Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 3, Access to Records. Updated 5 May 2023. 6 FOIP. It provides guidance on processing access to information requests from the time they are received, to sending the section 7 decision to the applicant. Name of Applicant is Personal Information Government institutions should be careful when sharing the name of an applicant who has submitted an access to information request. When handling an access to information request, the government institution must protect the identity of the applicant, along with the applicant’s contact information that appears on the access to information request. As the name and contact information of the applicant, in most cases, is their personal information pursuant to subsection 24(1) of FOIP, it is subject to the privacy protections in Part IV of FOIP. This includes restrictions on the collection, use and disclosure of that personal information. For more on the obligations on government institutions to protect personal information, see the Guide to FOIP, Chapter 6, “Protection of Privacy”. The data minimization and need-to-know principles should be abided by when deciding who to share the applicant’s personal information with. The key question to ask is, does the person I am sharing this with need to know the identity of the applicant or their contact information to process the request or can it be done without sharing it? If the request can still be processed without sharing it, then it should not be shared. When considering sharing this personal information internally, section 28 of FOIP should be abided by. If considering sharing it externally (e.g., with another government institution), there must be authority to do so under subsection 29(2) of FOIP. For more on these two principles and section 28 and subsection 29(2) of FOIP, see the Guide to FOIP, Chapter 6, “Protection of Privacy”. All applicants are equal under FOIP. The identity of the applicant should not change how the government institution responds to the access to information request (e.g., the applicant is the media so the government institution decides not to release information it generally would release). IPC Findings In Investigation Report 278-2017, the Commissioner investigated an alleged breach of privacy involving Saskatchewan Power Corporation (SaskPower). The complaint alleged that when the individual sent an access to information request to SaskPower, it then sent a briefing note to the Minister responsible for SaskPower. The briefing note contained details about the access to information request and included the applicant’s first and last name. Upon investigation, the Commissioner found that the name of an applicant was personal
RkJQdWJsaXNoZXIy MTgwMjYzOA==