Section 33.1 - Disclosure Inside or Outside Canada
Section 33.1 establishes a narrowly defined set of purposes under which a public body may disclose personal information outside Canada. Sections 33.1 and 33.2 combined, list the only circumstances under which a public body may disclose personal information inside Canada.
Section 33.1 of the Freedom of Information and Protection of Privacy Act
(1) A public body may disclose personal information referred to in section 33 inside or outside Canada as follows:
(a) in accordance with Part 2;
(a.1) if the information or disclosure is of a type described in section 22 (4) (e), (f), (h), (i) or (j);
(b) if the individual the information is about has identified the information and consented, in the prescribed manner, to its disclosure inside or outside Canada, as applicable;
(c) in accordance with an enactment of British Columbia, other than this Act, or Canada that authorizes or requires its disclosure;
(c.1) if it is made available to the public in British Columbia under an enactment, other than this Act, that authorizes or requires the information to be made public;
(d) in accordance with a provision of a treaty, arrangement or written agreement that
(i) authorizes or requires its disclosure, and
(ii) is made under an enactment of British Columbia, other than this Act, or Canada;
(e) to an individual who is a minister, an officer of the public body or an employee of the public body other than a service provider, if
(i) the information is necessary for the performance of the duties of the minister, officer or employee, and
(ii) in relation to disclosure outside Canada, the outside disclosure is necessary because the individual is temporarily travelling outside Canada;
(e.1) to an individual who is a service provider of the public body, or an employee or associate of such a service provider, if
(i) the information is necessary for the performance of the duties of the individual in relation to the public body, and
(ii) in relation to disclosure outside Canada,
(A) the individual normally receives such disclosure only inside Canada for the purpose of performing those duties, and
(B) the outside disclosure is necessary because the individual is temporarily travelling outside Canada;
(f) to an officer or employee of the public body or to a minister, if the information is immediately necessary for the protection of the health or safety of the officer, employee or minister;
(g) to the Attorney General or legal counsel for the public body, for the purpose of preparing or obtaining legal advice for the government or public body or for use in civil proceedings involving the government or public body;
(h) to the minister responsible for the Coroners Act or a person referred to in section 31 (1) of that Act, for the purposes of that Act;
(i) the disclosure is for the purposes of collecting amounts owing to the government of British Columbia or a public body by
(A) an individual, or
(B) a corporation of which the individual the information is about is or was a director or officer, and
(ii) in relation to disclosure outside Canada, there are reasonable grounds for believing that
(A) the individual the information is about is in, resides in or has assets in the other jurisdiction, or
(B) if applicable, the corporation was incorporated in, is doing business in or has assets in the other jurisdiction;
(i.1) for the purposes of
(i) a payment to be made to or by the government of British Columbia or a public body,
(ii) authorizing, administering, processing, verifying or canceling such a payment, or
(iii) resolving an issue regarding such a payment;
(j) [Repealed 2011-17-13.]
(k) for the purposes of
(i) licensing or registration of motor vehicles or drivers, or
(ii) verification of motor vehicle insurance, motor vehicle registration or drivers licences;
(l) for the purposes of licensing, registration, insurance, investigation or discipline of persons regulated inside or outside Canada by governing bodies of professions and occupations;
(i) the head of the public body determines that compelling circumstances exist that affect anyone's health or safety, and
(ii) notice of disclosure is mailed to the last known address of the individual the information is about, unless the head of the public body considers that giving this notice could harm someone's health or safety;
(m.1) for the purpose of reducing the risk that an individual will be a victim of domestic violence, if domestic violence is reasonably likely to occur;
(n) so that the next of kin or a friend of an injured, ill or deceased individual may be contacted;
(o) in accordance with section 36 (disclosure for archival or historical purposes);
(p) if the disclosure
(i) is necessary for
(A) installing, implementing, maintaining, repairing, trouble-shooting or upgrading an electronic system or equipment that includes an electronic system, or
(B) data recovery that is being undertaken following the failure of an electronic system
that is used in Canada, by the public body or by a service provider for the purposes of providing services to a public body, and
(ii) in the case of disclosure outside Canada, results in temporary access and storage that is limited to the minimum period of time necessary to complete the installation, implementation, maintenance, repair, trouble-shooting, upgrading or data recovery referred to in subparagraph (i);
(p.1) if the disclosure
(i) is necessary for the processing of information and if that processing does not
(A) involve the intentional access of the information by an individual, or
