Office of the Saskatchewan Information and Privacy Commissioner. Guide to FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 335 FOIP does not specify how long a government institution should retain personal information. However, a specifically identified purpose is often a clear indicator of how long this information needs to be retained. There may be legislative requirements to keep information for a certain amount of time. In other instances, there may be no legislative requirement, and an organization needs to determine the appropriate retention period. In assessing what is the appropriate retention period and whether it is time to dispose of personal information, an organization can consider the following points: • Reviewing the purpose for having collected the personal information in the first place is generally helpful in assessing how long certain personal information should be retained. • If personal information was used to make a decision about an individual, it should be retained for the legally required period of time thereafter – or other reasonable amount of time in the absence of legislative requirements – to allow the individual to access that information in order to understand, and possibly challenge, the basis for the decision. • If retaining personal information any longer would result in a prejudice for the concerned individual or increase the risk and exposure of potential data breaches, the organization should consider safely disposing of it.823 Developing plain language internal policies and procedures that set out clear retention and disposal schedules – including minimum and maximum retention periods for the various types of personal information that are being held – is key. Internal policies should address the whole lifecycle of the personal information held by the organization.824 Contractors Each government institution should have its own retention and disposition schedule that apply to records being maintained by a contractor on behalf of the government institution. Such retention and disposition schedules should be included as part of the 823 Office of the Privacy Commissioner of Canada, Personal Information Retention and Disposal: Principle and Best Practices. June 2014. Available at Personal Information Retention and Disposal: Principles and Best Practices - Office of the Privacy Commissioner of Canada. Accessed December 19, 2022. 824 Office of the Privacy Commissioner of Canada, Personal Information Retention and Disposal: Principle and Best Practices. June 2014. Available at Personal Information Retention and Disposal: Principles and Best Practices - Office of the Privacy Commissioner of Canada. Accessed December 19, 2022.
RkJQdWJsaXNoZXIy MTgwMjYzOA==