jswizzle3737/ontario_laws_and_regs huggingface dataset:
33 (1) A head shall make available, in the manner described in section 35, (a) manuals, directives or guidelines prepared by the institution, issued to its officers and containing interpretations of the provisions of any enactment or scheme administered by the institution where the interpretations are to be applied by, or are to be guidelines for, any officer who determines, (i) an application by a person for a right, privilege or benefit which is conferred by the enactment or scheme, (ii) whether to suspend, revoke or impose new conditions on a right, privilege or benefit already granted to a person under the enactment or scheme, or (iii) whether to impose an obligation or liability on a person under the enactment or scheme; or (b) instructions to, and guidelines for, officers of the institution on the procedures to be followed, the methods to be employed or the objectives to be pursued in their administration or enforcement of the provisions of any enactment or scheme administered by the institution that affects the public.  R.S.O. 1990, c. F.31, s. 33 (1). Deletions (2) A head may delete from a document made available under subsection (1) any record or part of a record which the head would be entitled to refuse to disclose where the head includes in the document, (a) a statement of the fact that a deletion has been made; (b) a brief statement of the nature of the record which has been deleted; and (c) a reference to the provision of this Act or the Personal Health Information Protection Act, 2004 on which the head relies.  R.S.O. 1990, c. F.31, s. 33 (2); 2004, c. 3, Sched. A, s. 81 (2). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 81 (2) - 1/11/2004
34 (1) A head shall make an annual report, in accordance with this section, to the Commissioner.  2006, c. 19, Sched. N, s. 1 (4). Contents of report (2) A report made under subsection (1) shall specify, (a) the number of requests under this Act or the Personal Health Information Protection Act, 2004 for access to records made to the institution or to a health information custodian within the meaning of the Personal Health Information Protection Act, 2004
that is acting as part of the institution; (b) the number of refusals by the head to disclose a record under this Act, the provisions of this Act under which disclosure was refused and the number of occasions on which each provision was invoked; (c) the number of refusals under the Personal Health Information Protection Act, 2004 by a health information custodian, within the meaning of that Act, that is the institution or that is acting as part of the institution, of a request for access to a record, the provisions of that Act under which disclosure was refused and the number of occasions on which each provision was invoked; (d) the number of uses or purposes for which personal information is disclosed where the use or purpose is not included in the statements of uses and purposes set forth under clauses 45 (d) and (e) of this Act or in any written public statement provided under subsection 16 (1) of the Personal Health Information Protection Act, 2004 by the institution or a
health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; (e) the amount of fees collected under section 57 of this Act by the institution and under subsection 54 (10) of the Personal Health Information Protection Act, 2004 by the institution or a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; and (f) any other information indicating an effort by the institution or by a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution to put into practice the purposes of this Act or the purposes of the Personal Health Information Protection Act, 2004.  2006, c. 19, Sched. N, s. 1 (4). Separate information (3) The information required by each of clauses (2) (a), (d), (e) and (f) shall be provided separately for, (a) each separate health information custodian that is the institution or that is acting as part of the institution; and (b) the institution other than in its capacity as a health information custodian and other than in its capacity as an institution containing a health information custodian.  2006, c. 19, Sched. N, s. 1 (4). Same (4) The information required by clause (2) (c) shall be provided separately for each separate health information custodian that is the institution or that is acting as part of the institution.  2006, c. 19, Sched. N, s. 1 (4). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 81 (3) - 1/11/2004 2006, c. 19, Sched. N, s. 1 (4) - 22/06/2006
35 (1) The responsible minister shall cause the materials described in sections 31, 32 and 45 to be made generally available for inspection and copying by the public and shall cause them to be made available to the public on the Internet or in the reading room, library or office designated by each institution for this purpose.  2006, c. 34, Sched. C, s. 3. Same (2) Every head shall cause the materials described in sections 33 and 34 to be made available to the public on the Internet or in the reading room, library or office designated by each institution for this purpose.  2006, c. 34, Sched. C, s. 3. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 3 - 1/04/2007
36 (1) Every head shall provide to the responsible minister the information needed by the responsible minister to prepare the materials described in sections 31, 32 and 45.  2006, c. 34, Sched. C, s. 4. Annual review (2) Every head shall conduct an annual review to ensure that all the information the head is required to provide under subsection (1) is provided and that all such information is accurate, complete and up to date.  2006, c. 34, Sched. C, s. 4. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 4 - 1/04/2007
