Difference between revisions of "Freedom of Information and Protection of Privacy"

From Clicklaw Wikibooks
Jump to navigation Jump to search
 
(15 intermediate revisions by 3 users not shown)
Line 1: Line 1:
{{Dial-A-Law Blurb}}
{{REVIEWEDPLS | reviewer = [https://www.ahbl.ca/people/courtenay-catlin/ Courtenay Catlin], Alexander Holburn and [https://pacificlaw.ca/about-our-lawyers/christopher-v-morcom/ Christopher Morcom], Pacific Law Group|date= April 2022}} {{Dial-A-Law TOC|expanded = rights}}
Increasingly, organizations — both private and public — are collecting your personal information. Learn about the laws allowing you to access this information and limiting how it can be collected, used, and disclosed.


{{Dial-A-Law TOC|expanded = rights}}
==Common questions==
==You have a right to certain information==
===What laws govern information and privacy rights in British Columbia?===
BC’s ''[http://www.bclaws.ca/civix/document/id/complete/statreg/96165_00 Freedom of Information and Protection of Privacy Act]'' (called FIPPA in this script) gives you the right to see many records kept by provincial government ministries and other public bodies - including records of your personal information, such as your name, address, age, employment history, educational background. Public bodies include provincial government ministries, local municipalities, schools and school boards, hospitals and health authorities, local police forces, colleges and universities, and self-governing bodies such as the College of Physicians and Surgeons of British Columbia and the Law Society of British Columbia.
In BC, your privacy rights are protected by two main laws.


In addition, BC’s ''[http://www.bclaws.ca/civix/document/id/complete/statreg/03063_01 Personal Information Protection Act]'' (PIPA in this script) gives you the right to see your personal information held by organizations in the private sector in BC. Organizations include stores, unions, hotels and restaurants, doctors, not-for-profit agencies, credit unions (but not chartered banks) and many others. Under PIPA, you can ask an organization for access to your personal information that it has, or explain how it has used your personal information and who it has given your information to. You can also ask for information on the organization’s privacy policy.
The ''[https://canlii.ca/t/8421 Freedom of Information and Protection of Privacy Act]'' applies to public organizations, like local governments, schools, and hospitals. It also applies to bodies that govern professions in the province, like the College of Physicians and Surgeons of BC (which governs doctors) and the Law Society of BC (which governs lawyers). [https://www.canlii.org/en/bc/laws/stat/rsbc-1996-c-165/latest/rsbc-1996-c-165.html#Schedule_3__309308 Here’s a list] of the professional governing bodies this law covers.


==How do you ask for information?==
The second one, the ''[https://canlii.ca/t/84mg Personal Information Protection Act]'', covers data about you collected, used, and disclosed by private organizations, unincorporated associations, trade unions, trusts, or non-profits. This includes stores, hotels, banks, and doctors in private practice.
In some cases, it may be quick and easy to access records held by provincial government ministries or other public bodies, or to access your personal information held by a private organization. Their website may have the information you want, or a phone call may be enough get the information. But if there’s no other way of getting the information you want, you can send a written request to the information and privacy branch of the government ministry or other public body, or to the privacy officer of the private organization. For example, if you want to see records on an ICBC claim, you would send a written request to the Information and Privacy Branch of ICBC. If you want access to information about your gym’s privacy policy, or your personal information it has on file, you would send a written request to the gym’s privacy officer.


==How long does a public body or an organization have to respond?==
These two laws regulate how your personal information is allowed to be collected, used and disclosed. They also set out your rights around consent to the collection, use, and disclosure of your data, knowing how much of your data is out there, and what’s being done with it.
FIPPA gives public bodies 30 business days to respond to your request. They can’t charge you any fees for your own personal information, but they can charge you fees for finding, copying, retrieving, and producing records not related to your personal information. You can ask them to waive the fees if you can’t afford them, or if the information is in the public interest.


Private organizations also have 30 business days to respond to your request. They can’t charge you a fee for your own employee personal information. But they can charge a reasonable fee for giving you access to your other personal information – not employee personal information.
For a closer look, visit the [https://www.oipc.bc.ca/for-the-public/what-are-my-rights/ BC privacy commissioner’s website].


==Some information isn’t available==
===How do I request access to my personal information?===
Under FIPPA, you may not be able to get certain records, such as Cabinet records, someone else’s personal information, court files, current work files of the Auditor General or Ombudsman, or certain information if its release or disclosure would harm private business interests. You may also not be able to see information if its disclosure would harm a law enforcement matter, or harm people or public safety.
In some cases, a simple phone call or email directly to the organization that has your information will work.


==What can you do if your request for information is refused?==
But if that route proves unsuccessful, you can send a '''written request'''. The organization will have a department or person that handles such queries. If they don’t, you can send your request to the organization’s general address. It’s their responsibility to have a procedure in place to deal with these requests and make a reasonable effort to assist you.
If a public body or private organization refuses your request, or if you’re not satisfied with its response, you can ask BC’s Information and Privacy Commissioner to review the response. There’s a time limit of 30 business days to make this request to the Commissioner. The Commissioner is an independent officer of the provincial Legislature who reviews the decision and can order a public body or private organization to release information that FIPPA or PIPA gives you the right to see. See the [http://www.oipc.bc.ca/ Information and Privacy Commissioner website] for information on how to ask for a review.


