Restrictions on use, s. 293 (9) of the Act
 4. (1) Despite subsection 293 (9) of the Act, a prescribed entity, or a person or entity that is not a prescribed entity, may use personal information received under subsection 293 (1), (2) or (3) of the Act for a purpose other than for which it was received if the following requirements are met: 1. The person or entity shall submit a research plan that meets the requirements of subsection (2) respecting the use of that personal information to a research ethics board that meets the following criteria: i. It has at least five members. ii. At least one member has no affiliation with the person or persons that established the research ethics board. iii. At least one member is knowledgeable in research ethics, either as a result of formal training in research ethics or practical or academic experience in research ethics. iv. At least two members have expertise in the methods or in the areas of research being considered. v. At least one member is knowledgeable in privacy issues but does not provide legal advice to a service provider. 2. The person or entity has received written confirmation from each member of the research ethics board that the member’s personal interest in the use of the personal information or the performance of the research does not conflict or appear to conflict with the member’s ability to objectively review the research plan. 3. The research ethics board has approved the plan. (2) A research plan shall be in writing and set out the following information: 1. The affiliation of each person involved in the research. 2.   The nature and objectives of the research and the public or scientific benefit of the research that the researcher anticipates. 3. A description of the research proposed to be conducted and the duration of the research. 4. A description of the personal information required and the potential sources. 5. A description of how the personal information will be used in the research and, if it will be linked to other information, a description of the other information as well as how the linkage will be done. 6. An explanation as to why the research cannot reasonably be accomplished without the personal information and, if it is to be linked to other information, an explanation as to why this linkage is required. 7. An explanation as to why consent to the disclosure of the personal information is not being sought from the individuals to whom the information relates. 8. A description of the reasonably foreseeable harms and benefits that may arise from the use of the personal information and how the researchers intend to address those harms. 9. If the research relates primarily to First Nations, Inuit or Métis individuals, i. the written approval of each of the bands or First Nations, Inuit or Métis communities whose member’s personal information will be used in the research, and ii. the written approval of each of the bands or First Nations, Inuit or Métis communities with which an individual whose personal information will be used in the research identifies. 10. A description of all persons who will have access to the personal information, why their access is necessary, their roles in relation to the research and their related qualifications. 11. The safeguards that the person or entity will impose to protect the confidentiality and security of the personal information, including an estimate of how long information will be retained in an identifiable form and why. 12. Information as to how and when the personal information will be disposed of or returned to the service provider. 13. A description of how the entity or person will, at the earliest reasonable opportunity, notify the service provider from which the personal information was received of any theft, loss or unauthorized use or disclosure of the personal information. 14. The funding source of the research. 15. Whether the person or entity has applied for the approval of another research ethics board and, if so, the response to or status of the application. 16.   Whether the person or entity’s interest in the disclosure of the personal information or the performance of the research would likely result in an actual or perceived conflict of interest with other duties of the person or entity.