BILL 73 – 2004
FREEDOM OF INFORMATION AND PROTECTION OF PRIVACY AMENDMENT ACT, 2004
HER MAJESTY, by and with the advice and consent of the Legislative Assembly of the Province of British Columbia, enacts as follows:
1 Section 3 of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, is amended
(a) by repealing subsection (1) (c) and substituting the following:
(c) subject to subsection (3), a record that is created by or for, or is in the custody or control of, an officer of the Legislature and that relates to the exercise of that officer's functions under an Act; , and
(b) by adding the following subsection:
(3) The following sections apply to officers of the Legislature, their employees and, in relation to their service providers, the employees and associates of those service providers, as if the officers and their offices were public bodies:
(a) section 30 (protection of personal information);
(b) section 30.1 (storage and access must be in Canada);
(c) section 30.2 (obligation to report foreign demand for disclosure);
(d) section 30.3 (whistle-blower protection);
(e) section 30.4 (unauthorized disclosure prohibited);
(f) section 33 (disclosure of personal information);
(g) section 33.1 (disclosure inside or outside Canada);
(h) section 33.2 (disclosure inside Canada only);
(i) section 74.1 (privacy protection offences).
2 Section 30 is repealed and the following substituted:
Protection of personal information
30 A public body must protect personal information in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.
Storage and access must be in Canada
30.1 A public body must ensure that personal information in its custody or under its control is stored only in Canada and accessed only in Canada, unless one of the following applies:
(a) if the individual the information is about has identified the information and has consented, in the prescribed manner, to it being stored in or accessed from, as applicable, another jurisdiction;
(b) if it is stored in or accessed from another jurisdiction for the purpose of disclosure allowed under this Act.
Obligation to report foreign demand for disclosure
30.2 (1) In this section:
"foreign demand for disclosure" means a subpoena, warrant, order, demand or request that is
(a) from a foreign court, an agency of a foreign state or another authority outside Canada, and
(b) for the unauthorized disclosure of personal information to which this Act applies;
"unauthorized disclosure of personal information" means disclosure of, production of or the provision of access to personal information to which this Act applies, if that disclosure, production or access is not authorized by this Act.
(2) If a public body, an employee of a public body or an employee or associate of a service provider
(a) receives a foreign demand for disclosure,
(b) receives a request to disclose, produce or provide access to personal information to which this Act applies, if the public body, employee or other person receiving the request
(i) knows that the request is for the purpose of responding to a foreign demand for disclosure, or
(ii) has reason to suspect that it is for such a purpose, or
(c) has reason to suspect that unauthorized disclosure of personal information has occurred in response to a foreign demand for disclosure,
the head of the public body, the employee or other person must immediately notify the minister responsible for this Act.
(3) The notice under subsection (2) must include, as known or suspected,
(a) the nature of the foreign demand for disclosure,
(b) who made the foreign demand for disclosure,
(c) when the foreign demand for disclosure was received, and
(d) what information was sought by or disclosed in response to the foreign demand for disclosure.
Whistle-blower protection
30.3 An employer, whether or not a public body, must not dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee of the employer, or deny that employee a benefit, because
(a) the employee, acting in good faith and on the basis of reasonable belief, has notified the minister responsible for this Act under section 30.2,
(b) the employee, acting in good faith and on the basis of reasonable belief, has disclosed to the commissioner that the employer or any other person has contravened or is about to contravene this Act,
(c) the employee, acting in good faith and on the basis of reasonable belief, has done or stated an intention of doing anything that is required to be done in order to avoid having any person contravene this Act,
(d) the employee, acting in good faith and on the basis of reasonable belief, has refused to do or stated an intention of refusing to do anything that is in contravention of this Act, or
(e) the employer believes that an employee will do anything described in paragraph (a), (b), (c) or (d).
Unauthorized disclosure prohibited
30.4 A person referred to in section 31.1 who has access, whether authorized or unauthorized, to personal information in the custody or control of a public body, must not disclose that information except as authorized under this Act.
