FOIPP Act Policy and Procedures
Manual
Section 30 - Protection of Personal
Information
Last updated: July 19, 2007
|
OVERVIEW
Section 30 requires a public body to provide appropriate physical and procedural security measures to protect personal information in
its custody or under its control.
SECTION REFERENCE
 Section
30 of the
Freedom of Information and Protection of
Privacy Act
30 A
public body must protect
personal information in its custody
or under its control by making reasonable
security arrangements against such risks
as unauthorized
access,
collection,
use,
disclosure
or
disposal.
SUMMARY
Section 30 imposes a duty upon
the public body to prevent unauthorized access to personal information in its custody or control both from within and outside the public body. This section also requires the
public body to ensure that access by members within the public body is governed by the principle of
need to know. Appropriate physical and procedural arrangements are discussed below.
POLICY
- Public bodies must:
- ensure their employees are
trained to follow proper security
procedures;
- monitor their employees’
compliance with security standards;
- ensure physical and procedural
security precautions are established
and maintained at appropriate
levels; and,
- comply with the
Core Policy
and Procedures Manual's security access matrix for
recorded information.
- Public bodies shall analyze the types
and level of sensitivity of the personal
information in their custody and control.
Public bodies shall follow the directions
on security of information, provided in
the
Core Policy and Procedures Manual's (CCPM)
Chapter 12 and take the necessary steps,
over time and within available resources,
to implement those physical and procedural
safeguards.
- A
Privacy Protection Schedule (PPS) for
use by ministries must be completed and
attached as a schedule to any contract between
ministries and a contractor under which
the contractor will be collecting, creating,
using, disclosing or storing "personal information"
(as defined by the
FOIPP Act ) unless it is not intended
that the ministry will own or control the
personal information. The CCPM reference
is Contract Award Administration Policy
11 that can be found at
CCPM 6.3.3(e) (11).
- The
PPS for use by other public bodies may
be completed and attached as a schedule
to any contract between a public body and
service provider under which the service
provider will be collecting, creating, using,
disclosing or storing "personal information"
(as defined in the
FOIPP Act) unless it is not intended
that the public body will own or control
the personal information.
- Public bodies should develop policy
governing the use of and access to non-written
formats of recorded personal information
(e.g. audio tapes, video tapes, photographs,
and discs) to supplement the policies governing
the use of and access to written information.
- Public bodies must ensure that the disposal
of personal information has been approved
by the designated authority and meets all
the requirements of any governing legislation.
For Ministries, this means disposal in accordance
with the
Document Disposal Act and
ARCS/ORCS On-line. Public bodies not
covered by the Document Disposal Act
are encouraged to use procedures outlined
in Procedure 5 below.
- Notwithstanding any other authorities
that any public body may be subject to,
a public body must retain personal information
that has been used to make a decision affecting
an individual for a minimum of one year.
PROCEDURE
- Review all records containing personal
information to determine which category
of the
Core Policy and Procedures Manual's (CCPM)
Chapter 12 applies to those particular
records. The CCPM's Chapter 12 defines
the security arrangements for all forms
of government documents.
- Those public bodies not governed by
the CCPM should consider using a sliding
scale of security as defined under
Interpretation Note 1 in this section.
- To ensure the security and retention
of audio tapes, video tapes or discs, public
bodies should follow the guidelines as stated
in the
Records and Information Management Manual
(RIM).
- Establish procedures to minimize the
risk of unauthorized access. Permit access
to personal information only by personnel
who require it in order to perform their
duties. Log all access, including who accessed
the information, their purpose for access
and the time of access. Establish a
Security Access
Matrix that describes which job functions
are permitted access to specific types or
groups of personal information. These access
charts should be available to all staff.
Access to personal information should only
be permitted to those who demonstrate their
right of access on the security access chart.
- The public body is responsible for ensuring
that the disposal of personal information
has been approved by the designated authority.
This responsibility may be exercised in
several ways:
- For public bodies who are subject to
the
Document Disposal Act: disposal
of records must be authorized by a records
retention and disposition authority.
- For public bodies not subject to the
Document Disposal Act, no disposal
of personal information should occur without
the authorization of the head of that public
body. The head may delegate this responsibility.
- Authorized disposal of information may
be either:
- transfer of the record to the legal
custody of the archives of the government
of British Columbia or the archives
of a public body; or
- physical destruction of the record
containing the personal information
in such a way that it cannot be retrieved
or reconstructed (e.g. paper records
should be shredded, burned or pulped;
magnetic media should be erased or physically
destroyed).
- Standards for the destruction of records
are available from
the archives of the government of British
Columbia.
- Public bodies should keep a record of
the personal (and non-personal) information
they destroy, transfer to the archives of
the government of British Columbia, or transfer
to the archives of a public body.
- If the final disposition of records
containing personal information is to the
legal custody of the the archives of the
government of British Columbia or to the
archives of a public body, the public body
must ensure that the security and confidentiality
of personal information is protected during
storage and transfer.
- A review of security arrangements
should be undertaken as part of any
Privacy Impact Assessment conducted
by completing the
Privacy Impact Assessment Process.
