Information and Privacy Commissioner Jill Clayton has concerns with Bill 25, the Children First Act, as introduced in the Legislature on May 7, 2013. The Commissioner says, “I support the principle of promoting the ‘well-being, safety, security, education and health of children’ and I recognize that information sharing is vital to providing programs and services that will benefit children. But I am very concerned about the privacy implications.”
- Bill 25 erodes individuals’ ability to control what happens to their own personal and health information by broadening the ability to share information without consent. The ability to say yes or no to the sharing of one’s own information is, fundamentally, what privacy laws are intended to provide – control.
- Individuals will not necessarily know what information has been collected about them, by whom, or for what specific purpose. This is contrary to fundamental privacy principles of transparency, openness and accountability, and reduces individuals’ ability to exercise their rights to complain or ask for a review under existing privacy laws.
- Bill 25 may authorize information sharing with non-profit organizations that are, for the most part, not regulated by privacy legislation and not subject to any independent privacy oversight body.
- Bill 25 provides legislative authority for sharing information “for the purposes of enabling or planning for the provision of services or benefits.” This is a very broad purpose that could include any number of activities undertaken by a service provider.
- Bill 25 authorizes information sharing that in many ways is already permissible under existing Alberta privacy laws. The Freedom of Information and Protection of Privacy (FOIP) Act, the Health Information Act (HIA) and the Personal Information Protection Act (PIPA) allow disclosures with the consent of the individual the information is about, or without consent in certain circumstances.
- Bill 25 is a legislated solution to an education and awareness problem. There will be a need to provide education and training about its provisions, in addition to explaining how it interacts/intersects with the FOIP Act, HIA and PIPA.
Commissioner Clayton points out that Bill 25 increases the overall complexity of Alberta’s legislated privacy framework by adding another layer of legislative requirements that service providers and custodians must consider. She reminds service providers and custodians that they must continue to comply with their existing obligations under privacy laws.
The Commissioner recommends that Bill 25 should, at the very least, be amended to include: mandatory requirements for privacy impact assessments; a duty to record disclosures, including disclosures via information systems; and a duty to report privacy breaches to the Commissioner’s Office.