Guidance on Consent for Collection, Use and Disclosure of Personal Information

Use this guidance to understand consent requirements under the Freedom of information and Protection of Privacy Act (FOIPPA) and the Freedom of Information and Protection of Privacy Regulation (FOIP Reg). This guidance is for ministry and non-ministry public bodies in B.C.

Public bodies can rely on consent, in limited circumstances, for collection, and in more cases for use and disclosure of an individual's personal information. Section 26(d) of FOIPPA provides authority for consent to collection and sections 32(b) and 33(2)(c) address consent to use and disclosure. The specifics of when and how to use consent is detailed below.

If a public body intends to use consent for the collection, use and/or disclosure of personal information, FOIPPA requires consent be obtained in a prescribed manner which is outlined in section 11 of the FOIPP Reg. Note: sections 3-5 of the FOIPP Reg outline who may provide consent on behalf of a minor, an adult, and a deceased individual, and for which sections of FOIPPA they may do so.

The first step is to determine whether you may rely on consent as an authority under FOIPPA to collect, use or disclose personal information. If consent is being relied on for collection, use or disclosure of personal information, you must prepare a consent form in accordance with the requirements prescribed by the FOIPP Reg.

Step 1: Determine if Consent is an Option

Before you ask an individual to consent to the collection, use or disclosure of their personal information, it is important for you to determine if consent is a valid option under FOIPPA.
Sections 26, 32 and 33 of the FOIPPA outline how a public body can collect, use, or disclose information. While consent is an option in some instances, there may be other provisions in FOIPPA that authorize the use or disclosure of personal information in your public body’s circumstances, depending on the context. Consent can only be relied on in limited circumstances for collection (see below for more information).

Consent and Collection

There are limited circumstances when you can rely on consent for collection of personal information under section 26(d) of FOIPPA. The limited circumstances are outlined in section 9 of the FOIPP Reg: 

• Recording or updating an individual’s contact information
• Updating an individual’s name, if it has officially changed 
• Notifying of a death so that benefits or services relating to the deceased may be provided or cancelled

As consent for collection can only be used in very limited circumstances, the remainder of this Guide discusses consent for use and disclosure of personal information.
If you are thinking of using consent to collect personal information you should contact your Ministry Privacy Officer (MPO) or your organization’s Privacy Officer to ensure that your use of consent is aligned with sections 9 and 11 of FOIPP Reg.

Step 2: Prepare a Consent Notice

Timing of Consent

Where you are relying on consent as an authority, you must obtain an individual’s consent before you use or disclose their personal information.

Form of Consent

Consent must be obtained in writing. Writing includes hard copy or digital signatures as well as electronic actions that acknowledge an individual is providing consent (e.g., an action such as ticking an electronic check box).

Content of a Consent Form

Section 11 of the FOIPP Reg outlines what must be included in a consent form. There are different requirements when you are asking an individual to consent to the use or consent to the disclosure of their personal information, which are outlined below.

Use of Personal Information

When you are asking an individual to consent to the use of their personal information, the consent form must contain:

• A description of the personal information the consent relates to
  • You must describe or list the personal information that you will use. The degree of detail you need to provide will vary according to the circumstances. In some cases, you may need to refer to a record containing personal information, such as “a medical file” or a “report on an individual’s examination by Dr [name] on [date]”. In other instances, you may need to list specific types of information, such as name, age, blood type, gender or income.
• The specifics of the use of the personal information
  • You will need to provide a description of how and why personal information will be used. For example, contact information is being used to send public engagement attendees of a summary of the session feedback.
• The date when the consent is effective and if applicable, the date it expires.

Disclosure of Personal Information

When you are asking an individual to consent to the disclosure of their personal information, the consent form must contain:

• A description of the personal information the consent relates to
  • You must describe or list the personal information that you will disclose. The degree of detail you need to provide will vary according to the circumstances. In some cases, you may need to refer to a record containing personal information, such as “a hospital file” or a “report on an individual’s medical examination by Dr [name] on [date]”. In other instances, you may need to list specific types of information, such as name, age, blood type, gender or income.
• The purpose of the disclosure
  • You should state the purpose of disclosure or how the personal information will be used as specifically and narrowly as possible. For example, "to post personal information on [name of public body]’s website featuring interviews or stories about or photographs of citizens promoting ​[name of public body]’s services.”
• To whom the personal information will be disclosed
  • You must state to whom the personal information will be disclosed. This could include for example to another public body, an individual, a private-sector organization in B.C., or the public via the internet.
  • If you intend to disclose personal information to a private-sector organization that is not a service provider for your public body, contact your MPO or your organization’s Privacy Officer.
• If practicable, the jurisdiction where the personal information will be disclosed
  • If practicable, you must state where the personal information will be disclosed (e.g., “information will be disclosed to the Royal Commission in the United Kingdom.”).
• The date when the consent is effective and if applicable, the date it expires.

Sample Consent Form

For an example of what a consent form could look like, see the sample consent form (Word, 30KB).