Third-Party Privacy Issues in Evidence (LTB)

Personal Information Protection and Electronic Documents Act

2 (1) The definitions in this subsection apply in this Part.

organization includes an association, a partnership, a person and a trade union. (organisation)

personal information means information about an identifiable individual. (renseignement personnel)

prescribed means prescribed by regulation. (Version anglaise seulement)

record includes any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microform, sound recording, videotape, machine-readable record and any other documentary material, regardless of physical form or characteristics, and any copy of any of those things. (document)

5 (1) Subject to sections 6 to 9, every organization shall comply with the obligations set out in Schedule 1.

Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31

2 (1) In this Act,

“personal information” means recorded information about an identifiable individual, including,

(a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual,

(b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

(c) any identifying number, symbol or other particular assigned to the individual,

(d) the address, telephone number, fingerprints or blood type of the individual,

(e) the personal opinions or views of the individual except where they relate to another individual,

(f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence,

(g) the views or opinions of another individual about the individual, and

(h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; (“renseignements personnels”)

“personal information bank” means a collection of personal information that is organized and capable of being retrieved using an individual’s name or an identifying number or particular assigned to the individual; (“banque de renseignements personnels”)

“institution” means,

(0.a) the Assembly,

(a) a ministry of the Government of Ontario,

(a.1) a service provider organization within the meaning of section 17.1 of the Ministry of Government Services Act,

(a.2) a hospital, and

(b) any agency, board, commission, corporation or other body designated as an institution in the regulations; (“institution”)

(3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity. 2006, c. 34, Sched. C, s. 2.

21 (1) A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except,

(a) upon the prior written request or consent of the individual, if the record is one to which the individual is entitled to have access;

(b) in compelling circumstances affecting the health or safety of an individual, if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;

(c) personal information collected and maintained specifically for the purpose of creating a record available to the general public;

(d) under an Act of Ontario or Canada that expressly authorizes the disclosure;

(e) for a research purpose if,

(i) the disclosure is consistent with the conditions or reasonable expectations of disclosure under which the personal information was provided, collected or obtained,

(ii) the research purpose for which the disclosure is to be made cannot be reasonably accomplished unless the information is provided in individually identifiable form, and

(iii) the person who is to receive the record has agreed to comply with the conditions relating to security and confidentiality prescribed by the regulations; or

(f) if the disclosure does not constitute an unjustified invasion of personal privacy. R.S.O. 1990, c. F.31, s. 21 (1).

(2) A head, in determining whether a disclosure of personal information constitutes an unjustified invasion of personal privacy, shall consider all the relevant circumstances, including whether,

(a) the disclosure is desirable for the purpose of subjecting the activities of the Government of Ontario and its agencies to public scrutiny;

(b) access to the personal information may promote public health and safety;

(c) access to the personal information will promote informed choice in the purchase of goods and services;

(d) the personal information is relevant to a fair determination of rights affecting the person who made the request;

(e) the individual to whom the information relates will be exposed unfairly to pecuniary or other harm;

(f) the personal information is highly sensitive;

(g) the personal information is unlikely to be accurate or reliable;

(h) the personal information has been supplied by the individual to whom the information relates in confidence; and

(i) the disclosure may unfairly damage the reputation of any person referred to in the record. R.S.O. 1990, c. F.31, s. 21 (2).

(3) A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy where the personal information,

(a) relates to a medical, psychiatric or psychological history, diagnosis, condition, treatment or evaluation;

(b) was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation;

(c) relates to eligibility for social service or welfare benefits or to the determination of benefit levels;

(d) relates to employment or educational history;

(e) was obtained on a tax return or gathered for the purpose of collecting a tax;

(f) describes an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness;

(g) consists of personal recommendations or evaluations, character references or personnel evaluations; or

(h) indicates the individual’s racial or ethnic origin, sexual orientation or religious or political beliefs or associations. R.S.O. 1990, c. F.31, s. 21 (3).

(4) Despite subsection (3), a disclosure does not constitute an unjustified invasion of personal privacy if it,

(a) discloses the classification, salary range and benefits, or employment responsibilities of an individual who is or was an officer or employee of an institution or a member of the staff of a minister;

(b) discloses financial or other details of a contract for personal services between an individual and an institution;

(c) discloses details of a licence or permit or a similar discretionary financial benefit conferred on an individual by an institution or a head under circumstances where,

(i) the individual represents 1 per cent or more of all persons and organizations in Ontario receiving a similar benefit, and

(ii) the value of the benefit to the individual represents 1 per cent or more of the total value of similar benefits provided to other persons and organizations in Ontario; or

(d) discloses personal information about a deceased individual to the spouse or a close relative of the deceased individual, and the head is satisfied that, in the circumstances, the disclosure is desirable for compassionate reasons. R.S.O. 1990, c. F.31, s. 21 (4); 2006, c. 19, Sched. N, s. 1 (2).

38 (1) In this section and in section 39,

“personal information” includes information that is not recorded and that is otherwise defined as “personal information” under this Act. R.S.O. 1990, c. F.31, s. 38 (1).

(2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. R.S.O. 1990, c. F.31, s. 38 (2).

42 (1) An institution shall not disclose personal information in its custody or under its control except,

(a) in accordance with Part II;

(b) where the person to whom the information relates has identified that information in particular and consented to its disclosure;

(c) for the purpose for which it was obtained or compiled or for a consistent purpose;

(d) where disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and where disclosure is necessary and proper in the discharge of the institution’s functions;

(e) where permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada;

(f) where disclosure is by a law enforcement institution,

(i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or

(ii) to another law enforcement agency in Canada;

(g) to an institution or a law enforcement agency in Canada if,

(i) the disclosure is to aid in an investigation undertaken by the institution or the agency with a view to a law enforcement proceeding, or

(ii) there is a reasonable basis to believe that an offence may have been committed and the disclosure is to enable the institution or the agency to determine whether to conduct such an investigation;

(h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;

(i) in compassionate circumstances, to facilitate contact with the spouse, a close relative or a friend of an individual who is injured, ill or deceased;

(j) to a member of the Legislative Assembly who has been authorized by a constituent to whom the information relates to make an inquiry on the constituent’s behalf or, where the constituent is incapacitated, has been authorized by the spouse, a close relative or the legal representative of the constituent;

(k) to a member of the bargaining agent who has been authorized by an employee to whom the information relates to make an inquiry on the employee’s behalf or, where the employee is incapacitated, has been authorized by the spouse, a close relative or the legal representative of the employee;

(l) to the responsible minister;

(m) to the Information and Privacy Commissioner;

(n) to the Government of Canada in order to facilitate the auditing of shared cost programs; or

(o) subject to subsection (2), an educational institution may disclose personal information in its alumni records, and a hospital may disclose personal information in its records, for the purpose of its own fundraising activities or the fundraising activities of an associated foundation if,

(i) the educational institution and the person to whom the information is disclosed, or the hospital and the person to whom the information is disclosed, have entered into a written agreement that satisfies the requirements of subsection (3), and

(ii) the personal information is reasonably necessary for the fundraising activities. R.S.O. 1990, c. F.31, s. 42; 2005, c. 28, Sched. F, s. 6 (1); 2006, c. 19, Sched. N, s. 1 (5-7); 2006, c. 34, Sched. C, s. 5; 2010, c. 25, s. 24 (12); 2019, c. 7, Sched. 31, s. 4.