A New Law Came To Town: The Right to Information and Protection of Privacy Act
Presentation to the Association of Municipal Administrators of New Brunswick
2013 Annual ConferenceShediac, NB – June 14, 2013
On September 1, 2010, a new law regarding access to information and protection of privacy came into effect: Right to Information and Protection of Privacy Act◦ Designed for the public sector◦ Promotes spirit of openness and transparency◦ Grants right to request information relating to the
public business of a public body◦ Grants right to request one’s personal information◦ Obligates public bodies to protect private
information at all times◦ Act “ Came to Town” on September 1, 2012
Introduction
◦ Also created on September 1, 2010
◦ Independent of government
◦ Commissioner: Officer of Legislative Assembly
◦ Impartial oversight body to ensure compliance with Right to Information and Protection of Privacy Act
(as well as Personal Health Information Privacy and Access Act)
Office of the Access to Information and Privacy
Commissioner
Interpret the Act
Inform the public of its rights
Promote openness and transparency
Provide guidance on how best to apply the new rules
Ensure compliance with the Act
Role of Commissioner’s Office
Receives:
◦ General inquiries about the Act ◦ Complaints regarding responses to requests for access to information ◦ Notification of privacy concerns or breaches of the Act (the handling of
personal information found in records during its collection, use, disclosure, retention, or destruction)
Investigates and Resolves:
◦ Complaints informally if at all possible
Publishes:
◦ Reports of Findings after investigations (when required)
Currently Developing:
◦ An “interactive” complaint investigation and resolution process specifically for municipalities
Commissioner’s Office
RIGHT OF ACCESS
Grants public a right to request information contained in records held by public bodies
◦ Key words: access to information rather than access to records
Promotes disclosure of the information, subject to limited and specific exceptions
Imposes on public bodies an obligation to respect that right of access - duty to assist
Right to Information and Protection of Privacy Act
All information regarding the public business of the public body, its activities and functions
◦Found in its records Example: information found in minutes of
meetings, reports, decisions made, handwritten notes, correspondence, emails, text messages, etc.
Includes information created before the Act came into effect
Which information can be accessed?
Time limit to respond is 30 days, unless authorized to extend time limit
Search for relevant records must be thorough
Response should be meaningful
Processing of request remains confidential for applicants and third parties
Processing an Access to Information Request
Two types of exceptions:
◦Mandatory: public body has no choice but to withhold the information requested
◦Discretionary: head of the public body must come to a decision whether or not to disclose the information Based on relevant considerations existing at
the time of the request
Exceptions to disclosure
An applicant who is not satisfied with the response has two options:
Refer the matter to the Court of Queen’s Bench for review (legal application, must file within 30 days)
Or
File a complaint with the Office of the Access to Information and Privacy Commissioner within:
60 days of receiving response, or 120 days from making request if did not receive a
response
If the response is not satisfactory?
Commissioner must investigate all complaints
Will first attempt to resolve the matter informally
To the satisfaction of both parties, and In accordance with the Act Meanwhile guidance on application of rules is provided
If informal resolution is unsuccessful, formal Report of Findings will be published
May contain recommendations
Access Complaints filed with the Commissioner
PROTECTION OF PRIVACY
Privacy breach occurs when personal information is:
◦ Lost or stolen, handled or accessed in an unauthorized manner or without consent
If breach occurs, must reduce possible harm caused by:
Containing it Assessing the risk of harm Notifying the Commissioner and those persons affected Implementing corrective measures to prevent recurrence
Right to Information and Protection of Privacy Act
Access to information
Governed by rules found in Part 2 of the Act Request to access private information
Only rules for protection of private information found under Part 2 can be considered in exceptions to disclosure
Protection of privacy
Governed by rules found in Part 3 of the Act Protects private information at all times
Rules under Part 3 are applied by public bodies to protect private information on a regular basis – not for requests
Separate but related concepts
Personal information− protected based on unreasonable invasion of privacy
Business information− protected based on may cause harm to business
◦ Both types may still be subject to access (Subsections 21(3) &22(3))− Because disclosure deemed not unreasonable invasion of privacy
nor to cause harm
◦ Example: personal information about an officer or employee of a public body deemed subject to disclosure: job classification salary range benefits employment responsibilities or travel expenses
Interaction between the concepts
If information is protected under another statute, the Act will respect that protection unless there is conflict regarding its disclosure
◦ Example: where third party individual or business consents to release of own private information which is otherwise protected by other statute
Public procurement is a good example of such interaction
Interaction between the Act & other statutes
Public Procurement Process and the Act
Appropriate level of confidentiality of business and personal information while promoting transparency and accountability
Rules ensure that the public obtains access only to
information it is entitled to receive
Where request made to access bid information after tender is awarded, municipality must ask the bidder for consent to release the bid information
See Guide for Municipalities on Public Procurement and the Act
Use video surveillance only to: Ensure safety of the public Enforce the law Supplement less intrusive forms of surveillance
Cannot use video surveillance to: View inside private dwellings View areas of greater privacy Capture images of those citizens not targeted
by stated purpose of surveillance Simply observe
Video surveillance: Factors to consider
TRANSPARENCY
◦ Advise the public as to purpose of the surveillance
◦ Inform the public to ensure that the surveillance is considered acceptable
◦ Keep the public informed of the surveillance, and any changes made to it
◦ Post signs indicating where video surveillance camera is located
◦ Ensure cameras cannot be manipulated or adjusted to change viewing area unless authorized
Video surveillance: Factors to consider
SECURITY
◦ Protect information collected by video surveillance
◦ Ensure that video feed is encrypted to reduce the risk of unauthorized access
◦ Limit those authorized to access the recorded information
◦ Train staff on importance of security and protection of privacy of the recorded information
◦ Conduct annual audits
Video surveillance: Factors to consider
Protect personal information and business information at all times, including during retention, storage and destruction
Implement proper and secure handling practices when retaining, storing and destroying the information
Adopt and follow reasonable retention schedules and inform the public of same
Securely store records in locked or controlled-access areas
Destroy records securely and under supervision (shredding, disk wiping, etc.)
Retention, storage and destruction of records
How to Contact us
230 - 65 Regent Fredericton, NB E3B 7H8
Tel/Tél: 506.453.5965Toll-free/Sans frais: 1.877.755.2811
Fax/Fac: 506.453.5963
www.info-priv-nb.ca
Email/Courriel: [email protected] accès.info.vieprivé[email protected]