Privacy

The Freedom of Information and Protection of Privacy Act (FOIPOP) is also about protecting the privacy of individuals. In fact, the FOIPOP Act provides specific obligations for public bodies and municipalities to protect the privacy of identifiable individuals by restricting the collection, use, and disclosure of information about those individuals. FOIPOP requires a public body or municipality to ensure the accuracy and completeness of the information, and to make reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.

Collection of Personal Information
A public body or a municipality cannot collect personal information unless the collection is permitted by legislation, is done for the purposes of law enforcement, or is necessary for “an operating program” or “activity” of that public body or municipality. FOIPOP does not require that the purpose of the collection is provided to an individual, but public bodies and municipalities are advised to do so as a best practice where possible.

Use of Personal Information
Personal information can only be used:

• for the reason it was obtained or compiled, for a “compatible purpose”;
• if the individual has identified the information and given written consent for the change in use (See Form 4 - Consent to Use Information); or
• for other reasons authorized by FOIPOP, e.g., complying with another Act or with a treaty, arrangement, or agreement made pursuant to another Act.

These reasons also include where the information could have been disclosed to someone in a public body to collect a crown debt, assist in a law enforcement investigation, and where “compelling health or safety reasons” exist.

Disclosure of Personal Information
Personal information may only be disclosed according to provisions outlined in the FOIPOP Act, unless there has been a documented custom or past practice to provide access to certain personal information (see subsection 5(2) of the FOIPOP Act). Personal information can be disclosed if it is a matter of public record, is excluded from the FOIPOP Act, or if any of the circumstances in Section 27 of the FOIPOP Act apply. These circumstances include situations where an individual has provided written consent (see Form 3 - Consent to Disclosure of Information). Disclosure is also permitted where legislation has provided the authority, or allows compliance with an agreement to exchange information made pursuant to legislation. Other permissible circumstances include disclosure to another public body where it is necessary for the work of that public body. As well it may be disclosed where the information could have been disclosed to someone in a public body to collect a crown debt, assist in a law enforcement investigation, and where “compelling health or safety reasons” exist.

In limited circumstances, identifiable personal information may be disclosed for research purposes. The FOIPOP Act has specific provisions for this disclosure.

Personal Information International Disclosure Protection Act

On July 14, 2006, government passed the Personal Information International Disclosure Protection Act (PIIDPA.) This Act was created to provide further privacy protection, and at the same time respond to Nova Scotian concerns about the vulnerability of public body and municipal personal information holdings to foreign access and disclosure.

PIIDPA came into effect on November 15, 2006. The Act prohibits public sector organizations, universities, municipalities and their service providers from allowing foreign storage, disclosure, or access to their personal information except to meet the “necessary requirements” of a public body’s or municipality’s operation. It also requires any individual in these organizations to report any demand by a foreign court for disclosure of Nova Scotians’ personal information. The Act provides substantial fines of up to $500,000 if the law is violated.

A copy of the Personal Information International Disclosure Protection Act can be located on the Legislative Council website.  For further explanation of the statute see frequently asked questions. A copy of the template for conducting a Privacy Impact Assessment can be found on the FOIPOP publications page.

For more information on PIIDPA, contact the FOIPOP Coordinator's Office at the N.S. Department of Justice at (902) 424-2719 or e-mail PIIDPA@gov.ns.ca.