GreatNorthCollective/greatnorth-canada-federal-laws-text huggingface dataset:
Personal Information Protection and Electronic Documents Act — P-8.6 7.4
Use without consent 7.4 (1) Despite clause 4.5 of Schedule 1, an organization may use personal information for purposes other than those for which it was collected in any of the circumstances set out in subsection 7.2(1) or (2) or section 7.3. Disclosure without consent (2) Despite clause 4.5 of Schedule 1, an organization may disclose personal information for purposes other than those for which it was collected in any of the circumstances set out in subsection 7.2(1) or (2) or section 7.3. 2015, c. 32, s. 7
Personal Information Protection and Electronic Documents Act — P-8.6 8
Written request 8 (1) A request under clause 4.9 of Schedule 1 must be made in writing. Assistance (2) An organization shall assist any individual who informs the organization that they need assistance in preparing a request to the organization. Time limit (3) An organization shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request. Extension of time limit (4) An organization may extend the time limit (a) for a maximum of thirty days if (i) meeting the time limit would unreasonably interfere with the activities of the organization, or (ii) the time required to undertake any consultations necessary to respond to the request would make the time limit impracticable to meet; or (b) for the period that is necessary in order to be able to convert the personal information into an alternative format. In either case, the organization shall, no later than thirty days after the date of the request, send a notice of extension to the individual, advising them of the new time limit, the reasons for extending the time limit and of their right to make a complaint to the Commissioner in respect of the extension. Deemed refusal (5) If the organization fails to respond within the time limit, the organization is deemed to have refused the request. Costs for responding (6) An organization may respond to an individual’s request at a cost to the individual only if (a) the organization has informed the individual of the approximate cost; and (b) the individual has advised the organization that the request is not being withdrawn. Reasons (7) An organization that responds within the time limit and refuses a request shall inform the individual in writing of the refusal, setting out the reasons and any recourse that they may have under this Part. Retention of information (8) Despite clause 4.5 of Schedule 1, an organization that has personal information that is the subject of a request shall retain the information for as long as is necessary to allow the individual to exhaust any recourse under this Part that they may have. 2000, c. 5, s. 8; 2015, c. 32, s. 8(F)
Personal Information Protection and Electronic Documents Act — P-8.6 9
tion is protected by solicitor-client privilege or the professional secrecy of advocates and notaries or by litigation privilege; (b) to do so would reveal confidential commercial information; (c) to do so could reasonably be expected to threaten the life or security of another individual; (c.1) the information was collected under paragraph 7(1)(b); (d) the information was generated in the course of a formal dispute resolution process; or (e) the information was created for the purpose of making a disclosure under the Public Servants Disclosure Protection Act or in the course of an investigation into a disclosure under that Act. However, in the circumstances described in paragraph (b) or (c), if giving access to the information would reveal confidential commercial information or could reasonably be expected to threaten the life or security of another individual, as the case may be, and that information is severable from the record containing any other information for which access is requested, the organization shall give the individual access after severing. Limit (4) Subsection (3) does not apply if the individual needs the information because an individual’s life, health or security is threatened. Notice (5) If an organization decides not to give access to personal information in the circumstances set out in paragraph (3)(c.1), the organization shall, in writing, so notify the Commissioner, and shall include in the notification any information that the Commissioner may specify. 2000, c. 5, s. 9, c. 17, s. 97; 2001, c. 41, s. 82; 2005, c. 46, s. 57; 2006, c. 9, s. 223; 2015, c. 32, s. 9 2019, c. 18, s. 61
Personal Information Protection and Electronic Documents Act — P-8.6 10
Sensory disability 10 An organization shall give access to personal information in an alternative format to an individual with a sensory disability who has a right of access to personal information under this Part and who requests that it be transmitted in the alternative format if (a) a version of the information already exists in that format; or (b) its conversion into that format is reasonable and necessary in order for the individual to be able to exercise rights under this Part.
