Disclosing personal information

Consent

Types of consent

Before disclosing personal information, an organization must usually:

• get a person’s consent

A person can consent to the collection, use or disclosure of personal information for reasonable purposes (which is what a reasonable person would consider appropriate under the circumstances).

Someone may consent verbally or in writing, including via electronic communications.

Someone is ‘deemed to consent’ if he or she, without actually giving consent, voluntarily provides the information to the organization and it is reasonable for that purpose. This is also called ‘implied consent’.

Someone can also consent if they do not ‘opt out’ in a reasonable time when he or she receives clear and understandable notification and is given a reasonable opportunity to decline by the organization.

Even if an organization gets consent, it can only collect, use, or disclose personal information for the purposes provided in the notice and to the extent reasonable for that purpose. An organization may not provide false or misleading information in its notice.

Withdraw or change consent

Individuals have the right to withdraw or change their consent, subject to legal limitations. As soon as an organization is notified of this, the organization must inform the individual of the likely consequences it they are not obvious.

If a person changes his or her consent, the organization must abide by the new terms of consent. If the person withdraws his or her consent the organization must stop collecting, using or disclosing his or her personal information immediately.

Disclosure with consent

An organization may disclose personal information only with the individual’s consent except in the limited circumstances where use without consent is allowed.

Disclosure without consent

The Personal Information Protection Act (PIPA) will also let an organization disclose someone’s personal information without that person’s consent in the following circumstances:

• it is clearly in the person’s interests and
  • that person’s consent cannot be obtained in a timely way, or
  • that person would not reasonably be expected to withhold consent

• there is a legal authority for the disclosure:
  • it is authorized by a statute of Alberta or Canada, a regulation of Alberta or Canada, a bylaw of a local government body, or a legislative instrument of a professional regulatory organization
  • it is in accordance with a form provided under a statute or regulation of Alberta
  • the disclosure of information is to a public body and the public body is authorized by an enactment of Alberta to collect the information to the organization
  • it is in accordance with a provision of a treaty, and is made under an enactment of Alberta or Canada
  • if it is for a collective agreement
    • the disclosure of information is necessary to comply with a collective agreement that is binding on the organization under section 128 of the Labour Relations Code
  • it is for an inspection or audit
    • if the audit is either of or by the organization and is authorized by a statute or regulation of Alberta or Canada
    • if it is by another organization and it’s not practical to use non-identifying information for the purpose of the audit
  • it is to collect, pay a debt
    • the disclosure is necessary to collect a debt owed to the organization
    • the disclosure is necessary to pay a debt owed by the organization to the person
  • it is by a credit reporting organization
    • the organization is a credit reporting organization and is permitted to disclose the information under Part 5 of the Fair Trading Act
  • it is to protect against fraud
    • the disclosure of information is for the purposes of protecting against, or for the prevention, detection or suppression of fraud, and the information is disclosed to or by an organization permitted by:
      • a statute of a province of Alberta or a statute of Canada
      • a regulation of Alberta or Canada, or a similar subordinate legislation of another Canadian province
      • an order made by a Minister under a statute or regulation
      • Investigative Services, a division of the Insurance Bureau of Canada
      • the Canadian Bankers Association, Bank Crime Prevention and Investigation Office
  • it is for an investigation or law enforcement or legal proceeding
    • the disclosure is for complying with a subpoena, warrant or order issued or made by a court or body having the jurisdiction to compel the production of information
    • the disclosure is to a public body or a law enforcement agency in Canada to assist in an investigation taken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result
    • it is reasonable for the purposes of an investigation or legal proceeding
  • it is for an emergency or to notify next of kin
    • it is necessary to respond to an emergency that threatens the life, health, or security of a person or the public
    • it is for the purposes of contacting the next of kin or a friend of an injured, ill or deceased person
    • it is to the surviving spouse or adult interdependent partner or to a relative of the deceased person if, in the opinion of the organization, the disclosure is reasonable
  • it is for an award, honour, benefit, scholarship or similar prize
    • it is necessary to determine a person’s suitability to receive an honour, award or similar benefit, including an honorary degree, scholarship or bursary
  • the information is publicly available, as prescribed in the regulations
    • the information is contained in a telephone directory available to the public and the subscriber can refuse to have the personal information appear in the directory
    • the information is business contact information
    • the information is contained in a registry
    • the information in contained in a public record of a quasi-judicial body and is being collected for a purpose for which the record was created
    • the information is in a publication and it is reasonable to assume the individual provided that information to the publication
  • it is for archival or research purposes
    • the organization disclosing the information is an archival institution and the disclosure of the information is reasonable for archival purposes or research
    • the disclosure of the information meets the requirements respecting archival purposes or research set out in the regulations and it isn’t reasonable to obtain the consent of the individual the information is about
  • it is in accordance with section 22: PIPA’s disclosure respecting acquisition of a business
    • an organization may disclose personal information on a limited basis with other organizations for the purposes of a business transaction
  • it is by a trade union relating to a labour relations dispute
    • the disclosure is for the purpose of informing or persuading the public about a matter of significant interest or importance relating to a labour relations dispute involving the trade union
    • the disclosure is reasonably necessary for that purpose, and
    • it is reasonable to disclose without consent considering all relevant circumstances including the nature and sensitivity of the information

Contact

Connect with the FOIP/PIPA help desk.