislation, Litigation and Appeals Branch.

Records that will be released must be reviewed prior to release to ensure that no third party information is released. [For more information, see Policy - Review for Information of a Third Party or Other Person.]

Release of Information by Information Access Operations

If a client’s request for their personal information does not fall into one of the categories described under Policy – Release of Information by the Employment and Assistance Office, the client's written request should be forwarded to Information Access Operations for processing [see Contacts].

Correction of Client Information

Clients who believe that there is an error or omission in their personal information may request, under section 29 of the Freedom of Information and Protection of Privacy Act (FOIPPA), that the information be corrected. This applies to personal information held on physical files or in ministry information systems, such as ICM and MIS.

Where a decision is made not to correct the information, section 29 requires that an annotation be made to indicate that a correction was requested but not made.   

Authority to deal with requests for correction of personal information is delegated from the Minister to Information Privacy Analysts, in Information Access Operations (IAO), part of the Ministry of Citizens’ Services.  Requests for correction of personal information must be submitted to IAO [see Contacts].

Supervisors have authority to correct or annotate client information where an error is identified by ministry staff, as opposed to requests from clients under section 29 FOIPPA.

Effective: December 6, 2010

Ministry staff may release a client’s personal information to a third party in either of the following circumstances only:

• the client provides the ministry with a current written consent which outlines what information may be released and specifies to whom the information may be released
• the third party provides a current written consent signed by the client which outlines what information may be released and specifies to whom the information may be released

A client cannot normally consent to the disclosure of someone else’s personal information, regardless of whether the other person is a spouse, a dependent child, or a stranger. The few exceptions to this rule are outlined in the Freedom of Information and Protection of Privacy Regulation, section 3 [see Acts and Regulations]. For questions about disclosing personal information under that section, consult with the Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts].

Effective: April 15, 2013

A client may authorize the release of their personal information to any person or agency by signing a current written consent that outlines what information may be released and specifies to whom the information may be released and how the information may be used.

Information may be shared between the ministry and other public bodies, when an information sharing agreement is in place.  For general information on, or assistance in, developing information sharing agreements, consult the Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts].

The Freedom of Information and Protection of Privacy Act, (FOIPPA), S 33, provides authority to provincial government departments/ministries, crown corporations and agencies (‘public bodies’) to release personal information for specified purposes, e.g., law enforcement, litigation, debt collection.  Questions about disclosure of personal information under this section can be directed to the Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts].

Sharing Information with Other Ministry staff

Ministry staff may share the personal information of clients with one another, without requiring the client’s specific consent, if the information is specific to a case situation AND at least one of the following conditions is met:

• the information is necessary to carry out a legal function
• the information is necessary to carry out an assigned function
• the purpose for which the information is shared is consistent with the purpose for which it was provided by the client

All ministry-approved forms that gather information from clients specify the legislation under which the information is collected and the purpose for collecting the information. Information collected for one purpose may not be used for a different purpose.  Most ministry forms state that the purpose of collecting the information is for “administering the Employment and Assistance Act and the Employment and Assistance for Persons with Disabilities Act,” which permits sharing of information between staff as noted in the paragraph above.

Release of Information to the Employment and Assistance Appeal Tribunal

Information pertinent to an appeal must only be disclosed to the Employment and Assistance Appeal Tribunal (EAAT) under both of the following circumstances:

• by the Reconsideration and Appeals Section, SDPR-MCFD Legislation, Litigation and Appeals Branch
• during the course of an appeal when a right of appeal exists and a client has submitted a Notice of Appeal (HR2607) to the EAAT

The Reconsideration and Appeals Section, SDPR-MCFD Legislation, Litigation and Appeals Branch must ensure that information that is not related to the appeal will not be disclosed.

Release of Information to the Ministry of Children and Family Development

Section 96 of the Child, Family and Community Services (CF&CS) Act (Director’s right to information) obligates ministry staff to disclose to the Ministry of Children and Family Development (CFD) any information needed to perform the duties or functions authorized by the CF&CS Act [see Acts and Regulations].  The CF&CS Act under section 14 further obligates ministry staff to report child protection concerns to the Ministry of Children and Family Development. [For more information, see Related Links - Protection of Children.]  All requests for disclosure must specify S 96 and must be received in writing.