3 The following section is added to Division 1 of Part 3:
Application to employees and others
31.1 The requirements and restrictions established by this Part also apply to
(a) the employees, officers and directors of a public body, and
(b) in the case of an employee that is a service provider, all employees and associates of the service provider.
4 Section 33 is repealed and the following substituted:
Disclosure of personal information
33 A public body must ensure that personal information in its custody or under its control is disclosed only as permitted under section 33.1 or 33.2.
Disclosure inside or outside Canada
33.1 (1) A public body may disclose personal information referred to in section 33 inside or outside Canada as follows:
(a) in accordance with Part 2;
(b) if the individual the information is about has identified the information and consented, in the prescribed manner, to its disclosure inside or outside Canada, as applicable;
(c) in accordance with an enactment of British Columbia or Canada that authorizes or requires its disclosure;
(d) in accordance with a provision of a treaty, arrangement or agreement that
(i) authorizes or requires its disclosure, and
(ii) is made under an enactment of British Columbia or Canada;
(e) to a minister, if the information is immediately necessary for the performance of the duties of the minister;
(f) to an officer or employee of the public body or to a minister, if the information is immediately necessary for the protection of the health or safety of the officer, employee or minister;
(g) to the Attorney General or legal counsel for the public body, for use in civil proceedings involving the government or public body;
(h) to the minister responsible for the Coroners Act or a person referred to in section 36 of that Act, for the purposes of that Act;
(i) for the purposes of
(i) collecting monies owing by an individual to the government of British Columbia or to a public body, or
(ii) making a payment owing by the government of British Columbia or by a public body to an individual;
(j) in the case of the Insurance Corporation of British Columbia, if
(i) the information was obtained or compiled by that public body for purposes of insurance provided by the public body, and
(ii) disclosure of the information is necessary to investigate, manage or settle a specific insurance claim;
(k) for the purposes of
(i) licensing or registration of motor vehicles or drivers, or
(ii) verification of motor vehicle insurance, motor vehicle registration or drivers licences;
(l) for the purposes of licensing, registration, insurance, investigation or discipline of persons regulated inside or outside Canada by governing bodies of professions and occupations;
(m) if
(i) the head of the public body determines that compelling circumstances exist that affect anyone's health or safety, and
(ii) notice of disclosure is mailed to the last known address of the individual the information is about, unless the head of the public body considers that giving this notice could harm someone's health or safety;
(n) so that the next of kin or a friend of an injured, ill or deceased individual may be contacted;
(o) in accordance with section 36 (disclosure for archival or historical purposes).
(2) In addition to the authority under any other provision of this section or section 33.2, a public body that is a law enforcement agency may disclose personal information referred to in section 33
(a) to another law enforcement agency in Canada, or
(b) to a law enforcement agency in a foreign country under an arrangement, a written agreement, a treaty or provincial or Canadian legislative authority.
(3) The minister responsible for this Act may, by order, allow disclosure outside Canada under a provision of section 33.2 in specific cases or specified circumstances, subject to any restrictions or conditions that the minister considers advisable.
Disclosure inside Canada only
33.2 A public body may disclose personal information referred to in section 33 inside Canada as follows:
(a) for the purpose for which it was obtained or compiled or for a use consistent with that purpose (see section 34);
(b) to comply with a subpoena, warrant or order issued or made by a court, person or body in Canada with jurisdiction to compel the production of information;
(c) to an officer or employee of the public body or to a minister, if the information is necessary for the performance of the duties of the officer, employee or minister;
(d) to an officer or employee of the public body or to a minister, if the information is necessary for the delivery of a common or integrated program or activity and for the performance of the duties of the officer, employee or minister to whom the information is disclosed;
(e) to an officer or employee of a public body or to a minister, if the information is necessary for the protection of the health or safety of the officer, employee or minister;
(f) to the auditor general or any other prescribed person or body for audit purposes;
(g) to a member of the Legislative Assembly who has been requested by the individual the information is about to assist in resolving a problem;
(h) to a representative of the bargaining agent, who has been authorized in writing by the employee whom the information is about, to make an inquiry;
(i) to a public body or a law enforcement agency in Canada to assist in a specific investigation
(i) undertaken with a view to a law enforcement proceeding, or
(ii) from which a law enforcement proceeding is likely to result;
(j) to the archives of the government of British Columbia or the archives of a public body, for archival purposes;
(k) in accordance with section 35 (disclosure for research or statistical purposes).
