Privacy laws are not a barrier to appropriate information sharing in a pandemic or emergency situation.
It is important that public bodies, health custodians and private sector organizations know how personal or health information may be shared during a pandemic or emergency situation.
How Information May Be Shared under Alberta’s Privacy Laws
Alberta has three privacy laws:
- Freedom of Information and Protection of Privacy Act for the public sector
- Health Information Act for the health sector
- Personal Information Protection Act for the private sector
These Acts govern the collection, use and disclosure of personal or health information.
Each Act contains provisions to allow for the sharing of personal or health information in the event of an emergency.
All three Acts require that any collection, use or disclosure of personal information or health information be limited to that which is needed to achieve the purpose of the collection, use or disclosure.
Freedom of Information and Protection of Privacy Act (FOIP Act)
The FOIP Act applies to “public bodies”, which include provincial government ministries and municipalities.
The FOIP Act permits public bodies to collect personal information if the collection is expressly authorized by an enactment (section 33(a)) or if the collection relates directly to and is necessary for an operating program or activity of the public body (section 33(c)). For example, a municipality may have a bylaw specifically authorizing the collection of personal information in emergency situations. As a bylaw is an “enactment”, the collection would be authorized under section 33(a). Section 33(c) would permit a municipality to collect personal information necessary for the management and delivery of its emergency services.
The FOIP Act generally requires public bodies to collect personal information directly from the individual the information is about. Public bodies may collect information about an individual from other sources with the individual’s consent, or without consent in specific circumstances, such as when the collection is authorized by law or the individual is not able to provide the information directly in a health or safety emergency (section 34(1)).
Public bodies may disclose personal information in emergency situations with the consent of the individual, or without consent in certain circumstances, including:
- if the disclosure is authorized by an enactment of Alberta or Canada (sections 40(1)(e), (f))
- to avert or minimize an imminent danger to the health or safety of any person (section 40(1)(ee))
- if the disclosure is not an unreasonable invasion of the individual’s privacy (section 40(1)(b))
- so that a spouse, adult interdependent partner, relative or friend of an injured, ill or deceased individual may be contacted (section 40(1)(s))
Health Information Act (HIA)
The HIA applies to health information in the custody or control of custodians. Custodians include Alberta Health, Alberta Health Services, Covenant Health, nursing homes, ambulance operators, physicians, pharmacists, registered nurses and certain other health professionals. The HIA authorizes custodians to collect and use health information for the purposes of providing health services.
The HIA allows custodians to disclose (Part 5) health information with the consent of the individual, or without consent in specific circumstances, including:
- if the disclosure is authorized or required by an enactment of Canada or Alberta (section 35(1)(p))
- to avert or minimize an imminent danger to the health or safety of any person (section 35(1)(m))
- to family members or another individual in a close relationship with the individual so they may be notified that the individual is ill, injured or deceased, providing the disclosure is not contrary to the expressed wishes of the individual (section 35(1)(d))
- to another custodian for the provision of health services (section 35(1)(a))
- to a person responsible for continuing treatment and care for the individual (section 35(1)(b))
- to law enforcement officials where the custodian reasonably believes the information relates to a possible offence and the disclosure will protect the health and safety of Albertans (section 37.3(1) – limited health information may be disclosed in this circumstance (section 37.3(2))
Personal Information Protection Act (PIPA)
PIPA applies to personal information collected, used and disclosed by private sector organizations.
Organizations are required by PIPA to collect, use and disclose personal information only for purposes that are reasonable (sections 11, 16 and 19). The term “reasonable” means “what a reasonable person would consider appropriate in the circumstances” (section 2).
Except in limited, specific circumstances, PIPA requires organization have the individual’s consent when collecting, using or disclosing personal information about that individual (section 7). Some of the circumstances where consent is not required include:
- if the collection, use or disclosure is authorized by an enactment of Alberta or Canada, including a bylaw (sections 14 (b), 17(b) and 20(b))
- a reasonable person would consider that the collection, use or disclosure of the information is clearly in the interests of the individual and consent of the individual cannot be obtained in a timely way or the individual would not reasonably be expected to withhold consent (sections 14(a), 17(a) and 20(a))
- the use or disclosure of the information is necessary to respond to an emergency that threatens the life, health or security of an individual or the public (sections 17(i) and 20(g))
- the disclosure is for the purposes of contacting the next of kin or a friend of an injured, ill or deceased individual (section 20(h))
Declaration of a Public Health Emergency
Privacy legislation would not impede the work of public health officials if a public health emergency is declared.
If an outbreak is declared to be a public emergency, the powers to collect, use and disclose personal or health information to protect the public health may be very broad.
In the event that a public health or general emergency is declared, orders issued under public health legislation could require the collection, use and disclosure of certain personal information relating to employees and customers.
If you need to collect, use or disclose employee personal information in an emergency, you should communicate to your employees the specific legislative authority that is engaged to do so.
March 2020