The ministry has an information sharing agreement with the Ministry of Children and Family Development under section 70 of the Adoption Act [see Acts and Regulations]. Specific requests for information under section 70 of the Adoption Act must be referred to Information Access Operations (see Contacts).

Release of Information to Police and RCMP

The ministry, through the Prevention and Loss Management Services Branch Criminal Investigations Unit, may disclose personal information to a law enforcement agency for the purpose of a law enforcement matter.  The request must meet both of the following conditions:

• be submitted in writing on agency letterhead
• specify all of the following:
  • the specific information that is required
  • confirm that the information is provided for a specific investigation and provide the investigation file number
  • that the information is required to assist in a law enforcement proceeding as defined in the Freedom of Information and Protection of Privacy Act

The Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts] can be contacted with any questions or concerns about disclosing information requested by law enforcement agencies.

Release of Information to the Family Maintenance Enforcement Program

For the purposes of this section, a debtor means a person required under the Family Maintenance Enforcement Act to pay family maintenance.  [see Acts and Regulations]

If requested, ministry staff must disclose information regarding a debtor to the Family Maintenance Enforcement Program that concerns any of the following:

• their location, address, or place of employment
• the location of their assets
• the source of their income
• particulars of their assets or income

Without the written consent of a debtor, ministry staff must not disclose personal correspondence between the debtor and a parent, child, spouse, or sibling of the debtor.

Release of Information under Coroner’s Act

If requested, ministry staff must disclose information to any person authorized to act as a coroner in BC under the Coroner’s Act [see Acts and Regulations] that relates to either of the following:

• a deceased ministry client
• the circumstances of the deceased client

Release of Information to Ombudsperson

Due to provisions in the Ombudsperson Act, which grant the Ombudsperson the ability to request and obtain information from certain public bodies, ministry staff do not need a Release of Information (ROI), Consent to Disclosure of Information, or a Freedom of Information (FOI) request to be completed before providing the requested information to the Ombudsperson in the course of an investigation. Staff must follow established protocols to consult with the ministry’s Litigation section of the Legislation, Litigation and Appeals Branch [see Contacts] before disclosing any legal advice on the file, or any other material not clearly related to the subject of the investigation.

Effective: December 6, 2010

A client may authorize the release of his or her personal information to any person or agency if the person provides a current written consent that outlines what information may be released and specifies to whom the information may be released.  [For additional information, see Consent to Disclosure of Information below.]

A client’s personal information may be disclosed without the client’s consent if compelling circumstances exist that affect another person’s health or safety.  In these situations, notice of the information disclosed must be mailed to the last known address of the client.

Release of Information for Contacting Next of Kin

Information may be disclosed without the client’s consent so that the next of kin or a friend of an injured, ill, or deceased client may be contacted.

Release of Information to Media

Government Communications and Public Engagement (GCPE) is responsible for inquiries from the media.  The Supervisor must refer all questions from the media to the ministry’s director for the GCPE [see Contacts]. All media requests for records that are not routinely releasable must be directed to Information Access Operations [see Contacts].

Release of Information to Contractors

Without the client’s consent, and provided the information is specific to a case situation and necessary to carry out a legal and assigned function, Ministry staff may share information with a person or agency who has a contract with the ministry to administer the client’s assistance or to provide services to the client.

Release of Information to MLA

Information may be disclosed without the client’s written consent to a MLA or the MLA’s staff who has been requested by a client to assist in resolving a problem.  A Certificate of Authority to Obtain Personal Information form [see Additional Resources] must be submitted prior to any information being disclosed.  Disclosure of information is only warranted during the course of resolving the client’s problem.  Staff should not disclose information about a client that they would not also provide to the client concerned.

Release of Information to Other Governments

Information may be shared with the federal government, other provinces, and other external bodies when an information sharing agreement is in place.  For questions regarding sharing of information where there is an information sharing agreement in place, or general questions about, or assistance in, preparing information sharing agreements, staff may contact the Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts].

Effective: July 11, 2018

Consent to Disclosure of Information – HR3189

In circumstances where clients wish that third parties communicate with a ministry representative, informed written consent must be given by the client.  The HR3189 form [see Forms and Letters] is to be used for this purpose.  With this form, the client is able to restrict what information can be disclosed and for the period of time covered by the consent.  The HR3189 provides great latitude in what can be discussed.  The third party may be a social worker, physician, advocate, parent, etc.  In situations where someone has legal authority to act on the behalf of the client, such as power of attorney, they may also provide this consent as outlined on the form.