(B) result in the storage of personal information, other than personal information that is metadata, outside Canada, and
(ii) in the case of disclosure outside Canada, results in temporary access that is limited to the minimum period of time necessary to complete the processing;
(p.2) if the information is metadata that
(i) is generated by an electronic system, and
(ii) describes an individual’s interaction with the electronic system,
(iii) if practicable, personal information in individually identifiable form has been removed from the metadata or destroyed, and
(iv) in the case of disclosure to a service provider, the public body has prohibited any subsequent use or disclosure of personal information in individually identifiable form without the express authorization of the public body;
(q) if the information was collected by observation at a presentation, ceremony, performance, sports meet or similar event
(i) at which the individual voluntarily appeared, and
(ii) that was open to the public;
(r) if the information
(i) was disclosed on a social media site by the individual the information is about,
(ii) was obtained or compiled by the public body for the purpose of enabling the public body to engage individuals in public discussion or promotion respecting proposed or existing initiatives, policies, proposals, programs or activities of the public body or respecting legislation relating to the public body, and
(iii) is disclosed for a use that is consistent with the purpose described in subparagraph (ii);
(s) in accordance with section 35 [disclosure for research or statistical purposes];
(t) to comply with a subpoena, a warrant or an order issued or made by a court, person or body in Canada with jurisdiction to compel the production of information.
(a) to another law enforcement agency in Canada, or
(b) to a law enforcement agency in a foreign country under an arrangement, a written agreement, a treaty or provincial or Canadian legislative authority.
(3) The minister responsible for this Act may, by order, allow disclosure outside Canada under a provision of section 33.2 in specific cases or specified circumstances, subject to any restrictions or conditions that the minister considers advisable.
(4) In addition to the authority under any other provision of this section or section 33.2, the Insurance Corporation of British Columbia may disclose personal information if
(a) the information was obtained or compiled by that public body for the purpose of insurance provided by the public body, and
(b) the disclosure of the information is necessary to investigate, manage or settle a specific insurance claim.
(5) In addition to the authority under any other provision of this section or section 33.2, a provincial identity information services provider may disclose personal identity information
(a) to enable the provincial identity services provider to provide services under 69.2, or
(b) to a public body if the disclosure is necessary to enable the public body to identify an individual for the purpose of providing a service to the individual.
(6) In addition to the authority under any other provision of this section or section 33.2, a public body may disclose personal identity information to a provincial identity information services provider if the disclosure is necessary to enable
(a) the public body to identify an individual for the purpose of providing a service to the individual, or
(b) the provincial identity information services provider to provide services under section 69.2.
(7) Without limiting the authority under any other provision of this section or section 33.2, a public body may disclose personal information to the individual the information is about if
(a) the individual has initiated contact with the public body about a matter and the public body is responding to that contact,
(b) the public body discloses information only in respect of the matter, and
(c) the public body uses
(i) the same communication method used by the individual to initiate contact, or
(ii) another communication method authorized by the individual.
Section 33.1 permits, not requires, disclosure at the discretion of the public body. As indicated by the word "may" in the opening phrase, a public body uses its discretion and considers each new situation on its own merits. The word "only" indicates that any disclosures of personal information, outside of Canada, are limited to the circumstances outlined in section 33.1.
- Public bodies may not penalize people for refusing to consent to a new disclosure of their personal information by denying them the benefit or service for which their personal information was originally collected, or in any other way.
- Ministries that are contemplating new legislation or revisions to existing legislation that have privacy or access implications, or are developing or making changes to programs or electronic systems that collect, store, use or disclose personal information, must complete a privacy impact assessment (PIA) as required by section 69(5) of the Act and in accordance with the Core Policy and Procedures Manual (section 12.3.3) Privacy Impact Assessments. All PIA’s related to legislative changes or to program and system initiatives that involve data linkages, information sharing, outsourcing, or are of a corporate nature must be submitted to the Minister responsible for the Act for review.
- Public bodies should disclose only the minimum personal information necessary to meet the operational requirements under the specific subsection of section 33.1.
