Office of the Saskatchewan Information and Privacy Commissioner. Guide to LA FOIP, Chapter 6, Protection of Privacy. Updated 27 February 2023. 24 minimization principles. Authority to collect, use and disclose only exists when these principles are abided by. These two important principles underlie Part IV of LA FOIP.36 Identifying the ‘need-to-know’ requires careful consideration of what data elements are required and separating out those that are not required for the purpose identified. As well, organizations should only allow those that have a ‘need to know’ access to the personal information. IPC Findings In Investigation Report 074-2018, 075-2018, the Commissioner found that the disclosure of a complainant’s personal information by a local authority was not appropriate because more personal information than was necessary for the purpose was disclosed. Even though the local authority had a provision to rely on and the discretion to disclose certain details, it did not adhere to the need-to-know and data minimization principles. Therefore, it did not have authority for the disclosures. Data Minimization Principle In Investigation Report LA-2010-001, the Commissioner stated: [47] The practice of disclosing the least amount of information when required is called the ‘data minimization principle’. This is one of the 10 Fair Information Principles that have been codified in the Canadian Standards Association Model Code for the Protection of Personal Information (Q830) … The data minimization principle is one of the 10 Fair Information Principles, which originated from the Canadian Standards Association Model Code for the Protection of Personal Information (Model Code). Specifically, principles #4 (Limiting Collection) and #5 (Limiting Use, Disclosure, and Retention). For more on this, see 10 Fair Information Principles earlier in this Chapter. Data minimization is the rule that an organization should always collect, use, and disclose the least amount of personal information necessary for the purpose.37 36 SK OIPC Investigation Report 074-2018, 075-2018 at [38]. See also Investigation Report 278-2017 at [22]. 37 SK OIPC Investigation Report F-2009-001 at [92].
RkJQdWJsaXNoZXIy MTgwMjYzOA==