Release of Personal Information – HR0095

The HR0095 [see Forms and Letters] may be used for release of information purposes, but its use should be restricted to situations where a third party requires specific information regarding type, amounts of and duration on assistance.  The completed form authorizes the ministry to release only the information specified; it does NOT authorize release of all records, or any information not specified on the form.

The HR0095 is completed by a ministry representative with the client, including only the minimum information required.  For example, the Property Tax Deferment Program requires only ministry confirmation of the applicant's Persons with Disabilities (PWD) designation; it does not require the amount of assistance received.  The client must sign the HR0095 prior to the completion by the ministry representative.

My Self Serve (MySS) registered users can view or print the HR0095. For individuals who do not have access to MySS the HR0095 can be obtained from a local service office.

Consent to Disclosure of Information – Service Authorization HR3189A

There are some circumstances when clients would like assistance navigating their interactions with the ministry.  There are some instances where it would be helpful to not only provide consent to discuss information with a third party, but also authorize them to request the start of some services.  The HR3189A form [see Forms and Letters] is to be used for this purpose.  With this form, the client is able to provide consent to what information can be disclosed, as well as what services can be initiated and authorized.  The client can authorize their representative to initiate specific services up to a maximum of one year and can cancel their authorization at any time.

Effective: February 27, 2017

Use the following procedures to collect information necessary for the management of income assistance programs:
 

1. Confirm that the Application for Assistance – Consents (Part 1 HR0080B) for the relevant period is signed and attached to the case.
2. Document the rationale for obtaining information.
3. Requests for information for an eligibility purpose can generally be forwarded to the FOI coordinator for that organization.  Include a copy of the ministry consent and declaration forms signed by the client.
4. If an individual who provides information requests confidentiality, record the information in such a way that the identity of the source cannot readily be ascertained by reading the documentation.

Information sharing agreements are in place to obtain information from:
 

• Service Canada (Canada Pension Plan and Old Age Security)
• Canada Revenue Agency
• Ministry of Advanced Education, Skills & Training (Student Loans)
• Insurance Corporation of British Columbia (ICBC)
• Motor Vehicle Branch

Information can also be obtained from:
 

• BC Online
• Equifax
• Vital Statistics Agency  (PLMS Supervisors or Ministry Investigators only)

[See Related Links – Information & Verification – Procedures for information on how to collect information from these agencies].

Effective: October 27, 2006

FOIPPA (S 32 and 34) specifies that client's personal information may only be used for a purpose consistent with the purpose for which it was obtained.

Only use client information to determine or confirm past or ongoing eligibility for assistance.

Effective: December 6, 2010

To release a client’s personal information to them, use the following procedures:
 

1. Clearly establish, prior to the release of information, the identity of the person from whom the information is being requested and to whom it will be disclosed.
2. Contact Information Access Operations [see Contacts] if uncertain about any aspect of the release of information to a client, or former client.
3. Review all records before release to ensure that they do not contain information that references other individuals (third parties).
4. Record in writing the information disclosed.
5. Attach written requests for information, and client consents required, to the ministry’s copy of any information that is disclosed, and place together on the appropriate ministry file (for example, the income assistance case).

Effective: December 6, 2010

As set out in the Freedom of Information and Protection of Privacy Act (FOIPPA) under Section 33(2)(g), information may be disclosed to an MLA or MLA staff, including the Constituency Assistant (CA), if the MLA’s office has been requested by a client to assist in resolving that client’s problem:

“33.2 A public body may disclose personal information referred to in section 33 inside Canada as follows:  (g) to a member of the Legislative Assembly who has been requested by the individual the information is about to assist in resolving a problem.”

To ensure consistency across government in responding to enquiries made on behalf of an MLA that fall under FOIPPA section 33(2)(g), a “Certificate of Authority to Obtain Personal Information” [see Additional Resources] is now required to constitute a sufficient basis upon which government ministries may disclose to MLAs and their staff personal information as needed in order for them to assist constituents in resolving problems.

Note: If you receive an inquiry on behalf of an MLA and the “Certificate of Authority to Obtain Personal Information” has not been provided, a copy of this completed protocol must first be obtained before releasing any personal information about a client.