- For the purposes of section 33.1(b), the person to whom the information pertains must agree to the disclosure in accordance with the requirements set out in regulation 11 and must specifically consent to the information being disclosed outside of Canada, if this is the case. Wherever possible, public bodies should obtain consent for all anticipated disclosures at the time that they collect the personal information (see manual section 32).
- Under section 33.1(c), disclosure may occur outside of Canada where it is authorized or required by an enactment of Canada or British Columbia.
- If a public body discovers that it has accidentally disclosed an individual’s personal information and the disclosure was not authorized by section 33.1, the public body must:
- follow the Information Incident Management Process;
- take steps to recover the personal information from all sources to which it has been disclosed;
- determine the impact of the disclosure, and advise senior staff as appropriate;
- advise, where appropriate, the individual whose information has been disclosed of the disclosure, explain the steps being taken to recover the information, and inform the individual of his/her right to complain to the Information and Privacy Commissioner;
- advise both the Legislation, Privacy and Policy branch and the Office of the Information and Privacy Commissioner (OIPC) in situations where the disclosure may have a serious public or personal impact;
- examine policies and processes that may have led to the breach of privacy and revise if necessary; and,
- provide staff education regarding privacy issues involved in the breach to reduce the potential of a future occurrence.
Privacy Protection Offences
Section 74.1 states that a person who discloses personal information not authorized by the Act commits an offence. The fines for committing such an offence are up to $500,000 for a corporation; up to $25,000 for a partnership or an individual who is a service provider; and up to $2,000 for an individual who is not a service provider (for example, an employee). Section 74.1(8) states that in the defence of a prosecution of an offence under section 74.1, the person charged can try to prove that they exercised due diligence to avoid committing the offence.
- According to Regulation 155/2012, paragraph 6, consent must be in writing and must specify to whom personal information may be disclosed and how it may be used (see manual section 32(b)).
- Consent must specifically state that the information may be disclosed outside Canada, if this is the case.
- Unless compelling reasons exist requiring the contrary, disclosures are recorded in writing. If a public body receives a verbal request for personal information and discloses it verbally, the transaction should be recorded in writing.
- All agreements, arrangements and treaties under which public bodies disclose personal information must be entered into the Information Sharing Agreement section of the Personal Information Directory that is published and maintained by KIS.
- Public bodies should ensure that incoming requests for personal information from other public bodies or law enforcement agencies are authorized and contain the following details:
- the name of the individual whose information is requested;
- the exact nature of the information desired;
- the authority under which the information is requested;
- the purpose for which the requesting agency will use the information; and,
- the name, title and address of the person authorized to make the request.
- The written request for personal information under this section and the outgoing correspondence (recording the fact that disclosure did or did not take place) should be retained on file. A written record of a verbal request and disclosure should be retained on file.
- A "notice of disclosure" must be in writing and must describe the specific personal information elements, which were disclosed, when, to whom and for what purpose.
- A copy of the notice is also placed on the file of the person whose personal information has been disclosed.
Public bodies may disclose personal information inside or outside Canada "in accordance with Part 2" in response to a request under section 5 (How to make a request). Part 2 of the Act permits disclosure:
- where the person concerned has requested access to information, including his/her own personal information, subject to the exceptions in sections 12 to 22;
- where a person or body has requested access to records containing the personal information of a third party and disclosure of the personal information does not constitute an unreasonable invasion of the privacy of the third party concerned under section 22, subject to other exceptions and to third party notification requirements; or
- where section 25 applies (Information must be disclosed if in the public interest).
"Identified" means that the person is aware of the specific information to be disclosed and has been informed of the new use to which the information will be put and of the consequences of agreeing or refusing to the disclosure.
The absence of consent is interpreted as the absence of authorization. Where the person concerned has not consented to a disclosure of personal information, public bodies cannot assume consent to the new disclosure.
If the person concerned approves a disclosure, it means that the person knows the consequences of the disclosure of his/her personal information and may make an informed decision about whether or not to agree to it.
If the person concerned consents to his or her personal information being disclosed, he or she must specifically consent to it being disclosed outside of Canada.
- A university researcher asks a high school for the names and addresses of graduating students in order to contact them for a survey he is conducting. The school releases this information only if the students involved have given consent.
