Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 178 personal information of the client, but the ID number was compiled by the government institution not collected from the client or indirectly from somewhere else. The purpose for collection is described in the collection notification provided to the individual when the information is collected directly (see Subsection 26(2) earlier in this Chapter). When personal information is not collected directly, or when it is compiled from several sources, the purpose should be stated in the written policy or procedure dealing with the program.535 In most cases, the government institution using the information, will be the government institution that collected it. However, if the personal information has been collected for the purposes of delivering a common or integrated service, the government institution using the information may not be the government institution that originally collected it.536 See section 17.1 of The Freedom of Information and Protection of Privacy Regulations for more on common or integrated services. Government institutions should still abide by the data minimization and need-to-know principles when using personal information. Only use the least amount of personal information necessary to achieve the purpose. Further, only share internally with those that have a need-to-know the personal information to carry out the purpose. See Need-to-Know and Data Minimization earlier in this Chapter. IPC Findings In Investigation Report 040-2021, the Commissioner investigated a privacy complaint involving the Ministry of Social Services (Social Services). The complaint alleged that Social Services used the complainant’s personal information inappropriately when one of its employees accessed the complainant’s case file from another location in the province. Social Services asserted that it had authority to access the complainant’s case file pursuant to subsection 28(1) of FOIP. During the investigation, the Commissioner determined that Social Services accessed the complainant’s case file from the North Battleford Income Assistance Division. Clients can have multiple workers at Social Services as a point of contact due to the new electronic system (MiCase) which allows access from all over the province. This permits faster service. Two tasks were completed in the complainant’s case file. Both tasks appeared to fall within the list of tasks outlined on the consent form which is signed by all Income Assistance clients when applying for income assistance. As a result of there being consent, 535 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 7, p. 260. 536 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 7, p. 294.
RkJQdWJsaXNoZXIy MTgwMjYzOA==