36.1 (1) Where an extra-ministerial data integration unit under Part III.1 is not an institution, or part of an institution, the senior officer of the extra-ministerial data integration unit shall cause to be published annually information respecting, (a) where a request for a record should be made; (b) the name, title, business telephone number and business address of the senior officer; (c) a description of the unit’s programs and functions as they relate to Part III.1; (d) an indication of the general types of records that are prepared by or are otherwise in the custody or under the control of the unit in relation to Part III.1; and (e) an indication of any changes to the information previously published under this section. 2023, c. 4, Sched. 3, s. 1. (2) The senior officer shall also cause the information to be provided to the responsible minister upon its publication. 2023, c. 4, Sched. 3, s. 1. Section Amendments with date in force (d/m/y) 2023, c. 4, Sched. 3, s. 1 - 24/07/2023 PART III   PROTECTION OF INDIVIDUAL PRIVACY Collection and Retention of Personal Information
37 (1) This Part does not apply to personal information that is maintained for the purpose of creating a record that is available to the general public.  R.S.O. 1990, c. F.31, s. 37. Same (2) With the exception of sections 47 to 49, this Part does not apply to personal information that is collected by a member of a multi-sector data integration unit or a ministry data integration unit under Part III.1. 2019, c. 7, Sched. 31, s. 3; 2020, c. 5, Sched. 2, s. 1 (1). Note: On a day to be named by proclamation of the Lieutenant Governor, section 37 of the Act is amended by adding the following subsection: (See: 2020, c. 5, Sched. 2, s. 1 (2)) Right of access, extra-ministerial data integration unit (3) Where an extra-ministerial data integration unit is not an institution, sections 47 to 49 apply, with any modifications prescribed by the regulations, to personal information that is collected by a member of the extra-ministerial data integration unit under Part III.1 as if the extra-ministerial data integration unit were an institution and, for that purpose, the senior officer of the unit shall be considered the head. 2020, c. 5, Sched. 2, s. 1 (2). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 3 - 04/11/2019 2020, c. 5, Sched. 2, s. 1 (1) - 25/03/2020; 2020, c. 5, Sched. 2, s. 1 (2) - not in force
38 (1) In this section and in section 39, “personal information” includes information that is not recorded and that is otherwise defined as “personal information” under this Act.  R.S.O. 1990, c. F.31, s. 38 (1). Collection of personal information (2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.  R.S.O. 1990, c. F.31, s. 38 (2).
39 (1) Personal information shall only be collected by an institution directly from the individual to whom the information relates unless, (a) the individual authorizes another manner of collection; (b) the personal information may be disclosed to the institution concerned under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act; (c) the Commissioner has authorized the manner of collection under clause 59 (c); (d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act; (e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service; (f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or tribunal; (g) the information is collected for the purpose of law enforcement; or (h) another manner of collection is authorized by or under a statute.  R.S.O. 1990, c. F.31, s. 39 (1). Notice to individual (2) Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of, (a) the legal authority for the collection; (b) the principal purpose or purposes for which the personal information is intended to be used; and (c) the title, business address and business telephone number of a public official who can answer the individual’s questions about the collection.  R.S.O. 1990, c. F.31, s. 39 (2). Exception (3) Subsection (2) does not apply where the head may refuse to disclose the personal information under subsection 14 (1) or (2) (law enforcement), section 14.1 (Civil Remedies Act, 2001) or section 14.2 (Prohibiting Profiting from Recounting Crimes Act, 2002).  2002, c. 2, s. 19 (6); 2007, c. 13, s. 43 (3). Section Amendments with date in force (d/m/y) 2002, c. 2, s. 19 (6) - 1/07/2003 2007, c. 13, s. 43 (3) - 4/06/2007
40 (1) Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information.  R.S.O. 1990, c. F.31, s. 40 (1). Standard of accuracy (2) The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date.  R.S.O. 1990, c. F.31, s. 40 (2). Exception (3) Subsection (2) does not apply to personal information collected for law enforcement purposes.  R.S.O. 1990, c. F.31, s. 40 (3). Disposal of personal information (4) A head shall dispose of personal information under the control of the institution in accordance with the regulations.  R.S.O. 1990, c. F.31, s. 40 (4). Use and Disclosure of Personal Information