Under subsection 33.1(1)(c), disclosure may occur outside of Canada where it is authorized or required by an enactment of Canada or British Columbia.
The "treaty, arrangement or agreement" must specifically authorize or compel the disclosure of the personal information that is released under section 33.1(1)(d). It is not enough that disclosure would assist in a program’s operation. Further, if a "treaty, arrangement or agreement" is used to release personal information under section 33.1(d), the authority to enter into the “treaty, arrangement or agreement” must be clearly established in an enactment for this provision to apply. The Government of Canada has sole power to conclude treaties with foreign countries.
Subsection 33.1(d) does not authorize public bodies to disclose personal information under the legislation of other provinces or other countries.
"Arrangements" should normally be in writing. A verbal arrangement is acceptable only on rare occasions, for example, where one or more of the participants do not wish to acknowledge that they have concluded an arrangement on sensitive law enforcement, security or intelligence matters. Where an arrangement is unwritten, the head of the public body approves disclosures of personal information that take place as part of the arrangement.
Before disclosing personal information under section 33.1(d), public bodies should ascertain that the treaty, arrangement or agreement, contains language specifically authorizing or requiring such exchange of information and,
- ensure that provisions for such an agreement are clearly spelled out in an enactment of British Columbia or Canada, or,
- ensure that the language of an enactment of British Columbia or Canada specifically provides for such an exchange of information.
Public bodies may use this provision to disclose personal information to a minister in situations where the information is “immediately” necessary for the performance of the Minister’s duties.
"Immediately necessary for the performance of the duties" means that the minister must need to see, generate or handle the personal information without delay in order to do his/her job. This may include the administration of statutes, regulations, programs and other activities.
Public bodies may use this provision to disclose personal information to an officer or employee of the public body or to a minister if it is immediately required to protect the health or safety of the officer, employee or minister. This means that the minimum amount of personal information is disclosed to the fewest number of people necessary.
Paragraph 33.1(1)(f) does not allow disclosure to the employees or officers of other public bodies
An "employee" is a person employed by a public body. The definition of employee in Schedule 1 of the Act includes a service provider retained to perform services for the public body. The term "officer" is included to ensure that all persons working for a public body in any capacity are encompassed by this disclosure provision.
- A student working with a public body as part of their educational activities or doing a practicum are to be deemed to be either an employee or an officer for the purposes of this Act.
"For the protection of the health or safety of the officer, employee or minister" means that the disclosure must be necessary to prevent harm to the health or safety of the person in question (officer, employee or minister).
- A public body has a client who is known to behave violently when dealing with the employees of this public body. The public body has told its employees about this client's behaviour and has instructed them to arrange for a security guard to be present whenever the client is known to be coming to the office for an appointment. This enables employees dealing with the client to take precautions for their own safety.
- A prison inmate with active hepatitis is due to be transferred from one institution to another. To enable escort officers to take adequate precautions against contracting hepatitis, it is permissible to warn them that the prisoner has a highly contagious disease and to tell them what measures they should take to minimize the risk of infection.
The Attorney General represents the government in legal matters and often requires access to personal information to discharge his/her legal duties. The Attorney General Act RSBC 1996, c. 22, contains no specific provision authorizing ministries and other public bodies to disclose personal information. Section 33.1(g) of the Act provides for such disclosures where appropriate.
- The Ministry of Transportation is named as a party in a civil proceeding for personal injuries in an accident that involved a bridge collapse on a public highway. The Ministry may disclose personal information about the victims and witnesses to the Attorney General to assist in the civil proceeding.
"Civil proceedings involving the government" are legal proceedings involving private rights and remedies (as opposed to criminal matters) in which the government of British Columbia or a public body is a party.
Government ministries and agencies must comply with the policies and procedures for responding to requests by the Ministry of Attorney General for disclosure of personal information to assist in legal proceedings involving the government of British Columbia. Contact your Information and Access Coordinator to obtain a copy of these procedures.
Obtain written confirmation that the person/entity to which personal information is to be released under this section is authorized under subsection 36(1) of the Coroners Act to receive the information. Public bodies may wish to consult with their legal representatives and respond accordingly.
