Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 220 information necessary to achieve the purpose. Further, only disclose to those that have a need-to-know the personal information to carry out the purpose. See Need-to-Know and Data Minimization earlier in this Chapter. IPC Findings In Investigation Report 133-2015, the Commissioner investigated a complaint involving Saskatchewan Power Corporation (SaskPower). The complaint alleged that SaskPower inappropriately disclosed the complainant’s personal information and personal health information to the Saskatchewan Workers’ Compensation Board (WCB). SaskPower asserted it had authority to disclose the personal information pursuant to various provisions under subsection 29(2) of FOIP including subsection 29(2)(i) of FOIP. SaskPower asserted that subsection 52(f) of The Workers’ Compensation Act, 2013 required SaskPower to disclose the personal information. The Commissioner found that SaskPower was authorized by subsection 29(2)(i) of FOIP to disclose the complainant’s personal information to WCB. In Investigation Report F-2014-001, the Commissioner investigated a complaint involving Saskatchewan Workers’ Compensation Board (WCB). The complaint alleged that WCB disclosed too much of the complainant’s personal information in its “Decision of the Appeals Department” letter to the complainant’s employer. The letter contained personal information regarding medical symptoms and diagnoses unrelated to her WCB claim such as pneumonia and alcohol dependence syndrome. The Commissioner found that FOIP applied in this matter and not The Health Information Protection Act. WCB asserted that it had authority for the disclosure but did not point to a specific provision in subsection 29(2) of FOIP that would authorize it to disclose the personal information without consent. However, it asserted that section 104 of The Workers’ Compensation Act, 1979 was justification to disclose the personal information. It argued that an employer would need the information if they wished to provide employers with a right to request a review of compensation paid. However, the Commissioner found that the complainant lost her appeal, and no compensation was being paid. As such, WCB could not rely on section 104 of The Workers’ Compensation Act, 1979 or subsection 29(2)(i) of FOIP for the disclosure. The Commissioner also found that WCB did not abide by the data minimization principle. Among other recommendations, the Commissioner recommended WCB seek to retrieve back the sensitive personal information it disclosed and investigate why its procedure protecting against non-compliance with the data minimization principle was not adhered to in this case.
RkJQdWJsaXNoZXIy MTgwMjYzOA==