More topics

Section 32 - Use of Personal Information

Last updated on April 27, 2016

Overview

Section 32 stipulates the limited conditions under which public bodies may use personal information that is in their custody or under their control.

Section Reference

Section 32 of the Freedom of Information and Protection of Privacy Act

A public body must ensure that personal information in its custody or under its control is used only

  1. for the purpose for which that information was obtained or compiled, or for a use consistent with that purpose (see section 34),
  2. if the individual the information is about has identified the information and has consented, in the prescribed manner to the use, or
  3. for a purpose for which that information may be disclosed to that public body under sections 33 to section 36.

Summary

Section 32 must be read in concert with section 26, which establishes the purposes for which information can be collected by a public body.

Section 32 requires public bodies to use personal information only for the purpose for which it was originally collected, unless:

  1. the information is to be used by the public body for a purpose which is reasonably and directly related to the original purpose for collection (See section 34);
  2. the person the information is about identifies the information and agrees to another use; or,
  3. the information is to be used for reasons for which the information was disclosed to the public body under sections 33 to 36.

Policy

  1. When considering using previously collected personal information, public bodies shall determine whether the proposed new use meets one of the three criteria established in section 32 of the Act. Any use not meeting one of the three criteria is not permitted under the Act.
  2. Any consent by an individual must be an informed consent, which must include informing the individual of:
    • the exact nature and extent of personal information held by the public body about the individual;
    • the proposed new use for the personal information;
    • the potential impact or consequences on the individual of his or her consent to the new use for the personal information; and
    • the right of the individual to refuse to consent and that there will be no repercussions for refusing consent.
  3. The absence of consent shall be interpreted as the absence of authorization. Where the person concerned has not consented to a new use of the personal information, public bodies cannot assume consent to the new use.
  4. Public bodies may not penalize an individual for refusing to consent to a new use of their personal information, by denying benefits or services for which their personal information was originally collected.

Procedure

  1. Consent for an additional or different use should be requested at the time of collection, if that additional or different use has been anticipated prior to collection. Consent may, however, be requested later, if the new use is not proposed until later.

Example

  • A public body compiles a mailing list containing personal information for one of its operating programs. It then begins a new program and plans to use the same mailing list for this program. If the programs are unrelated this use of the personal information is not consistent with the use for which the public body originally collected it, and the public body gets consent from each individual before including her or his personal information in a mailing list for the second operating program.

  1. The classes of persons who may provide consent for minors, incompetents, deceased persons, or other individuals in giving or withholding consent are prescribed in section 3 of the Freedom of Information and Protection of Privacy Regulation.

  2. When public bodies are seeking consent for a new use of personal information, the consent must meet the requirements established in section 11 of the Regulations to the Act.  According to Regulation 155/2012, paragraph 11, consent must be in writing and must specify to whom the personal information may be disclosed and how it may be used.

  3. The individual should be provided with an Informed Consent Form that provides the necessary information for the individual to make an informed decision.

  4. The public body should consider any relevant documentation it may possess when determining whether the purpose for disclosure of personal information meets the requirements of sections 33 to 36.

  5. The public body is to document, as fully as possible, all decisions to invoke section 32 in order to use previously collected personal information for a new purpose. This should be done even in instances where the public body believes that the new use is consistent with the purpose for which the personal information was originally collected.

  6. The Privacy Impact Assessment Process may assist a public body that is reviewing the use of personal information.

Interpretation

Interpretation Note 1 (Section 32(a)):

"Use"

"Purpose"

Paragraph 32(a) allows a public body to use personal information for:

  • the purpose for which the information was obtained or compiled, in accordance with section 26 (Purpose for which personal information may be collected);
  • a use that is reasonably and directly related to the original use and that is necessary for performing the statutory duties or operating a legally authorized program of the public body, in accordance with section 34 (Definition of consistent purposes).

A public body can disclose personal information provided there is authority to do so under sections 33 to 36. However, a public body collecting personal information under these circumstances must have authority under section 26 to collect the information.

That purpose must conform to section 26 which restricts the purposes of collection to the following:

  • where the collection is expressly authorized by legislation;
  • where the collection is needed for law enforcement purposes; or,
  • where it is needed to administer a particular program or activity.

Thus, a public body may make use of the personal information it has gathered, only for the reasons for which it has gathered, created or manipulated it.

obtained or compiled

"Obtained"

"Compiled"

For a use consistent with that purpose

A "consistent use" is defined in section 34 (Definition of consistent purposes) of the Act as a use that is directly related to the original use and that is necessary to performing the statutory duties or operating a legally authorized program of the public body.

Example of consistent use

  • Alcohol and drug program officials wish to evaluate the effectiveness of a drug-counseling program. They use the personal information they have collected from the program's participants in the evaluation to determine its effectiveness in comparison with other treatment programs. The use of the information for evaluation is considered consistent with the original purpose for which the personal information was collected by the public body.

Example of non-consistent (i.e., improper) use

  • A community college collects personal information to survey community college students for their views on the college's course content in an effort to modify courses to meet changing needs of the student population. The college may use the information it collects from the students only to compile statistics or a report on the students' views. It may not subsequently use the information for a second, totally unrelated purpose (e.g., to lower the marks of those students who make unfavourable comments on the college's courses or professors).

Interpretation Note 2 (Section 32(b)):

"Identified"

Has consented, in the prescribed manner

The person must agree to the new use in accordance with the requirements set out in section 11 of the Regulation.

See also Policy #2 of this section.

The absence of consent is interpreted as the absence of authorization. Where the person concerned has not consented to a new use of personal information public bodies cannot assume consent to the new use.

Interpretation Note 3 (Section 32(c)):

For a purpose for which that information may be disclosed to that public body under sections 33 to 36

Where public body "A" has received personal information from public body "B" under section 33 to 36, public body "A" may use that information for the purpose for which it was disclosed by public body "B".

Without this provision, a public body would be unable to use personal information which other public bodies are authorized to disclose to them.

A public body can disclose personal information provided there is authority to do so under sections 33 to 36. However, a public body collecting personal information under these circumstances must have authority under section 26 to collect the information.

Sections 33 to 36 authorize disclosure of personal information for specific purposes. If a public body receives personal information under those sections or subsections, then it may use that personal information only for those specific purposes. For further information, see the following sections:

  • Section 33: Disclosure of personal information (variety of purposes)
  • Section 34: Definition of consistent purpose
  • Section 35: Disclosure for research or statistical purposes
  • Section 36: Disclosure for archival or historical purposes

Examples

  • One public body issues a subpoena to a second public body, as part of a court case it is preparing. The second public body is authorized to disclose personal information to the first public body under paragraph 33(e) in response to a subpoena. Paragraph 32(c) permits the first public body to use that information for its court case..
  • A public body has a client who has just died. It wishes to contact the next of kin of the deceased to inform him/her of the death but does not have the relative's address. A second public body does have the address and, on the request of the first public body, may disclose it in accordance with paragraph 33(q) of the Act. The first public body may in turn use the information solely in order to contact the relative and may not use it for any other purpose.

Sectional Index of Commissioner's Orders

For orders organized by the Act's section numbers, Click here.

For a summary of Commissioner's orders and policy interpretation of key points, Click here.

Last updated: July 20, 2007