A Minister’s Guide to Protecting Personal Information 8 (ii) provides information management or information technology services to a government institution with respect to records of the government institution containing personal information; Although Ministers’ offices are not subject to section 24.2 of FOIP, it is nonetheless best practice to follow this section if engaging an IMSP. Subsection 24.2(1) provides: 24.2(1) A government institution may provide personal information to an information management service provider for the purposes of: (a) having the information management service provider process, store, archive or destroy the personal information for the government institution; (b) enabling the information management service provider to provide the government institution with information management or information technology services; (c) having the information management service provider take possession or control of the personal information; (d) combining records containing personal information; or (e) providing consulting services. Where a Ministers’ office engages an IMSP, it is best practice to enter into a written agreement. Subsections 24.2(2) and (3) provide: 24.2(2) Before disclosing personal information to an information management service provider, a government institution shall enter into a written agreement with the information management service provider that: (a) governs the access to and use, disclosure, storage, archiving, modification and destruction of the personal information; (b) provides for the protection of the personal information; and (c) meets the requirements of this Act and the regulations. (3) An information management service provider shall not obtain access to, use, disclose, process, store, archive, modify or destroy personal information received from a government institution except for the purposes set out in subsection (1). See the IPC’s resource entitled Best Practice for Information Sharing Agreements.
RkJQdWJsaXNoZXIy MTgwMjYzOA==