41 (1) An institution shall not use personal information in its custody or under its control except, (a) where the person to whom the information relates has identified that information in particular and consented to its use; (b) for the purpose for which it was obtained or compiled or for a consistent purpose; (c) for a purpose for which the information may be disclosed to the institution under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act; or (d) subject to subsection (2), an educational institution may use personal information in its alumni records and a hospital may use personal information in its records for the purpose of its own fundraising activities, if the personal information is reasonably necessary for the fundraising activities.  R.S.O. 1990, c. F.31, s. 41; 2005, c. 28, Sched. F, s. 5 (1); 2010, c. 25, s. 24 (9). Notice on using personal information for fundraising (2) In order for an educational institution to use personal information in its alumni records or for a hospital to use personal information in its records, either for its own fundraising activities or for the fundraising activities of an associated foundation, the educational institution or hospital shall, (a) give notice to the individual to whom the personal information relates when the individual is first contacted for the purpose of soliciting funds for fundraising of his or her right to request that the information cease to be used for fundraising purposes; (b) periodically and in the course of soliciting funds for fundraising, give notice to the individual to whom the personal information relates of his or her right to request that the information cease to be used for fundraising purposes; and (c) periodically and in a manner that is likely to come to the attention of individuals who may be solicited for fundraising, publish a notice of the individual’s right to request that the individual’s personal information cease to be used for fundraising purposes.  2005, c. 28, Sched. F, s. 5 (2); 2010, c. 25, s. 24 (10). Discontinuing use of personal information (3)  An educational institution or a hospital shall, when requested to do so by an individual, cease to use the individual’s personal information under clause (1) (d).  2005, c. 28, Sched. F, s. 5 (2); 2010, c. 25, s. 24 (11). Section Amendments with date in force (d/m/y) 2005, c. 28, Sched. F, s. 5 (1, 2) - 10/06/2006 2010, c. 25, s. 24 (9-11) - 1/01/2012
43 Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41 (1) (b) and 42 (1) (c) only if the individual might reasonably have expected such a use or disclosure.  R.S.O. 1990, c. F.31, s. 43; 2006, c. 34, Sched. C, s. 6. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 6 - 1/04/2007 Personal Information Banks
44 A head shall cause to be included in a personal information bank all personal information under the control of the institution that is organized or intended to be retrieved by the individual’s name or by an identifying number, symbol or other particular assigned to the individual.  R.S.O. 1990, c. F.31, s. 44.
45 The responsible minister shall publish at least once each year an index of all personal information banks setting forth, in respect of each personal information bank, (a) its name and location; (b) the legal authority for its establishment; (c) the types of personal information maintained in it; (d) how the personal information is used on a regular basis; (e) to whom the personal information is disclosed on a regular basis; (f) the categories of individuals about whom personal information is maintained; and (g) the policies and practices applicable to the retention and disposal of the personal information.  R.S.O. 1990, c. F.31, s. 45.
46 (1) A head shall attach or link to personal information in a personal information bank, (a) a record of any use of that personal information for a purpose other than a purpose described in clause 45 (d); and (b) a record of any disclosure of that personal information to a person other than a person described in clause 45 (e).  R.S.O. 1990, c. F.31, s. 46 (1). Record of use part of personal information (2) A record retained under subsection (1) forms part of the personal information to which it is attached or linked.  R.S.O. 1990, c. F.31, s. 46 (2). Notice and publication (3) Where the personal information in a personal information bank under the control of an institution is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled by the institution but the use is not one of the uses included under clauses 45 (d) and (e), the head shall, (a) forthwith notify the responsible minister of the use or disclosure; and (b) ensure that the use is included in the index.  R.S.O. 1990, c. F.31, s. 46 (3). Right of Individual to Whom Personal Information Relates to Access and Correction Rights of access and correction
47 (1) Every individual has a right of access to, (a) any personal information about the individual contained in a personal information bank in the custody or under the control of an institution; and (b) any other personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to render it reasonably retrievable by the institution.  R.S.O. 1990, c. F.31, s. 47 (1). Right of correction (2) Every individual who is given access under subsection (1) to personal information is entitled to, (a) request correction of the personal information where the individual believes there is an error or omission therein; (b) require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made; and (c) require that any person or body to whom the personal information has been disclosed within the year before the time a correction is requested or a statement of disagreement is required be notified of the correction or statement of disagreement.  R.S.O. 1990, c. F.31, s. 47 (2). Requests and manner of access
