OPC Issues Guidance on Federal Privacy Laws in light of the COVID-19 Outbreak

On March 20, 2020, the Office of the Privacy Commissioner of Canada (the OPC) issued guidance to assist organizations in navigating their privacy obligations with respect to collection, use and disclosure of personal information during a public health crisis. The guidance highlights key privacy principles under the Privacy Act, which covers the personal information-handling practices of federal government institutions, and the Personal Information Protection and Electronic Documents Act (PIPEDA), which deals with private sector organizations. The OPC clarified that “privacy laws still apply, but they are not a barrier to appropriate information sharing” during the COVID-19 pandemic.

Organizations subject to PIPEDA are reminded that meaningful consent of individuals is required to handle their personal information. However, PIPEDA allows for specific exemptions to the consent requirements that may be relevant during a health crisis, such as:

• if the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way, such as if an individual is critically ill or in a particularly dangerous situation, and needs help;
• if the collection and use is for the purpose of making a disclosure required by law (e.g. where a public health authority has the legislative authority to require the disclosure); and
• if disclosure is requested by government institution under a lawful authority for the purpose of enforcing or administering any law of Canada or a province.

Government institutions may also disclose personal information without an individual’s consent in limited circumstances, as provided in the Privacy Act. As always, organizations need to ensure that their information management practices are compliant with existing privacy laws and relevant statutory exemptions.

The OPC also noted that where federal, provincial and territorial governments formally declare public emergencies (as has already been done in all provinces and territories), the powers to collect, use and disclose personal information may be further expanded. In these circumstances, existing privacy laws still apply, unless emergency legislation states otherwise.

Summary By: Anna Troshchynsky