20 The following rules apply to the collection, use or disclosure of personal information by the Advocate: 1. The Advocate may directly collect personal information from an individual for the purposes of carrying out the functions of the Advocate. 2. When collecting personal information directly, the Advocate shall explain to the individual from whom it is being collected how the information may be used or disclosed, and any limitations on confidentiality that may apply. 3. Subject to paragraph 3.1, the Advocate may collect personal information about an individual indirectly either with the individual’s consent, or, if it is not reasonably possible to obtain the individual’s consent, with the consent of a person who is authorized to consent on behalf of the individual in accordance with paragraph 12. 3.1 The Advocate may directly or indirectly collect personal information about an individual without consent during an investigation conducted pursuant to the Advocate’s investigative function under subsection 15 (2), where the Advocate is of the opinion that the collection is reasonably necessary to the investigation. 4. Subject to paragraph 4.1, the Advocate may only use personal information about an individual that has been collected indirectly with the consent of the individual, or, if it is not reasonably possible to obtain the individual’s consent, with the consent of a person who is authorized to consent on behalf of the individual in accordance with paragraph 12. 4.1 The Advocate may use personal information about an individual without consent during an investigation conducted pursuant to the Advocate’s investigative function under subsection 15 (2), where the Advocate is of the opinion that the use is reasonably necessary to the investigation. 5. Subject to paragraph 3.1, with the consent of an individual, or, if it is not reasonably possible to obtain the individual’s consent, with the consent of a person who is authorized to consent on behalf of the individual in accordance with paragraph 12, the Advocate may collect personal information in the possession of an agency, service provider or other entity about the individual, if that information would normally be available to the individual, either through law or policy. 6. The Advocate may use personal information about an individual, i. for the specific purpose for which it was collected, or ii. for the purpose of seeking the individual’s consent to use or disclose the information, where the personal information was collected indirectly. 7. Subject to subsection 13.1 (4), the Advocate may only disclose personal information, i. with the consent of the individual to whom the information pertains, or, if it is not reasonably possible to obtain the individual’s consent, with the consent of a person who is authorized to consent on behalf of the individual in accordance with paragraph 12, and ii. in accordance with this Act and any other laws of Ontario and Canada. 8. Despite paragraph 7, the Advocate may disclose personal information without consent, i. if the Advocate reasonably believes that the disclosure is necessary to eliminate or reduce a significant risk of death or serious bodily harm to a person or group, ii. if the disclosure is authorized or required by law, or iii. if the disclosure is necessary for the purposes of law enforcement. 9.   The Advocate may only disclose under subparagraph 8 iii information that was received from a child or youth without the consent of the child or youth if the interest of the continued proper administration of justice in having the information disclosed outweighs the privacy interests of the child or youth in not having the information disclosed. 10. The Advocate may not disclose in a public report or public communication the name or identifying information of any individual who has not consented to the disclosure unless a person who is authorized to consent on behalf of the individual in accordance with paragraph 12 has consented to the disclosure. 11. Any consent required by this section must be knowledgeable as described in subsection 18 (5) of the Personal Health Information Protection Act, 2004, relate to the specific information, and be given freely. 12. Where an individual is not capable of consenting to the collection, use or disclosure of personal information, a person who would be capable of consenting to the collection, use or disclosure, as the case may be, of personal health information on the individual’s behalf under the Personal Health Information Protection Act, 2004 may consent on the individual’s behalf. 13. An individual or a person who is authorized to consent on behalf of an individual in accordance with paragraph 12 may withdraw consent to the collection, use or disclosure of personal information at any time. 14. All of the rules in this section that apply to the Advocate apply equally to the Advocate’s staff and to any specialists or consultants retained by the Advocate.  2007, c. 9, s. 20; 2014, c. 13, Sched. 10, s. 11. Section Amendments with date in force (d/m/y) 2014, c. 13, Sched. 10, s. 11 (1-6) - 01/03/2016 Reporting Requirements