Office of the Saskatchewan Information and Privacy Commissioner. Guide to LA FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 187 Local authorities should still abide by the data minimization and need-to-know principles when disclosing personal information. Only disclose the least amount of personal information necessary to achieve the purpose. Further, only disclose to those that have a need-to-know the personal information to carry out the purpose. See Need-to-Know and Data Minimization earlier in this Chapter. IPC Findings In Investigation Report LA-2010-001, the Commissioner investigated a complaint involving the City of Saskatoon (City). The complaint alleged that the City disclosed an employee’s personal information to the Canada Revenue Agency (CRA). The City asserted it had authority to make the disclosure pursuant to subsection 28(2)(h)(i) of LA FOIP. The City asserted that the CRA administered tax laws for Saskatchewan. The request for personal information came from the Verification and Enforcement Section of the Saskatoon Tax Services Office. The City had a long-standing (more than 27 years) arrangement with the CRA to release information to assist them in administering the tax laws. The Commissioner found that the City failed to meet the burden of proof in demonstrating that subsection 28(2)(h)(i) of LA FOIP provided it with the requisite authority to disclose. The Commissioner noted that the City’s submissions to the Commissioner were vague and lacked detail and evidence. The Commissioner stated that in order to rely on this provision, local authorities should be able to provide a copy of any agreement or arrangement in place and be able to identify which law(s) and sections of the law(s) the other party is seeking to administer or enforce. In addition, local authorities should be able to show the connection between the personal information to be disclosed and the administration or enforcement of the law or carrying out the lawful investigation (i.e., there should be a connection between what is being disclosed and the purpose). As such, the Commissioner found that the City could not rely on subsection 28(2)(h)(i) of LA FOIP. Subsection 28(2)(h.1) Disclosure of personal information 28(2) Subject to any other Act or regulation, personal information in the possession or under the control of a local authority may be disclosed: … (h.1) for any purpose related to the detection, investigation or prevention of an act or omission that might constitute a terrorist activity as defined in the Criminal Code, to:
RkJQdWJsaXNoZXIy MTgwMjYzOA==