5 Section 34 (1) is amended by striking out "33" and substituting "33.2".
6 Section 42 is amended
(a) by repealing subsection (1) (b) and substituting the following:
(b) make an order described in section 58 (3), whether the order results from an investigation or audit under paragraph (a) or an inquiry under section 56, , and
(b) by repealing subsection (2) (e) and substituting the following:
(e) personal information has been collected, used or disclosed in contravention of Part 3 by
(i) a public body or an employee, officer or director of a public body, or
(ii) an employee or associate of a service provider.
7 Section 58 is amended
(a) by repealing subsection (3) (e) and substituting the following:
(e) require a public body or service provider to stop collecting, using or disclosing personal information in contravention of this Act, or confirm a decision of a public body or service provider to collect, use or disclose personal information; , and
(b) in subsection (5) by adding the following paragraph:
(b.1) any service provider to whom the order is directed; .
8 Section 59 (1) is repealed and the following substituted:
(1) Not later than 30 days after being given a copy of an order of the commissioner, the head of the public body concerned or the service provider to whom the order is directed, as applicable, must comply with the order unless an application for judicial review of the order is brought before that period ends.
9 Section 69 is amended
(a) by repealing subsection (2) and substituting the following:
(2) The minister responsible for this Act must maintain and publish a personal information directory to provide information about records in the custody or under the control of ministries of the government of British Columbia and about the use of those records. ,
(b) by repealing subsection (3) (a) and substituting the following:
(a) the personal information banks that are in the custody or control of each ministry of the government of British Columbia; , and
(c) by adding the following subsection:
(8) Not later than 60 days after making an order under section 33.1 (3) (orders allowing disclosure outside Canada), the minister responsible for this Act must publish a summary of the order.
10 The following section is added:
Privacy protection offences
74.1 (1) A person who contravenes section 30.4 (unauthorized disclosure) commits an offence.
(2) A person who is a service provider or an employee or associate of a service provider commits an offence if the person does any of the following:
(a) stores or allows access to personal information to which section 30.1 (location and access in Canada) applies contrary to that section;
(b) contravenes section 30.2 (obligation to report foreign demand for disclosure);
(c) contravenes section 30.3 (whistle-blower protection).
(3) If an employee or associate of a service provider
(a) stores or allows access to personal information to which section 30.1 (location and access in Canada) applies contrary to that section,
(b) contravenes section 30.2 (obligation to report foreign demand for disclosure),
(c) contravenes section 30.3 (whistle-blower protection), or
(d) contravenes section 30.4 (unauthorized disclosure),
in relation to personal information that is held because of the service provider's status as a service provider, the service provider commits an offence.
(4) If a corporation commits an offence under this section, an officer, director or agent of the corporation who authorizes, permits or acquiesces in the commission of the offence also commits an offence, whether or not the corporation is prosecuted for the offence.
(5) A person who commits an offence under this section is liable
(a) in the case of an individual, other than an individual who is a service provider, to a fine of up to $2 000,
(b) in the case of a partnership that is or individual who is a service provider, to a fine of up to $25 000, and
(c) in the case of a corporation, to a fine of up to $500 000.
(6) The time limit for laying an information to commence a prosecution for an offence under this section is
(a) one year after the date on which the act or omission that is alleged to constitute the offence occurred, or
(b) if the minister responsible for this Act issues a certificate described in subsection (7), one year after the date on which the minister learned of the act or omission referred to in paragraph (a).
(7) A certificate purporting to have been issued by the minister responsible for this Act certifying the date referred to in subsection (6) (b) is proof of that date.