Additionally, a more in depth evaluation
of security standards can be undertaken
by completing a Threat and Risk Assessment
Form which is available from the
Risk Management Branch of the Ministry
of Finance.
INTERPRETATION
Interpretation
Note 1:
For public bodies covered by the Core
Policy Manual (Core), "reasonable security arrangements" are those as provided for in
the
Core Policy Manual.
For public bodies not covered
by the Core Policy and
Procedures Manual, "reasonable
security arrangements"
are those that a fair, rational
person would think were appropriate
to the sensitivity of the information
and to the medium in which it is
stored, transmitted, handled, or
transferred. A sliding scale of
security arrangements is appropriate,
depending on the sensitivity of
the personal information that a
public body handles.
Stringent security measures (e.g.,
locked filing cabinets, computer
access codes and a physically secure
room to which access is controlled
by a guard, receptionist, locked
door or electronic access control
device) are appropriate for particularly
sensitive information such as medical
records, personnel files or inmate
files.
Less rigorous methods (e.g., unlocked
filing cabinets; computers kept
behind a counter or other barrier
to the public; office doors locked
at night) are adequate for less
sensitive information, such as names
and addresses.
Examples
of physical security arrangements
- Storing records
containing personal
information in locked
storage rooms or locked
filing cabinets, with
controls over distribution
of keys or lock combinations.
- Use of numbers or
other methods to label
file drawers, records
storage boxes and other
storage containers so
as not to reveal the
fact that they contain
personal information.
Examples
of procedural security arrangements
- Access controls
on computer systems
(i.e., passwords that
allow different levels
of access to various
screens and differing
capabilities to read,
extract or change data).
- Where contracted
services are used for
storage, transportation
or destruction of records,
including security provisions
in the service contract,
public bodies should
require the contractors
to provide a certificate
of destruction.
"Unauthorized
access"
Access
to personal information is unauthorized
if an employee of a public body
does not have approved access according
to the security access chart (i.e.,
if the employee has access to personal
information which they do not need
to see or handle in the course of
their job duties).
"Unauthorized collection"
"Collection"
of personal information is unauthorized
if it is not done in accordance
with
sections 26 (Purpose for which
information may be collected) and
section 27 (How personal information
is collected) of the Act.
"Unauthorized
use"
"Use" of personal information
is unauthorized if it is not in
accordance with
section 32 (Use of personal
information) of the Act.
"Unauthorized disclosure"
An unauthorized disclosure is revealing,
exposing, showing, providing copies
of, selling, giving or telling personal
information in a way that is
not in accordance with
section 33 (Disclosure of personal
information) of the Act. The public
body ensures that disclosures of
personal information are authorized
under
section 33.1 or
section 33.2
of the Act.
"Unauthorized
disposal" of personal information
means destruction or removal of
records containing personal information
from the custody and/or control
of a public body without the approval
of the designated authority or in
ways which do not adhere to approved
methods and standards. Public bodies
must not dispose of personal information
within a year of that information
being used to make a decision about
an individual. See
section 31 (Retention of personal
information) and
section 31.1 (Application
to employees and others).
"Authorized
Disposal" means disposing
of records containing personal information
in accordance with approved legislated
government records standards and
procedures. For public bodies
which are covered by the
Document Disposal Act:
disposal of records must be authorized
by a records retention and disposition
authority. Such retention and disposition
schedules may require a public body
to retain the records well past
the 1-year period required under
section 31 of this Act.
A public body ensures that the disposal
of personal information is approved
by the designated authority. For
public bodies, which are subject
to the Document Disposal Act,
disposal of records must be authorized
by a records retention and disposition
authority approved either by the
Executive Council or the Legislative
Assembly, depending on the age of
the records.
If the public body is not subject
to the Document Disposal Act,
no disposal of personal information
occurs without the authorization
of the head of the public body.
The head may delegate this responsibility.
Authorized disposal of information
may be either:
- Transfer of the record to
the legal custody of the archives
of the government of British
Columbia or the archives of
a public body; or,
- Physical destruction of
the record containing the personal
information in such a way that
it cannot be retrieved or reconstructed
(e.g., paper records should
be shredded, burned or pulped;
magnetic media should be erased
or physically destroyed).
Standards for the destruction
of records are available from the
archives of the government of British
Columbia for public bodies subject
to the Document Disposal Act.
Examples
of unauthorized disposal
- Destroying sensitive
medical records by throwing
them into an ordinary
garbage can, instead
of using approved methods
of destruction such
as shredding or incineration.
- Destroying employment
competition files immediately
after the competition
when the approved retention
and disposition schedule
requires that they be
kept for the current
year plus three additional
years before destruction.
Public bodies should keep a record
of the personal (and non-personal)
information they destroy or transfer
to the archives of the government
of British Columbia or to the archives
of a public body.
If the final disposition of records
containing personal information
is their transfer to the legal custody
of the archives of the government
of British Columbia or to the archives
of a public body, the public body
must ensure that the security and
confidentiality of personal information
is protected during storage and
transfer.
SECTIONAL INDEX
OF COMMISSIONER'S ORDERS
For orders organized by the Act's
section numbers,
Click here.
|