48 (1) An individual seeking access to personal information about the individual shall, (a) make a request in writing to the institution that the individual believes has custody or control of the personal information, and specify that the request is being made under this Act; (b) identify the personal information bank or otherwise identify the location of the personal information; and (c) at the time of making the request, pay the fee prescribed by the regulations for that purpose.  1996, c. 1, Sched. K, s. 7; 2017, c. 2, Sched. 12, s. 4 (2). Access procedures (2) Subsections 10 (2), 24 (1.1) and (2) and sections 25, 26, 27, 27.1, 28 and 29 apply with necessary modifications to a request made under subsection (1).  1996, c. 1, Sched. K, s. 7. Exception, s. 25 (2.1) Despite subsection (2), subsection 25 (2) does not apply to a request for personal information that was collected under Part III.1. 2019, c. 7, Sched. 31, s. 5. Manner of access (3) Subject to the regulations, where an individual is to be given access to personal information requested under subsection (1), the head shall, (a) permit the individual to examine the personal information; or (b) provide the individual with a copy thereof.  R.S.O. 1990, c. F.31, s. 48 (3). Comprehensible form (4) Where access to personal information is to be given, the head shall ensure that the personal information is provided to the individual in a comprehensible form and in a manner which indicates the general terms and conditions under which the personal information is stored and used.  R.S.O. 1990, c. F.31, s. 48 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 7 - 30/01/1996 2017, c. 2, Sched. 12, s. 4 (2) - 22/03/2017 2019, c. 7, Sched. 31, s. 5 - 04/11/2019
49 A head may refuse to disclose to the individual to whom the information relates personal information, (a) where section 12, 13, 14, 14.1, 14.2, 15, 15.1, 16, 17, 18, 19, 20 or 22 would apply to the disclosure of that personal information; (b) where the disclosure would constitute an unjustified invasion of another individual’s personal privacy; (c) that is evaluative or opinion material compiled solely for the purpose of determining suitability, eligibility or qualifications for the awarding of government contracts and other benefits where the disclosure would reveal the identity of a source who furnished information to the institution in circumstances where it may reasonably have been assumed that the identity of the source would be held in confidence; (c.1) if the information is supplied explicitly or implicitly in confidence and is evaluative or opinion material compiled solely for the purpose of, (i) assessing the teaching materials or research of an employee of an educational institution or a hospital or of a person associated with an educational institution or a hospital, (ii) determining suitability, eligibility or qualifications for admission to an academic program of an educational institution or a hospital, or (iii) determining suitability for an honour or award to recognize outstanding achievement or distinguished service; (d) that is medical information where the disclosure could reasonably be expected to prejudice the mental or physical health of the individual; (e) that is a correctional record where the disclosure could reasonably be expected to reveal information supplied in confidence; or (f) that is a research or statistical record.  R.S.O. 1990, c. F.31, s. 49; 2001, c. 28, s. 22 (4); 2002, c. 2, ss. 15 (4), 19 (7); 2002, c. 18, Sched. K, s. 10; 2005, c. 28, Sched. F, s. 7; 2010, c. 25, s. 24 (15); 2017, c. 8, Sched. 13, s. 4. Section Amendments with date in force (d/m/y) 2002, c. 2, s. 19 (7) - 1/07/2003; 2002, c. 18, Sched. K, s. 10 (1, 2) - 26/11/2002 2005, c. 28, Sched. F, s. 7 - 10/06/2006 2010, c. 25, s. 24 (15) - 1/01/2012 2017, c. 8, Sched. 13, s. 4 - 09/03/2018 Part III.1   Data Integration
49.1 (1) In this Part, “data standards” means the data standards approved by the Commissioner under subsection 49.14 (1); (“normes relatives aux données”) “extra-ministerial data integration unit” means a person or entity, or an administrative division of a person or entity, that is designated as an extra-ministerial data integration unit in the regulations; (“service extraministériel d’intégration des données”) “inter-ministerial data integration unit” means an administrative division of a ministry that is designated as an inter-ministerial data integration unit in the regulations; (“service interministériel d’intégration des données”) “member” means, (a) in relation to an inter-ministerial data integration unit or a ministry data integration unit, an officer, employee or agent of the ministry in which the unit is located who works as part of the unit, and (b) in relation to an extra-ministerial data integration unit, an officer, employee or agent of the person or entity who works as part of the unit; (“membre”) “ministry data integration unit” means an administrative division of a ministry that is designated as a ministry data integration unit in the regulations. (“service ministériel d’intégration des données”) “multi-sector data integration unit” means, (a) an inter-ministerial data integration unit, or (b) an extra-ministerial data integration unit. (“service multisectoriel d’intégration des données”) “senior officer” means, in respect of an extra-ministerial data integration unit, the administrative head of the person or entity or another officer of the person or entity designated in the regulations as the senior officer. (“cadre dirigeant”) 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 2; 2023, c. 4, Sched. 3, s. 2. Meaning of de-identification (2) A reference in this Part to de-identifying a record or personal information means to remove the following information: 1. Information that identifies an individual. 2. Information that could be used, either alone or with other information, to identify an individual based on what is reasonably foreseeable in the circumstances. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 2 (1, 2) - 25/03/2020 2023, c. 4, Sched. 3, s. 2 (1, 2) - 24/07/2023
