Earlier this month, the Alberta Information and Privacy Commissioner, Jill Clayton, published the second instalment of her submissions with respect to the review of the Alberta Freedom of Information and Protection of Privacy Act (FIPPA). This second instalment involves technical suggestions regarding amendments to FIPPA.
One issue the Commissioner focused attention on was the application of privacy legislation to non-profit organizations, particularly when information is shared between public bodies and those non-profits. The Commissioner wrote:
There is an increasing movement towards citizen-centred service delivery involving cross‐sectoral partners (public, private and health sectors). I am concerned that the personal information of Albertans may not be protected in situations where one of the partners is a non‐profit organization that is not subject to privacy legislation.
Only certain non-profit organizations in Alberta are subject to the Personal Information Protection Act (PIPA) when they are collecting, using or disclosing personal information in connection with a commercial activity. The Commissioner recommends that PIPA be amended to apply to all non-profits.
In the meantime, however, the Commissioner recommends that when non-profits are engaged in cross-sectoral activities with public bodies subject to FIPPA, the public body should be accountable for the collection, use, disclosure and protection of personal information.
This is an intriguing suggestion. On the one hand, it could assist in lawful information sharing between the non-profit and the public body, while ensuring that there is accountability irrespective of where the information resides.
On the other hand, it could result in complicating these cross-sectoral partnerships as a result of the purpose limitation provisions of section 33 of FIPPA. Section 33 of FIPPA prohibits public bodies from collecting personal information unless it is expressly authorized by legislation, it is for law enforcement, or it "relates directly to and is necessary for an operating program or activity of the public body". Any amendment that would make a public body accountable for the information collection activities of the non-profit must be drafted carefully to avoid having the effect of limiting the legitimate collection, use, retention and disclosure activities of the non-profit in that information, which may be different and broader than those of the public body and which could be part of the reason for the cross-sectoral partnership in the first place.
For more information, visit our Data Governance Law blog at www.datagovernancelaw.com
About Dentons
Dentons is a global firm driven to provide you with the competitive edge in an increasingly complex and interconnected marketplace. We were formed by the March 2013 combination of international law firm Salans LLP, Canadian law firm Fraser Milner Casgrain LLP (FMC) and international law firm SNR Denton.
Dentons is built on the solid foundations of three highly regarded law firms. Each built its outstanding reputation and valued clientele by responding to the local, regional and national needs of a broad spectrum of clients of all sizes – individuals; entrepreneurs; small businesses and start-ups; local, regional and national governments and government agencies; and mid-sized and larger private and public corporations, including international and global entities.
Now clients benefit from more than 2,500 lawyers and professionals in 79 locations in 52 countries across Africa, Asia Pacific, Canada, Central Asia, Europe, the Middle East, Russia and the CIS, the UK and the US who are committed to challenging the status quo to offer creative, actionable business and legal solutions.
Learn more at www.dentons.com
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances. Specific Questions relating to this article should be addressed directly to the author.