Public bodies may disclose personal information to people who are authorized under section 36 of the Coroners Act, RSBC 1996, c. 72, to appear personally or by counsel at the inquest; to tender evidence and call witnesses; to examine, cross examine, and re-examine witnesses; and to obtain from the coroner a summons directed to any witness whom they desire to call.
Disclosures under this provision, including disclosure to the minister responsible for the Coroners Act, must be for the purposes of the Coroners Act.
The Coroners Act provides coroners with the authority to hold inquests into deaths due to certain causes (including deaths by violence, misadventure, negligence, malpractice, suicide, pregnancy, occurring suddenly and unexpectedly, by unknown diseases or causes, occurring in correctional institutions or prisons, occurring while resident in a community care facility or while in the custody of a peace officer).
Subsection 36(1) of the Coroners Act permits people, whose interest may be affected by evidence likely to be introduced at an inquest, to appear personally or be represented by counsel at the inquest. It also permits them to tender evidence and call witnesses, examine, cross-examine and re-examine witnesses and to obtain from the coroner a summons directed to any witness whom the person wishes to call.
Subsection 36(2) of the Coroners Act states that, where the inquest is into the death, arising out of his/her work, of a worker to whom Part 1 of the Workers Compensation Act applies, a representative of his/her employer and a representative of the trade union certified as the bargaining agent for the worker are deemed to be the persons to whom subsection 36(1) applies.
When considering disclosure under this provision, a public body must ensure that the request is in writing and that it specifies the nature of the personal information to be disclosed, the name of the person whose information is requested (and any other necessary identifying information, such as file number), the purpose of the request (including a citation of the legal authority for collecting the monies) and the name, title and address of the official making the request.
The only personal information that should be released in response to such requests is the minimum amount needed to locate the person (e.g., last known address or telephone number). The reply should also be in writing so that there is a record of the disclosure.
The permissive authority of section 33.1(1)(i)(ii) may not be used to override the mandatory provisions under Part 2 of the Act. (Order 217-1998). This means that this section may not be used to gain access to information that would be otherwise withheld under Part 2 of the Act.
Subsection 33.1(1)(i)(i) is primarily, though not solely, intended to assist public bodies whose mandate does not normally include the collection of monies. Some public bodies (e.g., Ministry of Small Business and Revenue), which have program responsibility for the collection of monies owing, have the necessary powers to do so in their own legislation. Subsection 33.1(1)(i)(i) merely reinforces their authority to request the necessary information.
For other public bodies, the collection of monies is incidental to their major responsibilities. Nevertheless, these ministries must on occasion recover debts or pursue defaulters. Subsection 33.1(i)(i) gives them the authority to carry out these activities.
"Monies" is the medium of exchange authorized or adopted by a government as part of its currency; assets that can be easily converted to cash; capital that is invested or traded as a commodity; funds; sums of money [Black’s]; sums of money; a current medium of exchange in the form of coins and banknotes; wealth; property viewed as convertible into money [OED].
- A public body approaches a bank manager for information on the state of a person’s bank account, as the public body needs to know if the person is being truthful when he says that garnishment of his account to collect monies owing would cause undue hardship. In order to identify the person to bank employees, the public body must disclose a certain amount of personal information to them.
- A person has been fined by the Ministry of Environment (the Ministry) for illegal dumping of chemicals. The Ministry is attempting to locate the person in order to collect the fine and, in doing so, approaches the Insurance Corporation of British Columbia (ICBC) for assistance. The Ministry discloses the person’s name and possibly other identifying information to ICBC. ICBC in turn may disclose the person’s address to the Ministry to assist in locating the person, in order to collect the monies owing.
- The municipality of Surrey owes a member of the public a refund for an overpayment of property taxes. The person has moved and the municipality does not have the new address. In order to locate the individual, the municipality asks former neighbours if they have a forwarding address for the person. The municipality must disclose the person’s name and, if necessary, the reason for the trace so that the neighbours know whom the municipality is trying to find and can provide the requested information.
This provision allows the Insurance Company of British Columbia (ICBC) to disclose personal information both inside and outside of Canada where the personal information was collected for insurance purposes and disclosure is necessary to investigate, manage or settle a specific insurance claim.
- An individual has submitted an insurance claim with ICBC. ICBC can then release personal information to a law enforcement agency to verify an individual’s involvement and confirm the details of an accident.