49.1.1 (1) Where an extra-ministerial data integration unit is not an institution, or part of an institution, the extra-ministerial data integration unit is deemed to also be an institution under this Act, but only in respect of personal information that is collected by a member of the extra-ministerial data integration unit under this Part, and, for that purpose, its senior officer is deemed to be the head of the institution. 2023, c. 4, Sched. 3, s. 3. Modifications (2) The application of this Act to an extra-ministerial data integration unit and its senior officer under subsection (1) is subject to the following modifications: 1. Sections 31, 32 and 33 do not apply with respect to the extra-ministerial data integration unit. 2. Section 62 shall be read without reference to subsection 62 (3). 3. Any other modifications prescribed by the regulations. 2023, c. 4, Sched. 3, s. 3. Section Amendments with date in force (d/m/y) 2023, c. 4, Sched. 3, s. 3 - 24/07/2023
49.2 The purpose of the collection of personal information under this Part is to compile information, including statistical information, to enable analysis in relation to, (a) the management or allocation of resources; (b) the planning for the delivery of programs and services provided or funded by the Government of Ontario, including services provided or funded in whole or in part or directly or indirectly; and (c) the evaluation of those programs and services. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019
49.3 (1) A member of a multi-sector data integration unit or a ministry data integration unit shall not collect personal information under this Part or use or disclose that information if other information will serve the purpose of the collection, use or disclosure. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 3. Extent of information (2) A member of a multi-sector data integration unit or a ministry data integration unit shall not collect, use or disclose more personal information under this Part than is reasonably necessary to meet the purpose of the collection, use or disclosure. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 3. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 3 - 25/03/2020
49.6 (1) Upon collection of personal information under this Part, a member of a multi-sector data integration unit or a ministry data integration unit shall do the following as soon as reasonably possible in the circumstances: 1. Create a record containing the minimal amount of personal information necessary for the purpose of de-identifying the information and linking it to other information collected by the unit. 2. De-identify the personal information. 3. If the information is to be linked, link the personal information that has been de-identified under paragraph 2 to other de-identified information within the unit. 4. Promptly and securely destroy any record created under paragraph 1 that contains personal information, subject to any exemptions set out in the data standards. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 6. Same (2) In complying with subsection (1), the member shall comply with the requirements set out in the data standards. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 6 - 25/03/2020
49.7 (1) A member of an inter-ministerial data integration unit or a ministry data integration unit may only use personal information collected under this Part, (a) to link and de-identify the information under section 49.6; and (b) to conduct an audit where there are reasonable grounds to believe that there has been inappropriate receipt of a payment, service or good, including any benefit funded in whole or in part, directly or indirectly, by the Government of Ontario. 2019, c. 7, Sched. 31, s. 6. Extra-ministerial data integration unit (1.1) A member of an extra-ministerial data integration unit may only use personal information collected under this Part to link and de-identify the information under section 49.6. 2020, c. 5, Sched. 2, s. 7 (1). Reporting on use (2) The minister of the ministry in which an inter-ministerial data integration unit or a ministry data integration unit is located and the senior officer of every extra-ministerial data integration unit shall publicly report on the use of personal information under subsection (1) in accordance with the data standards. 2020, c. 5, Sched. 2, s. 7 (2). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 7 (1, 2) - 25/03/2020
49.8 No person or entity shall use or attempt to use information that has been de-identified under this Part, either alone or with other information, to identify an individual. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019
