Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 182 Interpretation Note Many Reports by the Commissioner have been issued over the years for subsection 28(b) of FOIP. However, those reports reflect a former interpretation of this provision. The former interpretation was that a government institution could “use” personal information for a purpose it could also “disclose” that personal information. This former interpretation was consistent with the Office of the Alberta Information and Privacy Commissioner’s (AB IPC) interpretation of a similar provision in Alberta’s FOIP Act. However, AB IPC shifted its interpretation. At the present time, British Columbia, Alberta, and Manitoba all have provisions in their FOIP Acts that are similarly worded to Saskatchewan’s 28(b) of FOIP and all three have interpretations consistent with each other. The guidance reflected in this Chapter is consistent with the interpretations of these other provinces. As of the issuing of this Chapter, the interpretation for subsection 28(b) of FOIP will be shifting to adopt this new interpretation reflected in this Chapter and would be consistent with British Columbia, Alberta and Manitoba. Reports issued prior to this Chapter would not reflect this new interpretation but rather the old one. “Use” Involving Contracted Third Parties In the privacy world, when records are provided to a contractor and yet remain under the control of a government institution this constitutes a “use” and not a “disclosure”. In other words, there is no disclosure if the government institution retains control over the records. “Transfer” is a use by the government institution. It is not to be confused with a disclosure. When a government institution transfers personal information for processing, it can only be used for the purposes for which the information was originally collected. Example: transferring of personal information for the purpose of processing payments to customers. Example: an internet service provider may transfer personal information to a third party to ensure that technical support is available on a 24/7 basis.
RkJQdWJsaXNoZXIy MTgwMjYzOA==