Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 259 (a) for the purposes of protecting the security of the correctional facility or the safety of inmates, staff members or the public; (b) for the purposes of the investigation of or prevention of the commission of an offence; (c) for the purposes of any investigation being conducted pursuant to the Act; or (d) for any purpose for which personal information may be used or disclosed by a government institution pursuant to The Freedom of Information and Protection of Privacy Act. Government institutions should still abide by the data minimization and need-to-know principles when disclosing personal information. Only disclose the least amount of personal information necessary to achieve the purpose. Further, only disclose to those that have a need-to-know the personal information to carry out the purpose. See Need-to-Know and Data Minimization earlier in this Chapter. IPC Findings In Investigation Report F-2005-001, the Commissioner investigated a complaint involving the Automobile Injury Appeal Commission (Commission). The complaint alleged that the Commission was publishing on its website the full text of its decisions which included a great deal of personal information and personal health information. The Commission asserted it had authority to do this under several provisions of FOIP including subsection 29(2)(t) of FOIP. The Commission pointed to The Automobile Accident Insurance Act and The Personal Injury Benefits Regulations as Acts or regulations that “authorized” disclosure of the personal information to the internet. The Commissioner found that there was statutory authority for the hearings to be open, for the written decision to be part of the record and for the decision to be made available to the parties. However, the Commissioner also found that the Commission did not refer to any Act or regulation that authorized disclosure of personal information and personal health information via the internet in the fashion practiced by the Commission. The Commissioner concluded that the publication of individually identifying personal information of applicants on the internet could not be justified by subsection 29(2)(t) of FOIP. Along with several other recommendations, the Commissioner recommended that the identity of applicants be redacted or masked before publication to the website.
RkJQdWJsaXNoZXIy MTgwMjYzOA==