Personal information, prescribed standards, s. 169 (1) of the Act
 146. (1) This section prescribes standards, for the purposes of subsection 169 (1) of the Act, for the collection, use, disclosure and safeguarding of privacy of personal information and for a person’s access to his or her personal information.  O. Reg. 367/11, s. 146 (1). (2) A provider shall not disclose personal information obtained in the course of providing the services described in subsection 169 (1) of the Act except, (a) if the person to whom the personal information relates consents to the disclosure; (b) if the person to whom the personal information relates is less than 16 years old or is unable for any reason to give a valid consent and consent is given by another person who, (i) is the parent of the person to whom the personal information relates, if that person is less than 16 years old, (ii) is the guardian of the person to whom the personal information relates, (iii) is an attorney of the person to whom the personal information relates under a power of attorney that authorizes the attorney to give the consent on that person’s behalf, or (iv) is otherwise authorized to give the consent on behalf of the person to whom the personal information relates; (c) if the disclosure is authorized by, or is for the purpose of complying with, the Act or a regulation under the Act; (d) if the disclosure is authorized by law; (e) for the purpose for which it was obtained or compiled or for a consistent purpose; (f) if the disclosure is made to a director, officer, employee, consultant, agent or volunteer of the provider who needs the record in the performance of their duties; (g) if the disclosure is to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result and the disclosure is to a person or organization referred to in subsection 174 (1) or (2) of the Act or a law enforcement agency; (h) in compelling circumstances affecting the health or safety of a person if upon disclosure notification is mailed to the last known address of the person to whom the information relates; or (i) in compassionate circumstances, to facilitate contact with the spouse, a close relative or a friend of a person who is injured, ill or deceased.  O. Reg. 367/11, s. 146 (2); O. Reg. 242/22, s. 9 (1). (3) A provider shall not collect or use personal information except, (a) as is necessary for purposes relating to the performance of its powers and duties under the Act or a regulation under the Act, including powers and duties delegated to the provider under section 17 of the Act; or (b) as otherwise authorized by law.  O. Reg. 367/11, s. 146 (3). (4) A provider that collects personal information from the person to which it relates shall ensure that the person is given written notice, (a) of the purpose or purposes of the collection; (b) that the information may be shared as necessary for the purpose of making decisions or verifying eligibility for assistance under the Act, the Ontario Disability Support Program Act, 1997, the Ontario Works Act, 1997 or the Child Care and Early Years Act, 2014, or as authorized by an agreement under section 171 or 172 of the Act; and (c) of the name, title, business address and business telephone number of a person who can answer questions and respond to complaints about the collection, use or disclosure of the information.  O. Reg. 367/11, s. 146 (4); O. Reg. 150/16, s. 7. (5) A provider shall take whatever steps are reasonably necessary to safeguard the privacy of personal information in its custody or control, and when it disposes of personal information shall do so in a secure manner.  O. Reg. 367/11, s. 146 (5). (6) A provider who has custody or control of personal information shall allow the person to whom the information relates to have access to it on request, if the person provides satisfactory identification.  O. Reg. 367/11, s. 146 (6). (7) Subsection (6) does not apply if, (a) the personal information to which the person seeks access contains or reveals personal information about another person that could not be disclosed, under subsection (2), to the first-named person; (b) it would be unreasonably difficult for the provider to retrieve and allow access to the personal information; or (c) the disclosure of the personal information could reasonably be expected to prejudice the mental or physical health or mental or physical security of any person, including the person seeking access to the information.  O. Reg. 367/11, s. 146 (7). (8) A person who is given access to personal information under subsection (6) is entitled, on request, (a) to have the provider correct the personal information; or (b) to have the provider attach to the personal information a statement of disagreement reflecting any requested correction that was not made.  O. Reg. 367/11, s. 146 (8). (9) A provider shall ensure that the provider’s directors, officers, employees, agents and volunteers comply with the standards prescribed by this section.  O. Reg. 367/11, s. 146 (9). (10) Subsection (11) applies with respect to the following personal information: 1. Personal information collected for the purpose of determining whether a household should be included in the special priority household category. 2. Personal information, whether or not it is collected for the purpose described in paragraph 1, that relates to the abuse of a member of a household.  O. Reg. 367/11, s. 146 (10); O. Reg. 437/17, s. 26. (11) The following apply with respect to the personal information described in subsection (10): 1. Despite any other subsection in this section, the personal information shall not be disclosed or used except, i. for the purpose for which it was collected, or ii. with consent to the disclosure or use as described in paragraph 2. 2. The consent referred to in subparagraph 1 ii is the consent of the abused person or, if the abused person is less than 16 years old or is unable for any reason to give a valid consent, the consent of another person who, i. is the parent of the abused person, if that person is less than 16 years old, ii. is the guardian of the abused person, iii. is an attorney of the abused person under a power of attorney that authorizes the attorney to give the consent on that person’s behalf, or iv. is otherwise authorized to give the consent on the abused person’s behalf. 3. Subsection (6) does not apply with respect to the personal information.  O. Reg. 367/11, s. 146 (11); O. Reg. 242/22, s. 9 (2). (12) In this section, “law enforcement” means, (a) policing, (b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, and (c) the conduct of proceedings referred to in clause (b); (“exécution de la loi”) “parent”, in relation to an individual, includes a person who has demonstrated a settled intention to treat the individual as a child of his or her family, but does not include a person in whose home the individual has been placed as a foster child for consideration; (“parent”) “provider” means any person to whom section 169 of the Act applies. (“fournisseur”)  O. Reg. 367/11, s. 146 (12); O. Reg. 242/22, s. 9 (3, 4).