7 (1) This section applies with respect to the collection of personal information as required or authorized under a regulation made under clause 6 (5) (a) or (b). Purpose of collection (2) The purpose for collecting the personal information under this Act is to eliminate systemic racism and advance racial equity. Manner of collection (3) The personal information shall be collected directly from the individual to whom the information relates unless another manner of collection is authorized by the applicable data standards. Notice to individual — direct collection (4) If the personal information is collected directly from the individual to whom the information relates, the public sector organization shall inform the individual that the collection is authorized under this Act and shall also inform the individual of, (a)  the purpose for which the personal information is intended to be used; (b)  the fact that, under subsection 6 (8), no program, service or benefit may be withheld because the individual does not provide, or refuses to provide, the personal information; and (c)  the title and contact information, including an email address, of an employee who can answer the individual’s questions about the collection. Notice —
indirect collection (5) If personal information is collected other than directly from the individual to whom the information relates, the public sector organization shall, before collecting information in that manner, ensure that a notice is published on a website that the collection is authorized or required under this Act and also stating, (a)  the types of personal information that may be collected in that manner and the circumstances in which personal information may be collected in that manner; (b)  the purpose for which the personal information collected in that manner is intended to be used; and (c)  the title and contact information, including an email address, of an employee who can answer an individual’s questions about the collection. Limit on use (6) The public sector organization shall not use the collected personal information for a purpose other than the purpose specified in subsection (2). Exceptions to limit on use (7) Subsection (6) does not apply to personal information lawfully collected by a public sector organization for another purpose in addition to the purpose specified in subsection (2). Limits if collection is authorized under cl. 6 (5) (b) (8) A public sector organization shall not use personal information collected as authorized under a regulation made under clause 6 (5) (b) if the use of other information will meet the purpose specified in subsection (2) and shall not use more of such personal information than is reasonably necessary to meet that purpose. De-identification (9) The public sector organization shall de-identify the collected personal information as required under the applicable data standards. Retention (10) The public sector organization shall retain the collected personal information for the period specified in the applicable data standards or, if there is no such specified period, for at least one year after the day it was last used by the organization. Security (11) The public sector organization shall take reasonable measures to secure the collected personal information. Accuracy (12) Before using the collected personal information for the purpose specified in subsection (2), the public sector organization shall take reasonable steps to ensure that the information is as accurate as is necessary for that purpose. Limits on access (13) The public sector organization shall limit access to the collected personal information to officers, employees, consultants and agents of the organization who need access to the information in the performance of their duties in connection with anything the organization is required to do, or may do, under this Act, the regulations or the applicable data standards. Limit on disclosure (14) The public sector organization may disclose the collected personal information only if, (a)  the person to whom the information relates has identified that information in particular and consented to its disclosure; (b)  the disclosure is required by law, including as required under section 31 of the Human Rights Code; (c)  the disclosure is for the purpose of a proceeding or contemplated proceeding and the information relates to or is a matter in issue in the proceeding or contemplated proceeding and, (i)  the public sector organization is, or is expected to be, a party, or (ii)  a current or former employee, consultant or agent of the public sector organization is, or is expected to be, a witness; (d)  the disclosure is for a research purpose in accordance with section 8; or (e)  the disclosure is to the Information and Privacy Commissioner. Exceptions to limit on disclosure (15) Subsection (14) does not apply to personal information lawfully collected by a public sector organization for another purpose in addition to the purpose specified in subsection (2). Other Acts (16) Subsection (14) prevails over the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act but the
authority to disclose under that subsection is subject to any limits on disclosure under any other law. Rights of access and correction (17) Nothing in this section limits the right of an individual under any Act to access and correct personal information about the individual.