PLEA gratefully acknowledges our primary core funder the Law Foundation of Saskatchewan for their continuing and generous support of our organization.
There are laws that protect the privacy of your personal information. These laws determine when your person information can be collected and used, how it must be protected and provide people with the right to access their personal information.
This information deals with personal information other than health information. For information about the privacy of health information see Privacy of Your Health Records.
Privacy laws are complex. Below is a summary of these laws. If you need specific information or have a privacy concern contact the Office of the Saskatchewan Information and Privacy Commissioner if your concern is about the provincial government or a provincial government institution. If you have a privacy concern about the federal government, a federal government institution, a business or a federally regulated employer contact the Office of the Privacy Commissioner of Canada.
People and organizations that privacy laws do not apply to include:
Privacy laws apply to your personal information held by:
To find out if privacy laws apply to the federal government body you are dealing with see Schedule 3 of the Privacy Act.
Examples of federally regulated employers include railways, and airlines.
Examples of entities covered by privacy laws include:
Information that is not personal information includes information:
Privacy laws only protect your information if it is personal information. Personal information can be information in paper or electronic records. Any information about an identifiable individual is considered personal information.
This includes information about your:
Examples of personal information a government or government institution might collect include a person's:
Examples of personal information a business might collect include a person's:
Examples of personal information an employer might collect include an employee's:
There are rules about when personal information can be collected and how it can be collected.
Remember some federal government departments and institutions are not covered by privacy laws.
Government and government institutions cannot collect your personal information unless they need it for one of their programs or activities. Generally any personal information must be collected directly from you. You can consent to having your personal information collected in another way. There are some exceptions.
Remember only federally regulated employers are covered by privacy laws.
Businesses and employers cannot collect personal information unless it is for a purpose that a reasonable person would consider appropriate in the circumstances. Some things that are generally considered inappropriate are:
Businesses and employers must identify the reasons for collecting your personal information before or at the time of collection. They must have your consent before they collect your personal information. They must limit the amount and type of the information gathered to what is necessary.
Businesses can only collect the personal information they need for the business transaction in question. If they ask for more information than you think they need you can ask why and not provide the information if you are not satisfied with the answer. You should still be able to complete the transaction, even if you refuse to give out more personal information than you think is needed.
Provincial government and institutions as well as businesses and federally regulated employers are required to protect your personal information once they have collected it.
The provincial government and its institutions must take steps to prevent personal information they have collected from being accessed, used, disclosed or modified by people or institutions that are not authorized.
Personal information must be protected from being stolen or destroyed by things like fire or floods. Electronic information must be protected with passwords and firewalls. Policies must be in place to protect personal information, including training of staff that handles personal information.
Businesses and employers that are covered by privacy laws must keep your personal information only as long as necessary based on the purpose the information was collected for. They must protect your personal information against loss, theft, unauthorized access, disclosure, use or modification by using appropriate security safeguards. This should include physical measures such as locked filing cabinets, organizational methods such as security clearance for access to information and technological measures such as the use of passwords and encryption.
Generally speaking personal information that is protected by privacy laws can only be used for the purpose it was collected for unless the person consents to a different use.
There are a number of exceptions that allow use of your personal information without your consent.
Government and government institutions can use your personal information without your consent for certain things including:
Businesses and employers can also disclose your personal information in some circumstances including when it is needed for a police investigation or in an emergency situation.
You have the right to see your personal information.
You can apply for access to your personal information by contacting the government institution, business or employer that has the information. Remember not all government institutions, businesses and employers are covered.
The first step is to determine the information you want and the name of the government institution, business or employer that has the information.
If it is a provincial government institution you complete an Access to Information Request Form and send it to the government institution. If it is a federal government institution that is covered by privacy laws you complete the Personal Information Request Form.
If it is a business or employer you make the request in writing. Businesses and covered employers should have a designated contact for access requests or privacy concerns.
There is no charge for accessing your personal information in the hands of the federal government or a federal institution that is covered by privacy laws. Provincial government, provincial government institutions, businesses and employers can only charge you a minimal fee for responding. You must be told about the approximate cost up front and agree to proceed with that cost.
You do not have the right to paper copies. In some cases you may have to go their office and look at your information there.
A government institution, business or employers generally have 30 days to respond. If a provincial government office refuses your request you can apply to the Saskatchewan Information and Privacy Commissioner to reviewthe decision. If a federal government institution or employer that is covered by privacy laws or a business refuses you can file a complaint with the Office of the Privacy Commissioner Canada.
If you have accessed your personal information you can request that it be corrected if you feel any of the information is incorrect. The government institution can make the correction or make a note on the file that a correction was requested but denied.
To make this request to a federal government institution covered by privacy laws use the Record Correction Form.
Businesses must correct your personal information if you can prove that what they have is incorrect. If the business and you cannot agree your concerns must be recorded.
Members of Saskatchewan's Legislative Offices are covered by privacy laws but you cannot request copies of your personal information from them or ask that it be corrected. Members of Parliament and Senators are not covered by privacy laws.
Under Saskatchewan law anyone who knowingly collects, uses or discloses personal information held by the provincial government or a provincial government institution contrary to privacy laws can be charged with a summary conviction offence and if found guilty, fined up to $50,000 and be sentenced to up to a year in jail.
If you think a government institution has violated your privacy rights you start by complaining directly to that institution.
If it is a provincial government institution and they do not respond to a written complaint within 30 days or you are not satisfied with their response, you can complain in writing to the Saskatchewan Information and Privacy Commissioner. They will investigate and try to resolve the complaint. If the complaint cannot be settled a report will be issued with findings and recommendations on how to prevent future incidents.
If it is a federal government institution, or employer that is covered by privacy laws or a business you can file a complaint with the Office of the Privacy Commissioner Canada. They will investigate and try to resolve the complaint. They cannot order an institution or business to take any specific action but they can make recommendations. If the complaint is about a business or employer they can publicize their findings.
Is an offence for a business or employer covered by privacy laws to:
It is also an offence for an employer to take action against an employee for exercising their privacy rights. Businesses or employers covered by privacy laws can be charged with a summary conviction offence and, if found guilty, fined up to $10,000 or charged with an indictable offence and fined up to $100,000.
PLEA can provide you with information to help you understand many legal matters you, a family member or friend may be facing.