Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 181 A government institution can disclose personal information provided there is authority to do so under subsection 29(2) of FOIP. Subsection 29(2) of FOIP provides numerous circumstances under which a government institution may disclose personal information without consent of the individual for which it pertains. See Subsection 29(2)(a) through Subsection 29(4) later in this Chapter. However, the government institution that is receiving the personal information, should ensure that it has authority to collect the personal information in the first place under section 25 of FOIP (i.e., before relying on subsection 28(b) of FOIP to “use” it). If the government institution finds authority under section 25 to collect the personal information, it should also consider subsection 26(1)(b) of FOIP for authority to collect the personal information “indirectly”. Government institutions should still abide by the data minimization and need-to-know principles when using personal information. Only use the least amount of personal information necessary to achieve the purpose. Further, only share internally with those that have a need-to-know the personal information to carry out the purpose. See Need-to-Know and Data Minimization earlier in this Chapter. Example: One government institution issues a subpoena to a second government institution, as part of a court case it is preparing. The second government institution is authorized to disclose personal information to the first government institution under subsection 29(2)(b)(i) of FOIP in response to the subpoena. Subsection 28(b) of FOIP permits the first government institution to “use” that personal information for its court case. Example: A government institution has a client who has just died. It wishes to contact the next of kin of the deceased to inform them of the death but does not have the relative’s address. A second government institution does have the address and, on the request of the first government institution, may disclose it in accordance with subsection 29(2)(n) of FOIP. The first government institution may in turn “use” the personal information (address) solely in order to contact the relative and may not “use” it for any other purpose.
RkJQdWJsaXNoZXIy MTgwMjYzOA==