For other MLA’s office requests that do not fall under FOIPPA section 33(2)(g), a written consent must first be obtained before releasing the personal information that is requested [see Forms and Letters – Consent to Disclosure of Information].

Ministry staff  who are in doubt as to whether certain information is confidential must ask for guidance.  Common questions can be directed to the Privacy, Compliance and Training Branch (PCT) Corporate Information and Records Management Office [see Contacts] for clarification.

For record keeping purposes, ministry staff must record on the client's electronic file the following information:
 

•         Date of inquiry.
•         Name of requestor and position.
•         Nature of the inquiry.
•         Description of information released to requestor.

Ministry staff will also keep a copy of the “Certificate of Authority to Obtain Personal Information” on the client's case.

Effective: June 27, 2012

To assist clients who request access to information [see  Policy – Access to Personal Information By a Client – Release of Information by Information Access Operations], use the following procedures:
 

1. Inform the client that their request will be processed on behalf of the ministry by Information Access Operations (IAO), part of the Ministry of Citizens’ Services.
2. Inform the client that their request must be in writing, and must include a signature.  The client may use the online form  – Request For Access To Personal Information – Freedom of Information and Protection of Privacy Act (FOIPPA) [see Additional Resources - Submit Personal Freedom of Information Request].
3. If the client prefers to submit a written request rather than using the online form, print a copy of the form and issue it to the client.   Use of the form is optional; the client may submit a request in the form of a letter.  Inform the client that they may submit their written request in either of the following ways:

• Directly to IAO by fax or mail [see Contacts];
• To the Employment and Assistance Office (EAO) for forwarding to IAO. The office must fax the request immediately to IAO [see Contacts] and send the original to IAO in House Mail. Please note that placing a request on ICM will not result in IAO being notified.

Effective: June 27, 2012

Staff who make an entry in a ministry information system, such as ICM or MIS, and then discover that the entry was made in error may, in most cases, correct the information pursuant to section 28 of the Freedom of Information and Protection of Privacy Act (FOIPPA).  

Depending upon the situation, a correction may be made by deleting incorrect information (factual information) or adding a separate annotation.   However, users and supervisors do not have the ability to delete comments on the history screen in MIS or Contact/SR/Case Notes once they have been locked in ICM.  In addition, where the incorrect information is discovered some time after the original entry and additional comments have been added in the interim, users and supervisors do not have the ability to add an annotation so that it will appear directly adjacent to the original entry.    Where users or supervisors do not have the ability to make corrections themselves, they must submit a request to the Ministry Support Help Desk [see Contacts].

In addition, where clients initiate requests to have their personal information corrected, pursuant to section 29 of the FOIPPA, the requests must be directed to Information Access Operations (IAO), part of the Ministry of Technology, Innovation and Citizens’ Services.  An Information Privacy Analyst with IAO will provide direction and approval to make a correction or annotation.     