==What if an organization’s personal information about you is wrong?==
For example, if you want to see records on an ICBC claim, you could send a written request to the information and privacy branch of ICBC. ICBC offers guidance on [https://www.icbc.com/about-icbc/contact-us/information-request-and-privacy-complaints how to make such a request].
An organization must make reasonable efforts to ensure that your personal information is accurate and complete. You can ask a public body to correct any factual error or omission (but not opinions or judgments) in your personal information. If the public body refuses your request, FIPPA requires them to mark your information with the correction you requested. You can also ask a private organization to correct any inaccurate personal information. If you are not happy with the decision of the public body or organization, you can ask the Commissioner to review it.


==You also have a right to privacy==
Here's another example. If you want access to information about how your local gym collects, uses, and discloses your personal information, you can send a written request to the gym’s privacy officer, or to the gym’s general contact address.
Both FIPPA and PIPA protect your right to privacy by regulating how public bodies and private organizations collect, use, and give out (or disclose) personal information. Public bodies and organizations can use personal information only for the purposes they collect it for, unless they get your consent to use it for another reason. Organizations and public bodies must ensure that they don’t give out personal information without proper authorization.


==What if you’re upset with how your personal information is being handled?==
The BC privacy commissioner’s website provides [https://www.oipc.bc.ca/forms/individuals/ template letters you can use]. As well, many organizations have their own templates and internal procedures. If they do, this is a good place to start.
If you disagree with how your personal information is being managed, you should first complain directly to the public body or organization about how it collects, uses, or discloses your personal information. If that doesn’t help, you can file a complaint with the [http://www.oipc.bc.ca/ Information and Privacy Commissioner].  


==Where can you find more information?==
===How long does a public body or organization have to respond to my request for access to information?===
Check the [http://www.oipc.bc.ca/ Information and Privacy Commissioner website]. You can also phone the Office at 250.387.5629 in Victoria. For toll-free access, call Enquiry BC (604.660.2421 in Vancouver and 1.800.663.7867 elsewhere in BC) and ask them to connect you.
Under the law, public bodies have '''30 business days''' to respond to your request for information. They can’t charge you for a request that relates to your own personal information. But they ''can'' charge you fees for finding, copying, retrieving, and producing records about anything not related to your personal information if it takes more than three hours. (You can ask them to waive the fees if you can’t afford them, or if the information is in the public interest.)


For information records, send your written request directly to the public body or private organization that has the information you want.
Private organizations also have '''30 business days''' to respond to your request. They can’t charge you a fee for a request that relates to your “employee personal information.” This is personal information collected, used or disclosed to establish, manage or end an employment relationship. But, just like public bodies, they can charge a small fee to access information that isn’t employee personal information.


===What types of information can’t I request access to?===
You may not be able to get certain records, such as Cabinet records, someone else’s personal information, court files, current work files of the Auditor General or Ombudsperson, or certain information if its disclosure would harm private business interests. You may also not be able to see information if its disclosure would harm a law enforcement matter, or harm people or public safety.


[updated February 2016]
If you’re asking for information from a public body, you may ask for certain information to be “severed” from the record. This means you can access the information, but the sections you aren’t entitled to see are blacked out (or “redacted”).


===What can I do if my request for information is refused?===
If either a public body or private organization refuses your request for information — or if you’re not satisfied with its response — you can ask BC’s information and privacy commissioner to '''review''' the response. You have up to '''30 business days''' to do this after you receive a response.


----
The commissioner is independent of the government. They review the decision and can order information to be released — so long as it’s information the law gives you the right to see.
----


See the privacy commissioner’s website for [https://www.oipc.bc.ca/for-the-public/how-do-i-request-a-review/ how to ask for a review].


===What if someone’s information about me is wrong?===
An organization must make reasonable efforts to ensure your personal information is accurate and complete.
You can ask a public body to correct any factual error or omission (but not opinions or judgments). If they refuse your request, the law requires them to mark your information with the correction you requested.
You can also ask a private organization to correct any inaccurate personal information. Again, if the organization refuses your request, the law requires them to mark your information with the correction you requested.
If you aren’t happy with the decision of the public body or organization upon a correction request, your next step is to ask the privacy commissioner to review the decision.
===What if I’m upset with how my personal information is being handled?===
If you disagree with how your personal information is being managed, you should first complain directly to the public body or organization. Give them a reasonable amount of time to respond.
If that doesn’t resolve the issue, you can file a complaint with BC’s privacy commissioner. The commissioner’s website explains the [https://www.oipc.bc.ca/for-the-public/how-do-i-make-a-complaint/ process to make a complaint].
==Who can help==
===With more information===
:'''Office of the Information and Privacy Commissioner'''
:Oversees BC's laws relating to privacy and access to information.
:Call 1-800-663-7867
:Email: info@oipc.bc.ca
:[https://www.oipc.bc.ca/ Visit website]
{{Dial-A-Law_Navbox|type=life}}
{{Dial-A-Law Copyright}}
{{Dial-A-Law Copyright}}
{{Dial-A-Law_Navbox|type=rights}}

Latest revision as of 22:50, 7 November 2023

This information applies to British Columbia, Canada. Last reviewed for legal accuracy by Courtenay Catlin, Alexander Holburn and Christopher Morcom, Pacific Law Group in April 2022.

