Guide to FOIP-Chapter 6

Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 13 Individuals should be able to maintain a level of control over their own personal information. However, this is not possible if organizations are not clear and transparent about the reasons for collecting the personal information. Consent The Model Code states: The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. One of the most prominent and distinctive features of the Model Code is that it is consentdriven. In other words, subject to limited exceptions, consent of the individual is required to collect, use or disclose personal information about that individual. For more on consent, see Consent Requirements, later in this Chapter. Limiting Collection The Model Code states: The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means. Limiting collection can only be accomplished if the purpose is clearly identified as stated in Fair Information Principle #2. Organizations should not collect more than what is necessary for the identified purpose. With advancements in technology, personal information is becoming more valuable, and organizations realize that personal information is a form of data currency. For more on this topic, see Over-collection and Data Minimization later in this Chapter. Limiting Use, Disclosure and Retention The Model Code states: