Guide to FOIP-Chapter 6

Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 23 De-identification Guidelines for Structured Data (June 2016, ON IPC) IPC Findings In Review Report LA-2013-003, the Commissioner found that the then Saskatoon Regional Health Authority (SRHA) severed the names, email addresses, mailing addresses, other contact information and the opinions submitted by private individuals. The Commissioner noted that once the name and contact information was severed from the record, the contents of the record would be sufficiently de-identified. Once information was sufficiently deidentified, it no longer was classified as personal information for purposes of The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) and could be released. In Review Report F-2014-005, the Commissioner considered the severing of names of teachers, the schools they worked, classes they taught and extra-curricular activities involved in and their work email addresses. This information was not considered personal information. However, the Ministry of Education had concerns about the linking of this information to other information that would reveal personal information of other individuals. The Commissioner considered whether it would be reasonable to expect that an individual may be identified if this information were disclosed. The Commissioner found that these pieces of information were unique identifiers that, if released, would make it more possible to identify a specific teacher involved in professional misconduct or incompetence and the name of the victim. In Investigation Report 105-2014, the Commissioner found that direct and quasi-identifiers were being shared among participants of a Hub as part of Community Mobilization Prince Albert (CMPA). The Commissioner recommended that a comprehensive plan be developed and implemented to ensure deficiencies pertaining to agreements, policy, procedure, notice, training and documentation to ensure a consistent approach by all partner agencies. Further, the plan was to address, among other things, de-identification. In Review Report 044-2017, the Commissioner recommended that Horizon School Division review records and de-identify information as much as possible. In some instances, the record could be de-identified by severing names of other students or parents. In other instances, de-identification may require removing portions or entire sentences. Further, the Commissioner recommended that Horizon School Division release the de-identified information regarding its investigation to the applicant.