49.9 (1) A member of a multi-sector data integration unit or a ministry data integration unit may only disclose personal information collected under this Part if, (a) the disclosure is to another member of the multi-sector data integration unit or the ministry data integration unit, as the case may be, who need access to the information in the performance of their duties in connection with this Part; (b) the disclosure is required by law; (c) the disclosure is to an institution or a law enforcement agency in Canada and, (i) the disclosure is to aid in an investigation undertaken by the institution or the agency with a view to a law enforcement proceeding, or (ii) there is a reasonable basis to believe that an offence may have been committed and the disclosure is to enable the institution or the agency to determine whether to conduct such an investigation; (d) the disclosure is for the purpose of a proceeding or a contemplated proceeding before a court or a tribunal and the information relates to or is a matter in issue in the proceeding and, (i) in the case of a member of an inter-ministerial data integration unit or a ministry data integration unit, the ministry or the Government of Ontario is, or is expected to be, a party, (i.1) in the case of a member of an extra-ministerial data integration unit, the unit, or the person or entity in which the unit is located, as the case may be, is or is expected to be, a party, or (ii) a current or former employee, consultant or agent of the unit is, or is expected to be, a witness; (e) the disclosure is to the Commissioner; or (f) the disclosure for a research purpose is permitted by the regulations and the conditions prescribed in the regulations are met. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 8 (1-3); 2023, c. 4, Sched. 3, s. 4. Exception (2) Clause (1) (c) does not apply to an extra-ministerial data integration unit. 2020, c. 5, Sched. 2, s. 8 (4). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 8 (1-4) - 25/03/2020 2023, c. 4, Sched. 3, s. 4 - 24/07/2023
49.10 The minister of the ministry in which an inter-ministerial data integration unit or a ministry data integration unit is located and the senior officer of every extra-ministerial data integration unit shall ensure that a notice is published on a website that contains the following information respecting any personal information that a member of the unit intends to collect under this Part: 1. The legal authority for the collection. 2. The types of personal information that may be collected. 3. The sources of the personal information that may be collected. 4. The purpose for which the personal information is collected and may be used and disclosed, including the general nature of the linkages that may be made with the personal information. 5. The title and contact information of a member of the multi-sector data integration unit or the ministry data integration unit, as the case may be, who can answer questions about the collection, use and disclosure of the personal information under this Part. 6. The contact information for the Commissioner and a description of the Commissioner’s functions under section 49.12. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 9. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 9 (1, 2) - 25/03/2020
49.11 (1) The minister of the ministry in which an inter-ministerial data integration unit or a ministry data integration unit is located and the senior officer of every extra-ministerial data integration unit shall ensure that any personal information collected under this Part is, (a) retained, transferred and disposed of in a secure manner so as to protect the information against theft or loss or unauthorized use or disclosure; (b) retained separately from other personal information in the custody or under the control of the institution or extra-ministerial data integration unit; (c) retained for the period of time set out in the data standards or, if there is no such specified period, for at least one year after the day it was last used by a member of the unit; and (d) securely disposed of in accordance with the data standards. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (1, 2). Security requirements (2) In complying with clause (1) (a), the minister or the senior officer, as the case may be, shall comply with any requirements set out in the data standards respecting the security of the personal information. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (3). Notice of theft, loss, etc., to individual (3) Subject to the exceptions and additional requirements, if any, that are prescribed, if personal information collected under this Part that is in the custody or control of an inter-ministerial data integration unit, an extra-ministerial data integration unit or a ministry data integration unit is stolen or lost or if it is used or disclosed in a manner that is not permitted by this Part, the minister of the ministry in which the unit is located or the senior officer of the extra-ministerial data integration unit, as the case may be, shall, (a) notify the individual to whom the personal information relates at the first reasonable opportunity of the theft or loss or the unauthorized use or disclosure; and (b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (4). Notice to Commissioner (4) In the case of a theft or loss or of a use or disclosure in a manner that is not permitted by this Part, the minister or the senior officer, as the case may be, shall notify the Commissioner of the theft, loss or unauthorized use or disclosure at the first reasonable opportunity. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (5). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 10 (1-5) - 25/03/2020
