Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 211 should be able to show the connection between the personal information to be disclosed and the administration or enforcement of the law or carrying out the lawful investigation (i.e., there should be a connection between what is being disclosed and the purpose).607 Government institutions should still abide by the data minimization and need-to-know principles when disclosing personal information. Only disclose the least amount of personal information necessary to achieve the purpose. Further, only disclose to those that have a need-to-know the personal information to carry out the purpose. See Need-to-Know and Data Minimization earlier in this Chapter. IPC Findings As of the issuing of this Chapter, the Commissioner has not considered this provision in a Report yet. However, the Commissioner has considered the equivalent provision in The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) in one Investigation Report. In Investigation Report LA-2010-001, the Commissioner investigated a complaint involving the City of Saskatoon (City). The complaint alleged that the City disclosed an employee’s personal information to the Canada Revenue Agency (CRA). The City asserted it had authority to make the disclosure pursuant to subsection 28(2)(h)(i) of LA FOIP. The City asserted that the CRA administered tax laws for Saskatchewan. The request for personal information came from the Verification and Enforcement Section of the Saskatoon Tax Services Office. The City had a long-standing (more than 27 years) arrangement with the CRA to release information to assist them in administering the tax laws. The Commissioner found that the City failed to meet the burden of proof in demonstrating that subsection 28(2)(h) of LA FOIP provided it with the requisite authority to disclose. The Commissioner noted that the City’s submissions to the Commissioner were vague and lacked detail and evidence. The Commissioner stated that in order to rely on this provision, local authorities should be able to provide a copy of any agreement or arrangement in place and be able to identify which law(s) and sections of the law(s) the other party is seeking to administer or enforce. In addition, local authorities should be able to show the connection between the personal information to be disclosed and the administration or enforcement of the law or carrying out the lawful investigation (i.e., there should be a connection between what is being disclosed and the purpose). As such, the Commissioner found that the City could not rely on subsection 28(2)(h)(i) of LA FOIP. 607 SK OIPC Investigation Report LA-2010-001 at [27] to [30].
RkJQdWJsaXNoZXIy MTgwMjYzOA==