(8) In a prosecution for an offence under this section, it is a defence for the person charged to prove that the person exercised due diligence to avoid the commission of the offence.
11 Schedule 1 is amended
(a) by repealing the definitions of "employee" and "personal information" and substituting the following:
"employee", in relation to a public body, includes
(a) a volunteer, and
(b) a service provider;
"personal information" means recorded information about an identifiable individual other than contact information; , and
(b) by adding the following definitions:
"affiliate" means an affiliate within the meaning of the Business Corporations Act;
"associate" means, in relation to a service provider,
(a) an officer, director or partner of the service provider,
(b) an affiliate of the service provider,
(c) a subcontractor, or further sub-subcontractor, of the service provider or an affiliate of the service provider, or
(d) an employee, officer, director or partner of an affiliate referred to in paragraph (b) or of a subcontractor or further sub-subcontractor referred to in paragraph (c),
to or through whom access is made available to personal information that is
(e) subject to Division 2 (Use and Disclosure of Personal Information by Public Bodies) of Part 3, and
(f) held because of the service provider's status as a service provider;
"contact information" means information to enable an individual at a place of business to be contacted and includes the name, position name or title, business telephone number, business address, business email or business fax number of the individual;
"service provider" means a person retained under a contract to perform services for a public body; .
Consequential Amendments
Assessment Act
12 Section 68 (4) (a) of the Assessment Act, R.S.B.C. 1996, c. 20, is repealed and the following substituted:
(a) to a person or for a purpose specified in section 33.1 or 33.2 of the Freedom of Information and Protection of Privacy Act, .
Child, Family and Community Service Act
13 Section 78 of the Child, Family and Community Service Act, R.S.B.C. 1996, c. 46, is repealed and the following substituted:
Disclosure with consent
78 (1) A director may disclose information obtained under this Act if a person who under section 76 has a right of access to a record containing that information has consented in the prescribed manner to its disclosure.
(2) Disclosure under subsection (1) may only be within Canada unless the consent specifically allows disclosure outside Canada.
14 Section 79 (b), (j), (k) and (l) is repealed and the following substituted:
(b) required by section 64 or by order of a court in Canada to be made to a party to a proceeding,
(j) made in Canada to caregivers and the information relates to children in their care,
(k) made in Canada and necessary for the administration of this Act, or
(l) made in Canada and for research purposes in accordance with section 35 of the Freedom of Information and Protection of Privacy Act.
15 Section 80 is repealed and the following substituted:
Accuracy, protection and retention of information
80 (1) The following provisions of the Freedom of Information and Protection of Privacy Act apply to a director:
(a) section 28 [accuracy of personal information];
(b) section 30 [protection of personal information];
(c) section 30.1 [storage and access must be in Canada];
(d) section 30.2 [obligation to report to foreign demand for disclosure];
(e) section 30.3 [whistle-blower protection];
(f) section 30.4 [unauthorized disclosure prohibited];
(g) section 31 [retention of personal information];
(h) section 74.1 [privacy protection offences].
(2) For the purposes of this section,
(a) a reference in the Freedom of Information and Protection of Privacy Act to that Act is deemed to include a reference to this Act,
(b) a reference in that Act to "head" includes, with respect to a record, the director who has custody or control of the record, and
(c) a reference in that Act to "public body", where a power, function or duty is not conferred on the head of the same public body, includes, with respect to a record, the director who has custody or control of the record.
(3) In addition, the requirements and restrictions established by this section and sections 78 and 79 apply to
(a) employees of a director,
(b) service providers, within the meaning of the Freedom of Information and Protection of Privacy Act, to a director, and
(c) the employees, officers, directors and associates, within the meaning of the Freedom of Information and Protection of Privacy Act, of a service provider referred to in paragraph (b).