49.13 (1) The minister of a ministry in which is located an inter-ministerial data integration unit or a ministry data integration unit that collects personal information under this Part during the course of a year shall ensure that an annual report for the year is published on a Government of Ontario website on or before April 1 in the following year. 2019, c. 7, Sched. 31, s. 6. Same (1.1) The senior officer of an extra-ministerial data integration unit that collects personal information under this Part during the course of a year shall ensure that an annual report for the year is published on a publicly accessible website on or before April 1 in the following year. 2020, c. 5, Sched. 2, s. 12 (1). Contents of report (2) The annual report shall, (a) describe the types of personal information that were collected and used during the year; (b) describe the purposes for which personal information was collected, used and disclosed during the year; (c) describe the nature of the linkages of personal information that have been made over the year; (d) provide a summary of the manner in which de-identified information was used and disclosed during the year; and (e) set out a description of how the practices and procedures of the multi-sector data integration unit or the ministry data integration unit, as the case may be, meet the requirements of this Part. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 12 (2). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 12 (1, 2) - 25/03/2020
49.14 (1) The responsible minister or a person designated by him or her shall, (a) prepare draft data standards providing for anything referred to in this Part as being provided for in the data standards, as well as practices and procedures for use, in connection with this Part, when, (i) collecting, using and disclosing personal information, (ii) linking and de-identifying personal information, (iii) reporting publicly on the use of personal information, (iv) securely retaining personal information, including providing for a minimum retention period for personal information, and (v) securely disposing of personal information; and (b) provide the draft data standards to the Commissioner who may approve them. 2019, c. 7, Sched. 31, s. 6. Publicly available (2) The responsible minister shall make the data standards available on a Government of Ontario website in English and in French. 2019, c. 7, Sched. 31, s. 6. Non-application of the Legislation Act, 2006, Part III (3) Part III (Regulations) of the Legislation Act, 2006 does not apply to the data standards. 2019, c. 7, Sched. 31, s. 6. Compliance with data standards (4) A member of a multi-sector data integration unit or a ministry data integration unit shall comply with the data standards. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 13. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 13 - 25/03/2020
49.15 (1) The Lieutenant Governor in Council may make regulations governing anything that this Part refers to as being provided for in the regulations. 2019, c. 7, Sched. 31, s. 6. Inter-ministerial data integration unit (2) The regulations may only designate a single inter-ministerial data integration unit whose members are also authorized to collect personal information solely for the purpose of compiling statistical information, and the unit must be located in the ministry of the minister who is responsible for the administration of the Statistics Act. 2019, c. 7, Sched. 31, s. 6. Consultation with Commissioner (3) A minister shall consult with the Commissioner before recommending a regulation to the Lieutenant Governor in Council that, (a) designates a multi-sector data integration unit; or (b) permits the disclosure of personal information for a research purpose under clause 49.9 (1) (f) or establishes any conditions for the purposes of that clause. 2020, c. 5, Sched. 2, s. 14. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 14 - 25/03/2020 PART IV   APPEAL
51 The Commissioner may authorize a mediator to investigate the circumstances of any appeal and to try to effect a settlement of the matter under appeal.  R.S.O. 1990, c. F.31, s. 51.
53 Where a head refuses access to a record or a part of a record, the burden of proof that the record or the part falls within one of the specified exemptions in this Act lies upon the head.  R.S.O. 1990, c. F.31, s. 53.
54 (1) After all of the evidence for an inquiry has been received, the Commissioner shall make an order disposing of the issues raised by the appeal.  R.S.O. 1990, c. F.31, s. 54 (1). Idem (2) Where the Commissioner upholds a decision of a head that the head may refuse to disclose a record or a part of a record, the Commissioner shall not order the head to disclose the record or part.  R.S.O. 1990, c. F.31, s. 54 (2). Terms and conditions (3) Subject to this Act, the Commissioner’s order may contain any terms and conditions the Commissioner considers appropriate.  R.S.O. 1990, c. F.31, s. 54 (3); 1996, c. 1, Sched. K, s. 10. Notice of order (4) The Commissioner shall give the appellant and the persons who received notice of the appeal under subsection 50 (3) written notice of the order.  R.S.O. 1990, c. F.31, s. 54 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 10 - 30/01/1996
55 (1) The Commissioner or any person acting on behalf of or under the direction of the Commissioner shall not disclose any information that comes to their knowledge in the performance of their powers, duties and functions under this or any other Act.  R.S.O. 1990, c. F.31, s. 55 (1). Not compellable witness (2) The Commissioner or any person acting on behalf or under the direction of the Commissioner is not compellable to give evidence in a court or in a proceeding of a judicial nature concerning anything coming to their knowledge in the exercise or performance of a power, duty or function under this or any other Act.  R.S.O. 1990, c. F.31, s. 55 (2). Proceedings privileged (3) No proceeding lies against the Commissioner or against any person acting on behalf or under the direction of the Commissioner for anything done, reported or said in good faith in the course of the exercise or performance or intended exercise or performance of a power, duty or function under this or any other Act.  R.S.O. 1990, c. F.31, s. 55 (3).
