Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 20 population or in the data set, such as an unusual occupation or medical diagnosis, can increase the likelihood of the identity of an individual being revealed.48 Re-identification is any process that re-establishes the link between identifiable information and an individual.49 Masking is the process of removing a variable or replacing it with pseudonymous or encrypted information.50 De-identification protects the privacy of individuals because once de-identified, a data set is considered to no longer contain personal information. If a data set does not contain personal information, its use or disclosure cannot violate the privacy of individuals.51 The privacy provisions of FOIP would not apply to de-identified information. Removal of an individual’s name alone does not necessarily qualify personal information as sufficiently de-identified. It is possible to re-identify an individual if information is publicly available. The ability to re-identify is increased when the information contains unique characteristics (e.g., unusual occupation, unusual death, or event) and the existence of external sources of records with matching data elements which can be used to link with the de-identified information (e.g., voter registration records, newspapers, obituaries, social media sites and other public registries). The risk of re-identification increases as the number of variables increases, as the accuracy or resolution of the data increases and the number of external sources increases.52 An identifier is information such as: • A person’s name • Social Insurance Number • Driver’s license number • Employee number • Health card number • Address • Date of birth (usually used in combination with other identifiers such as name to distinguish between people with the same name but different birth dates) 48 ON IPC resource, De-identification Protocols: Essential for Protecting Privacy, June 25, 2014 at p. 3. 49 ON IPC resource, De-identification Guidelines for Structured Data, June 2016 at p. 2. 50 ON IPC resource, De-identification Guidelines for Structured Data, June 2016 at p. 2. 51 ON IPC resource, De-identification Guidelines for Structured Data, June 2016 at p. 1. 52 SK OIPC Review Report F-2014-005 at [22] to [23].
RkJQdWJsaXNoZXIy MTgwMjYzOA==