Personal Information Protection and Electronic Documents Act — P-8.6 10.1
Report to Commissioner 10.1 (1) An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual. Report requirements (2) The report shall contain the prescribed information and shall be made in the prescribed form and manner as soon as feasible after the organization determines that the breach has occurred. Notification to individual (3) Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual. Contents of notification (4) The notification shall contain sufficient information to allow the individual to understand the significance to them of the breach and to take steps, if any are possible, to reduce the risk of harm that could result from it or to mitigate that harm. It shall also contain any other prescribed information. Form and manner (5) The notification shall be conspicuous and shall be given directly to the individual in the prescribed form and manner, except in prescribed circumstances, in which case it shall be given indirectly in the prescribed form and manner. Time to give notification (6) The notification shall be given as soon as feasible after the organization determines that the breach has occurred. Definition of significant harm (7) For the purpose of this section, significant harm includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. Real risk of significant harm — factors (8) The factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to the individual include (a) the sensitivity of the personal information involved in the breach; (b) the probability that the personal information has been, is being or will be misused; and (c) any other prescribed factor. 2015, c. 32, s. 10
Personal Information Protection and Electronic Documents Act — P-8.6 10.2
Notification to organizations 10.2 (1) An organization that notifies an individual of a breach of security safeguards under subsection 10.1(3) shall notify any other organization, a government institution or a part of a government institution of the breach if the notifying organization believes that the other organization or the government institution or part concerned may be able to reduce the risk of harm that could result from it or mitigate that harm, or if any of the prescribed conditions are satisfied. Time to give notification (2) The notification shall be given as soon as feasible after the organization determines that the breach has occurred. Disclosure of personal information (3) In addition to the circumstances set out in subsection 7(3), for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual if (a) the disclosure is made to the other organization, the government institution or the part of a government institution that was notified of the breach under subsection (1); and (b) the disclosure is made solely for the purposes of reducing the risk of harm to the individual that could result from the breach or mitigating that harm. Disclosure without consent (4) Despite clause 4.5 of Schedule 1, an organization may disclose personal information for purposes other than those for which it was collected in the circumstance set out in subsection (3). 2015, c. 32, s. 10
Personal Information Protection and Electronic Documents Act — P-8.6 10.3
Records 10.3 (1) An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control. Provision to Commissioner (2) An organization shall, on request, provide the Commissioner with access to, or a copy of, a record. 2015, c. 32, s. 10
Personal Information Protection and Electronic Documents Act — P-8.6 11
Contravention 11 (1) An individual may file with the Commissioner a written complaint against an organization for contravening a provision of Division 1 or 1.1 or for not following a recommendation set out in Schedule 1. Commissioner may initiate complaint (2) If the Commissioner is satisfied that there are reasonable grounds to investigate a matter under this Part, the Commissioner may initiate a complaint in respect of the matter. Time limit (3) A complaint that results from the refusal to grant a request under section 8 must be filed within six months, or any longer period that the Commissioner allows, after the refusal or after the expiry of the time limit for responding to the request, as the case may be. Notice (4) The Commissioner shall give notice of a complaint to the organization against which the complaint was made. 2000, c. 5, s. 11; 2015, c. 32, s. 11
Personal Information Protection and Electronic Documents Act — P-8.6 12
Examination of complaint by Commissioner 12 (1) The Commissioner shall conduct an investigation in respect of a complaint, unless the Commissioner is of the opinion that (a) the complainant ought first to exhaust grievance or review procedures otherwise reasonably available; (b) the complaint could more appropriately be dealt with, initially or completely, by means of a procedure provided for under the laws of Canada, other than this Part, or the laws of a province; or (c) the complaint was not filed within a reasonable period after the day on which the subject matter of the complaint arose. Exception (2) Despite subsection (1), the Commissioner is not required to conduct an investigation in respect of an act alleged in a complaint if the Commissioner is of the opinion that the act, if proved, would constitute a contravention of any of sections 6 to 9 of An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act or section 52.01 of the Competition Act or would constitute conduct that is reviewable under section 74.011 of that Act. Notification (3) The Commissioner shall notify the complainant and the organization that the Commissioner will not investigate the complaint or any act alleged in the complaint and give reasons. Compelling reasons (4) The Commissioner may reconsider a decision not to investigate under subsection (1), if the Commissioner is satisfied that the complainant has established that there are compelling reasons to investigate. 2000, c. 5, s. 12; 2010, c. 23, s. 83
Personal Information Protection and Electronic Documents Act — P-8.6 12.1
