Guide to LA FOIP-Chapter 6

Office of the Saskatchewan Information and Privacy Commissioner. Guide to LA FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 160 Therefore, since the contractor is working on behalf of the local authority, the transfer of records to the contractor is a “use,” not a “disclosure.” Through a contract, the contractor uses the information to fulfill the local authority’s purpose for collecting the personal information in the first place.447 Local authorities are responsible for the actions of its contractors and agents when it comes to the protection of personal information it shares with its contractors and agents. Therefore, a strong written contract or agreement should be in place that spells out the privacy obligations the contractor or agent must abide by (which are the same obligations on the local authority). Subcontracting by Outsourcers Subcontracting by outsourcers is a concern that local authorities should take into consideration. A local authority having a contract with an outsource partner has a direct, legal relationship with that partner. It is aware of the contractual rights and remedies and can exercise them directly vis-à-vis its contracted partner. Furthermore, a local authority can choose who to contract with, exercising whatever due diligence it deems necessary in making the selection. This is not necessarily the case with sub-contracted outsourcers. The principle contracted outsourcer may choose its subcontractors based on entirely different criteria than would the local authority. A breach of the subcontract may only be actionable by the contractor; the local authority may have no ability to deal with the subcontractor except through the principal contractor.448 447 SK OIPC Investigation Report F-2013-001 at [76] to [78]. 448 SK OIPC Investigation Report F-2013-001 at [114]. Originates from AB IPC resource, Public-sector Outsourcing and Risks to Privacy, February 2006 at p. 28.

RkJQdWJsaXNoZXIy MTgwMjYzOA==