- ICBC may disclose personal information outside Canada in a case where an ICBC insured driver is involved in a motor vehicle accident outside Canada.
This provision permits the disclosure of personal information both inside and outside Canada for the purposes of licensing and registering motor vehicles and drivers, and verifying motor vehicle insurance, registration and drivers licenses.
- commercial trucking purposes which are monitored on an international basis.
- situations where an individual holding a British Columbia driver’s licence is involved with motor vehicle authorities in another jurisdiction.
This provision permits the disclosure of personal information both inside and outside of Canada for the purposes of licensing, registration, insurance, investigation, and discipline of persons regulated inside or outside of Canada by governing bodies of professions and occupations.
- When a physician moves from the UK to British Columbia, the College of Physicians and Surgeons could obtain the physician’s relevant history from the similar association in the UK.
- The exchange of personal information between licensing bodies in different jurisdictions prevents a professional involved in criminal or unethical behaviour from moving to a new jurisdiction and repeating the same practice.
This provision allows disclosure in urgent situations or in cases where disclosure is warranted because of other extraordinary circumstances while ensuring that the requirement to notify the person the information is about does not increase this risk or put someone else at risk. This Section usually applies to emergencies (e.g., in order to avert imminent danger to someone's health or safety) but it may also be used in other exceptional situations in which information must be disclosed either inside or outside Canada to protect an individual's health or safety and no other provision of section 33.1 or 33.2 applies.
There must be a danger to a person's physical or mental health or a threat to a person's life for the disclosure to fall under this provision.
Example of permissible disclosure
- An individual is seriously injured in a car accident and immediate medical treatment is required to save his life. If the individual is incapacitated, his spouse would be given access to the medical information necessary to make medical decisions on his behalf. The notice provisions of this section would be met by informing the individual of the disclosure when he recovers.
Example of impermissible disclosure
- Providing personal information to an individual attempting to bring about a family re-unification would not fit into this category, even though disclosure might seem justifiable from a humanitarian and compassionate point of view.
The limited exception to the notice requirement will allow public bodies, where appropriate, to weigh the risk of providing notice. It is not necessary for a public body to notify the individual the information is about if the head considers that harm will result to someone’s health or safety in giving this notice.
- Spouse, parent, child.
- Cousins brought up together as siblings.
- A grandchild brought up by grandparents.
This section allows for disclosure inside or outside Canada solely to inform the next of kin or a friend of the death, illness or injury of the person concerned and may include disclosure directly to the next of kin or to another person or organization in order to contact the next of kin or friend.
This section does not permit disclosure of the nature of the illness or injury, or the cause of death.
This section restricts the disclosure of personal information outside of Canada for archival or historical purposes.
"Section 36" permits the archives of the government of British Columbia or the archives of a public body to disclose personal information for archival purposes if the disclosure meets conditions designed to prevent the invasion of the privacy of the person concerned.
Interpretation Note 15.1 (Section 33.1(1)(p)):
Section 33.1(1)(p) authorizes public bodies to disclose personal information inside or outside Canada if that disclosure is necessary for doing any of the following to an electronic system or equipment that includes an electronic system:
- upgrading; or
- undertaking data recovery following the failure of the electronic system.
The public body must have a demonstrable need to disclose the personal information, such that the action would not be viable without it.
In the case of disclosures outside of Canada, the disclosure is only authorized where any resulting access to or storage of the personal information is limited to the minimum period of time necessary to complete the installation, implementation, maintenance, repair, trouble-shooting, upgrading, or data recovery. The disclosure of personal information to undertake data recovery is only authorized after a system failure has occurred. The public body is not authorized to disclose personal information outside of Canada on an ongoing basis for back-up purposes to mitigate the potential loss of information in the event of a future system failure.
A public body’s computer system normally stores personal information on a Canadian server; however, maintenance, repair, or other similar activities – when they are required – are carried out remotely by an expert who is based in another country. Providing access to this system, which contains personal information, is necessary to enable the expert to carry out these activities. The expert is given system access only as needed for this work to be undertaken, and only for the minimum amount of time necessary to complete the task.
Interpretation Note 15.2 (Section 33.1(1)(p.1)):
Section 33.1(1)(p.1) authorizes public bodies to disclose personal information inside and outside Canada for processing that is automated and temporary.