Powers of Commissioner 12.1 (1) In the conduct of an investigation of a complaint, the Commissioner may (a) summon and enforce the appearance of persons before the Commissioner and compel them to give oral or written evidence on oath and to produce any records and things that the Commissioner considers necessary to investigate the complaint, in the same manner and to the same extent as a superior court of record; (b) administer oaths; (c) receive and accept any evidence and other information, whether on oath, by affidavit or otherwise, that the Commissioner sees fit, whether or not it is or would be admissible in a court of law; (d) at any reasonable time, enter any premises, other than a dwelling-house, occupied by an organization on satisfying any security requirements of the organization relating to the premises; (e) converse in private with any person in any premises entered under paragraph (d) and otherwise carry out in those premises any inquiries that the Commissioner sees fit; and (f) examine or obtain copies of or extracts from records found in any premises entered under paragraph (d) that contain any matter relevant to the investigation. Dispute resolution mechanisms (2) The Commissioner may attempt to resolve complaints by means of dispute resolution mechanisms such as mediation and conciliation. Delegation (3) The Commissioner may delegate any of the powers set out in subsection (1) or (2). Return of records (4) The Commissioner or the delegate shall return to a person or an organization any record or thing that they produced under this section within 10 days after they make a request to the Commissioner or the delegate, but nothing precludes the Commissioner or the delegate from again requiring that the record or thing be produced. Certificate of delegation (5) Any person to whom powers set out in subsection (1) are delegated shall be given a certificate of the delegation and the delegate shall produce the certificate, on request, to the person in charge of any premises to be entered under paragraph (1)(d). 2010, c. 23, s. 83
Personal Information Protection and Electronic Documents Act — P-8.6 12.2
Reasons 12.2 (1) The Commissioner may discontinue the investigation of a complaint if the Commissioner is of the opinion that (a) there is insufficient evidence to pursue the investigation; (b) the complaint is trivial, frivolous or vexatious or is made in bad faith; (c) the organization has provided a fair and reasonable response to the complaint; (c.1) the matter is the object of a compliance agreement entered into under subsection 17.1(1); (d) the matter is already the object of an ongoing investigation under this Part; (e) the matter has already been the subject of a report by the Commissioner; (f) any of the circumstances mentioned in paragraph 12(1)(a), (b) or (c) apply; or (g) the matter is being or has already been addressed under a procedure referred to in paragraph 12(1)(a) or (b). Other reason (2) The Commissioner may discontinue an investigation in respect of an act alleged in a complaint if the Commissioner is of the opinion that the act, if proved, would constitute a contravention of any of sections 6 to 9 of An Act to promote the efficiency and adaptability of the Canadian economy by regulating certain activities that discourage reliance on electronic means of carrying out commercial activities, and to amend the Canadian Radio-television and Telecommunications Commission Act, the Competition Act, the Personal Information Protection and Electronic Documents Act and the Telecommunications Act or section 52.01 of the Competition Act or would constitute conduct that is reviewable under section 74.011 of that Act. Notification (3) The Commissioner shall notify the complainant and the organization that the investigation has been discontinued and give reasons. 2010, c. 23, s. 83; 2015, c. 32, s. 12
Personal Information Protection and Electronic Documents Act — P-8.6 13
Contents 13 (1) The Commissioner shall, within one year after the day on which a complaint is filed or is initiated by the Commissioner, prepare a report that contains (a) the Commissioner’s findings and recommendations; (b) any settlement that was reached by the parties; (c) if appropriate, a request that the organization give the Commissioner, within a specified time, notice of any action taken or proposed to be taken to implement the recommendations contained in the report or reasons why no such action has been or is proposed to be taken; and (d) the recourse, if any, that is available under section 14. (2) [Repealed, 2010, c. 23, s. 84] Report to parties (3) The report shall be sent to the complainant and the organization without delay. 2000, c. 5, s. 13; 2010, c. 23, s. 84
Personal Information Protection and Electronic Documents Act — P-8.6 14
Application 14 (1) A complainant may, after receiving the Commissioner’s report or being notified under subsection 12.2(3) that the investigation of the complaint has been discontinued, apply to the Court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the Commissioner’s report, and that is referred to in clause 4.1.3, 4.2, 4.3.3, 4.4, 4.6, 4.7 or 4.8 of Schedule 1, in clause 4.3, 4.5 or 4.9 of that Schedule as modified or clarified by Division 1 or 1.1, in subsection 5(3) or 8(6) or (7), in section 10 or in Division 1.1. Time for application (2) A complainant shall make an application within one year after the report or notification is sent or within any longer period that the Court may, either before or after the expiry of that year, allow. For greater certainty (3) For greater certainty, subsections (1) and (2) apply in the same manner to complaints referred to in subsection 11(2) as to complaints referred to in subsection 11(1). 2000, c. 5, s. 14; 2010, c. 23, s. 85; 2015, c. 32, s. 13
Personal Information Protection and Electronic Documents Act — P-8.6 15
Commissioner may apply or appear 15 The Commissioner may, in respect of a complaint that the Commissioner did not initiate, (a) apply to the Court, within the time limited by section 14, for a hearing in respect of any matter described in that section, if the Commissioner has the consent of the complainant; (b) appear before the Court on behalf of any complainant who has applied for a hearing under section 14; or (c) with leave of the Court, appear as a party to any hearing applied for under section 14.
