Appropriate Handling of Personal Information in an Emergency
Privacy laws should not handcuff emergency management. If a provincial employee is well-intentioned, but does not understand what a public body may do in an emergency situation, it may result in distress and delays.
Sections 15, 30 and 37 of the Freedom of Information and Protection of Privacy Act (the "FOIPP Act") may apply in an emergency situation, as they specifically describe limited instances where the disclosure of personal information without consent is authorized, including:
• for the protection of or harm to public health and safety;
• for the protection of or harm to the environment; or
• when the disclosure is clearly in the public interest
[ss. 15(2)(b), (c), 15(5)(b), 30, 37(1)(q), (cc) of the FOIPP Act, and s. 5 and Schedule 3 of its regulations].
Part II of the FOIPP Act puts restrictions on provincial public bodies for how they collect, use and disclose personal information; however, these restrictions should not interfere with emergency management.
Collection: A public body usually collects personal information directly from the individual the information is about. When there is a health or safety emergency and an individual is not able to provide the information directly, and if the public body thinks the information is accurate, the public body can collect personal information from other sources [clause 32(1)(l)]. The Commissioner may also authorize collection of information from sources other than the individual [clause 50(1)(f).
If an individual believes there is an error or omission in their personal information, he or she may request the public body that has the information to correct it. The public body must also notify any other public body or third party the personal information has been disclosed to of the correction and ask that they correct it as well.
Use: A public body may use personal information only for the purpose for which the information was collected, or for a use consistent with that purpose [subsection 36(1)].
Disclosure: A public body has an obligation to, without delay, disclose information about a risk of significant harm to the environment or to health or safety [section 30]. If the information is about a third party, the public body has to give notice to the third party.
A public body may disclose personal information for the purpose for which the information was collected, for a use consistent with that purpose and if it would not be an unreasonable invasion of personal privacy [clauses 37(1)(a.1) and (b)]. The law specifically allows the public body to disclose personal information:
• so that a spouse, relative or a friend of an injured, ill or deceased individual may be contacted [clause 37(1)(q)]; and
• if the head of a public body believes, on reasonable grounds, that the disclosure will avert or minimize an imminent danger to the health or safety of any person [clause 37(1)(cc)].
It is not considered an unreasonable invasion of personal privacy for a public body to disclose personal information when someone has been admitted to a health care facility or institution as a current patient or resident, except where the disclosure would reveal the nature of the third party’s treatment, or if the individual specifically requests that this information not be disclosed.
Note: Private businesses on Prince Edward Island may refer to the Personal Information Protection and Electronic Documents Act (PIPEDA) at the Office of the Privacy Commissioner of Canada.
Federally, the Office of the Privacy Commissioner of Canada, in consultation with the privacy oversight offices in Alberta, British Columbia, Manitoba, Newfoundland and Labrador, Northwest Territories, Nova Scotia, Nunavut, Ontario, Prince Edward Island, Quebec, Saskatchewan and Yukon, created a privacy emergency kit to help organizations enhance the timeliness and content of communications during an emergency while giving people confidence that their personal information will be handled appropriately.