Disclosure under this section is limited by the following:
- the processing cannot involve intentional access to the information by a human;
- the processing cannot result in storage of personal information outside Canada, except specified personal information; and
- where the processing happens outside Canada, the disclosure must be for the minimum amount of time necessary to complete the processing.
A ministry would like to use a web analytics service to understand users’ interaction with its grant application webpage. The ministry conducts a privacy impact assessment and finds that the use of the service could result in personal information such as IP addresses being stored outside of Canada.
However, the ministry’s due diligence also reveals that there is an option to set up the service using a feature that immediately masks the IP addresses of the users. Although this processing would take place outside of Canada, it would not result in the information being stored outside of Canada, and would not involve intentional access to the information by an individual. In this example, the use of this service would be enabled by the disclosure authority under 33.1(1)(p.1).
Interpretation Note 15.3 (Section 33.1(1)(p.2)):
Section 33.1(1)(p.2) authorizes public bodies to disclose personal information inside and outside Canada if the personal information is metadata that is generated by an electronic system and that describes an individual’s interaction with the system. Metadata is a set of data that describes and gives information about other data.
Disclosure under this provision is limited by the following:
- where possible, any information in individually identifiable form in the metadata is removed or destroyed; and
- where the disclosure is to a service provider, there is a contractual, or other suitable, prohibition on using or disclosing the information further.
A word processing program used by public body employees may log user actions such as total time spent editing a document or when the document was last accessed. This information is disclosed to the service provider, and the disclosure meets the requirements of this section because the data is logged according to system ID numbers, rather than using the names of individual employees. The public body also ensures that the contract with the service provider contains an explicit restriction on using the data for other purposes, such as marketing or promotion.
Only public bodies that are law enforcement agencies are authorized to disclose personal information under section 33.1(2). This disclosure could be (a) to another law enforcement agency in Canada or (b) to a law enforcement agency in a foreign country, if an arrangement, written agreement, treaty or provincial or Canadian legislative authority is present.
Public bodies that have some law enforcement responsibilities, but whose primary function is not law enforcement, are not law enforcement agencies for the purposes of section 33.1(2). They are, however, authorized under section 33.2(i) to disclose personal information within Canada to assist in a specific law enforcement investigation
Examples of public bodies with law enforcement responsibilities that are not "law enforcement agencies" for the purposes of section 33.1(2)
- Conservation branches, Ministry of Environment
- Office of the Fire Commissioner, Ministry of Public Safety and Solicitor General
- Financial Institutions Commission
- Municipal bylaw enforcement officers
- Other regulatory bodies responsible for enforcing compliance with a law.
A "law enforcement agency in Canada" includes any agency in Canada whose primary function is law enforcement.
- Municipal police forces, such as the Vancouver Police or the Royal Canadian Mounted Police (RCMP) in its role as municipal police.
- Provincial police forces, such as the Ontario Provincial Police (OPP) or the RCMP in its role as provincial police.
- Federal agencies, such as the Canadian Security Intelligence Service (CSIS) and the RCMP in its role as federal police.
- Other federal, provincial and municipal agencies which enforce laws, such as the Canadian Border Service Agency (CBSA).
Police forces and other law enforcement organizations in other countries including international organizations and the municipal or state police forces of foreign countries are included in this term.
- In the United Kingdom: New Scotland Yard; Metropolitan London Police.
- In the United States of America: Federal Bureau of Investigation (FBI); Central Intelligence Agency (CIA); US Immigration and Naturalization Service (USINS); Individual state and city police forces.
- In France: La Sûreté.
- International: Interpol.
If necessary, "arrangements" under this paragraph need not be in writing.
In special instances the minister may allow the disclosure of necessary or appropriate personal information outside of Canada under section 33.2 that would otherwise be restricted by the Act. This section permits the minister to issue an order to allow such disclosures to take place. A summary of this order will be made public. Disclosure under section 33.1(3) would be determined on a case by case basis.
For orders organized by the Act's section numbers, Click here.
For a summary of Commissioner's orders and policy interpretation of key points, Click here.
Last updated: November 5, 2019 (Sections 33.1(1)(p), (p.1) and (p.2) only).