Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 175 • If the government institution shares the personal information internally amongst other divisions, programs or employees, this is an internal “use” of the personal information not a “disclosure”. o Sharing with contracted employees is also an internal “use” as they qualify as “employees of a government institution” pursuant to subsection 2(1)(b.1) of FOIP. Contracted companies or agents providing services on behalf of the government institution are also captured as they are not considered separate from the government institution and are receiving and using the personal information “on behalf of” the government institution. Agreements or contracts should spell out privacy responsibilities. See “Use” Involving Contracted Third Parties later in this Chapter. • If the government institution shares the personal information outside of the organization, this is generally a “disclosure”. o “Disclosure” includes sharing personal information with another government institution, as each is considered a separate “government institution” under FOIP. Government institutions should still abide by the data minimization and need-to-know principles when using personal information. Only use the least amount of personal information necessary to achieve the purpose. Further, only share internally with those that have a need-to-know the personal information to carry out the purpose. See Need-to-Know and Data Minimization earlier in this Chapter. Subsection 28(a) Use of personal information 28 No government institution shall use personal information under its control without the consent, given in the prescribed manner, of the individual to whom the information relates, except: (a) for the purpose for which the information was obtained or compiled, or for a use that is consistent with that purpose; or Subsection 28(a) of FOIP allows a government institution to use personal information for purposes consistent with the reason it was collected.
RkJQdWJsaXNoZXIy MTgwMjYzOA==