SITUATION	ACTION	PROCEDURE
Employee records an entry (a comment in MIS or a Contact/SR/Case Note in ICM) and then immediately determines it is incorrect or does not belong to the client	EAW makes assessment. Supervisor may make request to SD Support under s.28 of FOIPPA.	If the original entry was placed on the correct client file: EAW adds a new comment or note in ICM explaining the correction.  (The annotation will appear immediately below the original entry, and be automatically replicated to MIS). If the original entry was placed on the contact tab (which is visible to both the Ministry of Social Development and Poverty Reduction and Ministry of Children and Family Development), Supervisor forwards request to the Ministry Support Help Desk, asking that original entry be deleted. If the original entry was placed on the incorrect client file: EAW makes new entry(s) on correct case in ICM.  (The note will be automatically replicated to MIS). Supervisor forwards request to the Ministry Support Help Desk, asking that original entry be deleted.
Employee records an entry (a comment in MIS or a Contact/SR/Case Note in ICM) and later determines it is incorrect or does not belong to the client.	Supervisor makes request to the Ministry Support Help Desk under s.28 of FOIPPA.	EAW makes new entry(s) on correct case in ICM, with an explanatory comment if required to clarify sequence of events (note will be automatically replicated to MIS). Supervisor forwards a request to the Ministry Support Help Desk, asking that the original entry(s) be deleted. If the original entry was placed on the Contacts tab (which is visible to both the Ministry of Social Development and Poverty Reduction and Ministry of Children and Family Development), and includes personal identifying information, this must also be reported as a potential information incident [see Resources for Staff].
Client states that factual information recorded is incorrect or incomplete.	Client to make request to IAO under s.29 of FOIPPA	If request is received in a ministry office, redirect the request to IAO [see Contacts]. The request must be in writing. IAO contacts the Supervisor to make determination. If IAO determines that no adequate proof exists, Supervisor annotates the file with the correction that was requested but not made.    Supervisor advises client of decision by letter1, with a cc to IAO. If IAO determines that adequate proof exists, Supervisor, as directed by IAO, either: adds an annotation; or (where a deletion is required or the annotation must appear adjacent to the original entry to which the annotation applies)   forwards an e-mail with Supervisor’s and IAO’s approval to the Ministry Support Help Desk requesting deletion or correction. The Ministry Support Help Desk advises Supervisor when complete.   Supervisor advises client of decision by letter1, with a cc to IAO.
Client does not agree with a subjective opinion recorded in MIS comment or ICM Contact/SR/Case Note.	Client to make request to IAO under s.29 of FOIPPA	If request is received in a ministry office, redirect the request to IAO [see Contacts]. The request must be in writing. IAO contacts the Supervisor to make determination. IAO provides direction as to an annotation to be made. Supervisor, as directed by IAO, either: adds an annotation; or (where the annotation must appear adjacent to the original entry to which the annotation applies) b. forwards an e-mail with Supervisor’s and IAO’s approval to the Ministry Support Help Desk  requesting correction. The Ministry Support Help Desk advises Supervisor when complete. Supervisor advises client of decision by letter1, with a cc to IAO.
[1] The letter must include the following paragraph: “Under Section 52 of the Freedom of Information and Protection of Privacy Act (FOIPPA), you may ask the Information and Privacy Commissioner to review any matter concerning the ministry’s response to your request.  You have 30 days from receipt of this notice to request a review by writing to the Office of the Information and Privacy Commissioner, PO Box 9038, Victoria BC  V8W 9A4, telephone 250-387-5629 or facsimile 250-387-1696.”

Effective: March 29, 2011

Where clients initiate requests to have their personal information corrected, pursuant to section 29 of the Freedom of Information and Protection of Privacy Act (FOIPPA), the requests must be directed to Information Access Operations (IAO), part of the Ministry of Technology, Innovation and Citizens’ Services.  An Information Privacy Analyst with IAO will provide direction and approval to make a correction or annotation.
 

SITUATION	ACTION	PROCEDURE
Employee determines that a record filed on the physical file does not belong to the client.	Advise EAW.  EAW makes assessment.	If positive, EAW approves record to be filed on the correct file.
Client states that factual information recorded in physical file is incorrect or incomplete.	Client to make request to IAO under s.29 of FOIPPA	If request is received in a ministry office, redirect the request to IAO [see Contacts]. The request must be in writing. IAO contacts the Supervisor to make determination. If IAO determines that no adequate proof exists, Supervisor annotates the file with the correction that was requested but not made. Supervisor advises client of decision by letter1, with a cc to IAO. If IAO determines that adequate proof exists, Supervisor, as directed by IAO, directs the record to be edited or changed. Supervisor advises client of decision by letter1, with a cc to IAO.
Client does not agree with a subjective opinion recorded in physical file.	Client to make request to IAO under s.29 of FOIPPA	If request is received in a ministry office, redirect the request to IAO [see Contacts]. The request must be in writing. IAO contacts the Supervisor to make determination. IAO provides direction as to annotation to be made. Supervisor instructs the physical file to be annotated by adding the submission from the client, as directed by IAO. Supervisor advises client of decision by letter1, with a cc to IAO.
[1] The letter must include the following paragraph: “Under Section 52 of the Freedom of Information and Protection of Privacy Act (FOIPPA), you may ask the Information and Privacy Commissioner to review any matter concerning the ministry’s response to your request.  You have 30 days from receipt of this notice to request a review by writing to the Office of the Information and Privacy Commissioner, PO Box 9038, Victoria BC  V8W 9A4, telephone 250-387-5629 or facsimile 250-387-1696.”

Effective: December 1, 2003

[For information regarding requests for T5007 information (calculation of assistance in a tax year), see Related Links – Individual Case Management – Policy.]