Canadian public and private sector organizations generally are allowed to collect and disclose personal information only with the consent of individuals. But the COVID-19 pandemic has raised questions about the ability of organizations to share certain personal information at a time when Canada is in crisis.
However, Canada’s privacy commissioner says the situation doesn’t mean privacy laws prevent some personal information from being shared with the right people or authorities.
“During a public health crisis, privacy laws still apply but they are not a barrier to appropriate information sharing,” the Office of the Privacy Commissioner said in guidance issued Friday.
“Public health situations are sometimes referred to as emergencies. Under both federal and provincial laws, governments are authorized to declare formal public emergencies. Where that is done, the powers to collect, use and disclose personal information may be further extended and can be very broad. To understand the impact of such legislation on privacy, one has to read its specific terms. Normal privacy laws apply unless emergency legislation provides otherwise.”
Alberta, British Columbia, Ontario, Quebec, Manitoba, Nova Scotia are provinces that have declared states of emergencies, while Vancouver, Calgary and London, Ont., are among the municipalities that have done so.
Because both Ottawa, the provinces and the territories have jurisdiction over health employers are urged to check all public and private sector regulators on what is allowable under a public health crisis.
For example, in Alberta the provincial Health Information Act allows health data custodians to disclose health information without consent in some circumstances to avert or minimize an imminent danger to the health or safety of any person, to a person responsible for continuing treatment and care for the individual, and to law enforcement officials where the custodian reasonably believes the information relates to a possible offence and the disclosure will protect the health and safety of Albertans.
“If an outbreak is declared to be a public emergency,” the Alberta privacy commissioner’s guidance adds, “the powers to collect, use and disclose personal or health information to protect the public health may be very broad.”
The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private-sector organizations that collect, use or disclose personal information for commercial activity, and to information about employees of federal works, undertakings or businesses.
PIPEDA allows organizations to collect, use or disclose information only for purposes that a reasonable person would consider appropriate in the circumstances. Organizations are required to obtain the knowledge and meaningful consent of the individual for the collection, use, or disclosure of their personal information.
However there are some circumstances under which organizations may collect, use, or disclose personal information without the consent of the individual, including:
- If the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way, such as if an individual is critically ill or in a particularly dangerous situation, and needs help;
- If the collection and use is for the purpose of making a disclosure required by law. For instance, this would include where a public health authority has the legislative authority to require the disclosure;
- If the disclosure is requested by a government institution under lawful authority to obtain the information and the disclosure is for the purpose of enforcing or administering any law of Canada or a province. Again, this would include instances where a public health authority has the legislative authority to require the disclosure;
- If the disclosure is made on the initiative of the organization to a government institution, which has reasonable grounds to believe that the information relates to a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed. This would include if an organization believes an individual is in contravention of an invoked quarantine order;
- If the use or disclosure is for the purpose of acting in respect of an emergency that threatens the life, health or security of an individual, such as if an individual requires urgent medical attention, and they are unable to communicate directly with medical professionals.