Personal Information Protection and Electronic Documents Act — P-8.6 16
Remedies 16 The Court may, in addition to any other remedies it may give, (a) order an organization to correct its practices in order to comply with Divisions 1 and 1.1; (b) order an organization to publish a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under paragraph (a); and (c) award damages to the complainant, including damages for any humiliation that the complainant has suffered. 2000, c. 5, s. 16; 2015, c. 32, s. 14
Personal Information Protection and Electronic Documents Act — P-8.6 17
Summary hearings 17 (1) An application made under section 14 or 15 shall be heard and determined without delay and in a summary way unless the Court considers it inappropriate to do so. Precautions (2) In any proceedings arising from an application made under section 14 or 15, the Court shall take every reasonable precaution, including, when appropriate, receiving representations ex parte and conducting hearings in camera, to avoid the disclosure by the Court or any person of any information or other material that the organization would be authorized to refuse to disclose if it were requested under clause 4.9 of Schedule 1.
Personal Information Protection and Electronic Documents Act — P-8.6 17.1
Compliance agreement 17.1 (1) If the Commissioner believes on reasonable grounds that an organization has committed, is about to commit or is likely to commit an act or omission that could constitute a contravention of a provision of Division 1 or 1.1 or a failure to follow a recommendation set out in Schedule 1, the Commissioner may enter into a compliance agreement, aimed at ensuring compliance with this Part, with that organization. Terms (2) A compliance agreement may contain any terms that the Commissioner considers necessary to ensure compliance with this Part. Effect of compliance agreement — no application (3) When a compliance agreement is entered into, the Commissioner, in respect of any matter covered under the agreement, (a) shall not apply to the Court for a hearing under subsection 14(1) or paragraph 15(a); and (b) shall apply to the court for the suspension of any pending applications that were made by the Commissioner under those provisions. For greater certainty (4) For greater certainty, a compliance agreement does not preclude (a) an individual from applying for a hearing under section 14; or (b) the prosecution of an offence under the Act. 2015, c. 32, s. 15
Personal Information Protection and Electronic Documents Act — P-8.6 17.2
Agreement complied with 17.2 (1) If the Commissioner is of the opinion that a compliance agreement has been complied with, the Commissioner shall provide written notice to that effect to the organization and withdraw any applications that were made under subsection 14(1) or paragraph 15(a) in respect of any matter covered under the agreement. Agreement not complied with (2) If the Commissioner is of the opinion that an organization is not complying with the terms of a compliance agreement, the Commissioner shall notify the organization and may apply to the Court for (a) an order requiring the organization to comply with the terms of the agreement, in addition to any other remedies it may give; or (b) a hearing under subsection 14(1) or paragraph 15(a) or to reinstate proceedings that have been suspended as a result of an application made under paragraph 17.1(3)(b). Time for application (3) Despite subsection 14(2), the application shall be made within one year after notification is sent or within any longer period that the Court may, either before or after the expiry of that year, allow. 2015, c. 32, s. 15