Community Living Authority Act
16 Section 83 of the Community Living Authority Act, as it enacts section 74 of the Child, Family and Community Services Act, R.S.B.C. 1996, c. 46, is amended by repealing section 74 (2) (e) and substituting the following:
(e) the only provisions of sections 33.1 and 33.2 that apply to a director are the following:
(i) section 33.1 (1) (a) [in accordance with Part 2 of the Act];
(ii) section 33.1 (1) (b) [individual consent];
(iii) section 33.1 (1) (o) [archival and historical purposes];
(iv) section 33.2 (j) [in Canada -- archives];
(v) section 33.2 (k) [in Canada -- research]; .
Criminal Records Review Act
17 Section 6 of the Criminal Records Review Act, R.S.B.C. 1996, c. 86, is amended
(a) in subsection (3) by striking out "section 33 (n) or (p)" and substituting "section 33.1 (l) (m), 33.2 (i)", and
(b) in subsection (4) by striking out "sections 33 (n) and (p) and 44 (2) and (3) of that Act." and substituting "the provisions of that Act referred to in subsection (3)."
Family Maintenance Enforcement Act
18 Section 43 (2) of the Family Maintenance Enforcement Act, R.S.B.C. 1996, c. 127, is amended by striking out "section 35" and substituting "section 33.2 (k)".
Family Relations Act
19 Sections 3 (5) (c) and 100 (6) (c) of the Family Relations Act, R.S.B.C. 1996, c. 128, are amended by striking out "section 35" and substituting "section 33.2 (k)".
Income Tax Act
20 Section 64 (8) of the Income Tax Act, R.S.B.C. 1996, c. 215, is amended by striking out "sections 32 and 33" and substituting "sections 32, 33, 33.1 and 33.2".
Medicare Protection Act
21 Section 49 (d) of the Medicare Protection Act, R.S.B.C. 1996, c. 286, is amended by striking out "section 35" and substituting "section 33.2 (k)".
Police Act
22 Section 66.1 of the Police Act, R.S.B.C. 1996, c. 367, is amended by striking out "Except as provided by this Act, the Freedom of Information and Protection of Privacy Act does not apply" and substituting "Except as provided by this Act and by section 3 (3) of the Freedom of Information and Protection of Privacy Act, that Act does not apply".
Transitional -- existing contracts and research arrangements
23 (1) In this section:
"contract" means
(a) a contract entered into by a public authority for the provision of services by a service provider within the meaning of the Freedom of Information and Protection of Privacy Act, or
(b) a contract or other arrangement entered into by a public authority under which personal information is disclosed under section 35 [disclosure for research or statistical purposes] of the Freedom of Information and Protection of Privacy Act;
"contract commitment date" means
(a) in the case of a contract that a public authority is legally obliged to enter into as a result of a completed binding competitive process, the date on which the process was completed, or
(b) in any other case, the date on which the contract was entered into by the public authority;
"new disclosure rules" means Part 3 of the Freedom of Information and Protection of Privacy Act, as amended by this Act, other than section 30.3 [whistle-blower protection] of that Act;
"previous disclosure rules" means Part 3 of the Freedom of Information and Protection of Privacy Act, as it read before its amendment by this Act;
"public authority" means
(a) the government,
(b) a public body within the meaning of the Freedom of Information and Protection of Privacy Act, or
(c) a director under the Child, Family and Community Service Act.
(2) The new disclosure rules apply in relation to all contracts for which the contract commitment date is later than
(a) October 12, 2004, in the case of a contract entered into by the government or a ministry, or
(b) the date on which this Act receives Royal Assent, in the case of a contract entered into by another public authority.
(3) Subject to subsection (4), in relation to a contract for which the contract commitment date is on or earlier than the applicable date under subsection (2),
(a) the previous disclosure rules are deemed to continue in force and apply to the contract, until the end of the term of the contract as it was on that contract commitment date, and
(b) the new disclosure rules apply to the contract after that time.
(4) In relation to the services provided under a contract to which subsection (3) applies, the public authority must use all reasonable efforts to come into compliance with the new disclosure rules as soon as reasonably possible.
(5) For certainty, the application of section 30.3 [whistle-blower protection] of the Freedom of Information and Protection of Privacy Act is not affected by this section.
Commencement
24 This Act comes into force on the date of Royal Assent.