56 (1) The Commissioner may in writing delegate a power or duty granted to or vested in the Commissioner to an officer or officers employed by the Commissioner, except the power to delegate under this section, subject to such limitations, restrictions, conditions and requirements as the Commissioner may set out in the delegation.  R.S.O. 1990, c. F.31, s. 56 (1). Exception re records under s. 12 or 14 (2) The Commissioner shall not delegate to a person other than the Deputy Commissioner or an Assistant Commissioner his or her power to require a record referred to in section 12 or 14 to be produced and examined.  R.S.O. 1990, c. F.31, s. 56 (2); 2018, c. 17, Sched. 19, s. 5. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 5 - 06/12/2018 PART V   GENERAL
57 (1) A head shall require the person who makes a request for access to a record to pay fees in the amounts prescribed by the regulations for, (a) the costs of every hour of manual search required to locate a record; (b) the costs of preparing the record for disclosure; (c) computer and other costs incurred in locating, retrieving, processing and copying a record; (d) shipping costs; and (e) any other costs incurred in responding to a request for access to a record.  1996, c. 1, Sched. K, s. 11 (1). (2) Repealed:  1996, c. 1, Sched. K, s. 11 (1). Estimate of costs (3) The head of an institution shall, before giving access to a record, give the person requesting access a reasonable estimate of any amount that will be required to be paid under this Act that is over $25.  R.S.O. 1990, c. F.31, s. 57 (3). Waiver of payment (4) A head shall waive the payment of all or any part of an amount required to be paid under subsection (1) if, in the head’s opinion, it is fair and equitable to do so after considering, (a) the extent to which the actual cost of processing, collecting and copying the record varies from the amount of the payment required by subsection (1); (b) whether the payment will cause a financial hardship for the person requesting the record; (c) whether dissemination of the record will benefit public health or safety; and (d) any other matter prescribed in the regulations.  R.S.O. 1990, c. F.31, s. 57 (4); 1996, c. 1, Sched. K, s. 11 (2). Review (5) A person who is required to pay a fee under subsection (1) may ask the Commissioner to review the amount of the fee or the head’s decision not to waive the fee.  R.S.O. 1990, c. F.31, s. 57 (5); 1996, c. 1, Sched. K, s. 11 (3). Disposition of fees (6) The fees provided in this section shall be paid and distributed in the manner and at the times prescribed in the regulations.  1996, c. 1, Sched. K, s. 11 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 11 (1-4) - 30/01/1996
58 (1) The Commissioner shall make an annual report to the Speaker of the Assembly in accordance with subsections (2) and (3).  2004, c. 3, Sched. A, s. 81 (4). Contents of report (2) A report made under subsection (1) shall provide a comprehensive review of the effectiveness of this Act and the Municipal Freedom of Information and Protection of Privacy Act
in providing access to information and protection of personal privacy including, (a) a summary of the nature and ultimate resolutions of appeals carried out under subsection 50 (1) of this Act and under subsection 39 (1) of the Municipal Freedom of Information and Protection of Privacy Act; (b) an assessment of the extent to which institutions are complying with this Act and the Municipal Freedom of Information and Protection of Privacy Act; and (c) the Commissioner’s recommendations with respect to the practices of particular institutions and with respect to proposed revisions to this Act, the Municipal Freedom of Information and Protection of Privacy Act and the regulations under them.  R.S.O. 1990, c. F.31, s. 58 (2). Same, personal health information (3) If the Commissioner has delegated powers or duties under the Personal Health Information Protection Act, 2004 to the Assistant Commissioner for Personal Health Information, a report made under subsection (1) shall include a report prepared in consultation with the Assistant Commissioner on the exercise of the Commissioner’s powers and duties under that Act, including, (a) information related to the number and nature of complaints received by the Commissioner under section 56 of that Act and the disposition of them; (b) information related to the number and nature of reviews conducted by the Commissioner under section 58 of that Act and the disposition of them; (c) information related to the number of times the Commissioner has made a determination under subsection 60 (13) of that Act and general information about the Commissioner’s grounds for the determination; (d) all other information prescribed by the regulations made under that Act; and (e) all other matters that the Commissioner considers appropriate.  2004, c. 3, Sched. A, s. 81 (5). Tabling (4) The Speaker shall cause the annual report to be laid before the Assembly if it is in session or shall deposit the report with the Clerk of the Assembly if the Assembly is not in session.  2004, c. 3, Sched. A, s. 81 (5). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 81 (4, 5) - 1/11/2004
59 The Commissioner may, (a) offer comment on the privacy protection implications of proposed legislative schemes or government programs; (b) after hearing the head, order an institution to, (i) cease collection practices, and (ii) destroy collections of personal information, that contravene this Act; (c) in appropriate circumstances, authorize the collection of personal information otherwise than directly from the individual; (d) engage in or commission research into matters affecting the carrying out of the purposes of this Act; (e) conduct public education programs and provide information concerning this Act and the Commissioner’s role and activities; and (f) receive representations from the public concerning the operation of this Act.  R.S.O. 1990, c. F.31, s. 59.