Office of the Saskatchewan Information and Privacy Commissioner. Guide to LA FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 231 IPC Findings In Investigation Report 062-2016, the Commissioner investigated an alleged breach of privacy involving the former Keewatin Yatthe Regional Health Authority (Keewatin). The complaint alleged that Keewatin disclosed the complainant’s personal information to the Saskatchewan Union of Nurses (SUN) and the Saskatchewan Association of Health Organizations (SAHO). The personal information pertained to the performance of the employee and their misconduct. Keewatin asserted that subsection 28(2)(s) of LA FOIP provided authority for the disclosure and pointed to subsection 10(b) and (f) of The Local Authority Freedom of Information and Protection of Privacy Regulations. The Commissioner found that Keewatin had authority for the disclosure pursuant to subsection 28(2)(s) of LA FOIP and subsections 10(b) and (f) of The Local Authority Freedom of Information and Protection of Privacy Regulations. In Investigation Report 296-2017, the Commissioner investigated an alleged breach of privacy involving the Northern Lights School Division No. 113 (Northern Lights). The complaint alleged that Northern Lights disclosed a letter of termination to the complainant’s new employer without authority to do so. Northern Lights asserted it had authority to do so under subsection 28(2)(s) of LA FOIP and subsection 10(g)(ii) of The Local Authority Freedom of Information and Protection of Privacy Regulations. The Commissioner found that Northern Lights had authority under subsection 28(2)(s) of LA FOIP and subsection 10(g)(ii) of The Local Authority Freedom of Information and Protection of Privacy Regulations. Section 28.1: Notification Notification 28.1 A local authority shall take all reasonable steps to notify an individual of an unauthorized use or disclosure of that individual’s personal information by the local authority if it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to the individual. Section 28.1 of LA FOIP places an obligation on a local authority to notify individuals when their personal information has been breached and a real risk of significant harm exists for the affected individual. Reasonable steps - whether something is reasonable is a subjective assessment which means fair, proper, just, moderate, suitable under the circumstances, rational, governed by
RkJQdWJsaXNoZXIy MTgwMjYzOA==