OPC Provides Guidance on Disclosure Provisions

On March 17, 2017, the Office of the Privacy Commissioner of Canada (OPC) published guidance for the application of  Sections 7(3)(d.1)-(d.2) (the Provisions) of the Personal Information Protection and Electronic Documents Act (PIPEDA). 

In 2015, the Digital Privacy Act, amended the Provisions, which deal with the disclosure of personal information without consent for certain investigative purposes.

The previous scheme permitted disclosure to a “designated investigative body”.  The amended scheme allows for the disclosure “to another organization” without the knowledge or consent of the individual for the investigation of contractual breaches, contravention of laws, or for the detection or prevention of fraud.  The Provisions contain restrictions, including that the disclosure must be reasonable for the permitted purposes and there must be a reasonable belief that disclosure with knowledge or consent of the individual concerned would compromise the effort.

The OPC made it clear that the Provisions:

• are not to be applied in an overly broad manner;
• do not allow for widespread disclosures and casual sharing of personal information; and
• are limited to certain purposes, under defined circumstances, and given specific conditions.

In overseeing the Provisions, the OPC said that it will expect organizations to:

• carry out due diligence and exercise good judgment;
• carefully consider each of the requirements explicitly outlined in the Provisions; and
• ensure that the limits set out in the Provisions are respected.

The OPC also discussed the following reasonability analyses that appear in each of the Provisions: 

• for paragraph 7(3)(d.1), “reasonable for the purposes” requires an investigation into a specific breach of agreement or contravention of a domestic law.  Disclosures must be proportionate to the purpose of the investigation; and
• while paragraph 7(3)(d.2) does not require a specific instance of fraud in the same manner as paragraph 7(3)(d.1), the risk of fraud must be probable and the same principle of proportionality applies.

Summary by: Lisa Danay