Increasingly, organizations — both private and public — are collecting your personal information. Learn about the laws allowing you to access this information and limiting how it can be collected, used, and disclosed.

Common questions

What laws govern information and privacy rights in British Columbia?

In BC, your privacy rights are protected by two main laws.

The Freedom of Information and Protection of Privacy Act applies to public organizations, like local governments, schools, and hospitals. It also applies to bodies that govern professions in the province, like the College of Physicians and Surgeons of BC (which governs doctors) and the Law Society of BC (which governs lawyers). Here’s a list of the professional governing bodies this law covers.

The second one, the Personal Information Protection Act, covers data about you collected, used, and disclosed by private organizations, unincorporated associations, trade unions, trusts, or non-profits. This includes stores, hotels, banks, and doctors in private practice.

These two laws regulate how your personal information is allowed to be collected, used and disclosed. They also set out your rights around consent to the collection, use, and disclosure of your data, knowing how much of your data is out there, and what’s being done with it.

For a closer look, visit the BC privacy commissioner’s website.

How do I request access to my personal information?

In some cases, a simple phone call or email directly to the organization that has your information will work.

But if that route proves unsuccessful, you can send a written request. The organization will have a department or person that handles such queries. If they don’t, you can send your request to the organization’s general address. It’s their responsibility to have a procedure in place to deal with these requests and make a reasonable effort to assist you.

For example, if you want to see records on an ICBC claim, you could send a written request to the information and privacy branch of ICBC. ICBC offers guidance on how to make such a request.

Here's another example. If you want access to information about how your local gym collects, uses, and discloses your personal information, you can send a written request to the gym’s privacy officer, or to the gym’s general contact address.

The BC privacy commissioner’s website provides template letters you can use. As well, many organizations have their own templates and internal procedures. If they do, this is a good place to start.

How long does a public body or organization have to respond to my request for access to information?

Under the law, public bodies have 30 business days to respond to your request for information. They can’t charge you for a request that relates to your own personal information. But they can charge you fees for finding, copying, retrieving, and producing records about anything not related to your personal information if it takes more than three hours. (You can ask them to waive the fees if you can’t afford them, or if the information is in the public interest.)

Private organizations also have 30 business days to respond to your request. They can’t charge you a fee for a request that relates to your “employee personal information.” This is personal information collected, used or disclosed to establish, manage or end an employment relationship. But, just like public bodies, they can charge a small fee to access information that isn’t employee personal information.

What types of information can’t I request access to?

You may not be able to get certain records, such as Cabinet records, someone else’s personal information, court files, current work files of the Auditor General or Ombudsperson, or certain information if its disclosure would harm private business interests. You may also not be able to see information if its disclosure would harm a law enforcement matter, or harm people or public safety.

If you’re asking for information from a public body, you may ask for certain information to be “severed” from the record. This means you can access the information, but the sections you aren’t entitled to see are blacked out (or “redacted”).

What can I do if my request for information is refused?

If either a public body or private organization refuses your request for information — or if you’re not satisfied with its response — you can ask BC’s information and privacy commissioner to review the response. You have up to 30 business days to do this after you receive a response.

The commissioner is independent of the government. They review the decision and can order information to be released — so long as it’s information the law gives you the right to see.

See the privacy commissioner’s website for how to ask for a review.

What if someone’s information about me is wrong?

An organization must make reasonable efforts to ensure your personal information is accurate and complete.

You can ask a public body to correct any factual error or omission (but not opinions or judgments). If they refuse your request, the law requires them to mark your information with the correction you requested.

You can also ask a private organization to correct any inaccurate personal information. Again, if the organization refuses your request, the law requires them to mark your information with the correction you requested.

If you aren’t happy with the decision of the public body or organization upon a correction request, your next step is to ask the privacy commissioner to review the decision.

What if I’m upset with how my personal information is being handled?

If you disagree with how your personal information is being managed, you should first complain directly to the public body or organization. Give them a reasonable amount of time to respond.

If that doesn’t resolve the issue, you can file a complaint with BC’s privacy commissioner. The commissioner’s website explains the process to make a complaint.

Who can help

With more information

Office of the Information and Privacy Commissioner
Oversees BC's laws relating to privacy and access to information.
Call 1-800-663-7867
Email: info@oipc.bc.ca
Visit website
Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International Licence Dial-A-Law © People's Law School is licensed under a Creative Commons Attribution - NonCommercial - ShareAlike 4.0 International Licence.