FOIPP Act Policy and Procedures Manual

 

Section 33 - Disclosure of Personal Information
Last updated: July 20, 2007
OVERVIEW

Section 33 is the overarching provision that requires a public body to only disclose personal information in its custody or under its control if it is permitted by section 33.1 (Disclosure inside or outside Canada) or section 33.2 (Disclosure inside Canada only).

SECTION REFERENCE

Section 33 of the Freedom of Information and Protection of Privacy Act

 

33 A public body must ensure that personal information in its custody or under its control is disclosed only as permitted under section 33.1 or 33.2.

Top of page.

SUMMARY

Section 33 states that a public body must only disclose personal information in accordance with sections 33.1 and 33.2.

Top of page.

POLICY

  1. A public body must only disclose personal information in its custody or under its control in accordance with sections 33.1 and 33.2.

  2. If a public body discovers that it has accidentally disclosed an individual’s personal information, and the disclosure was not authorized by section 33.1 or 33.2, the public body must:
  • notify the Director or Manager of Information and Privacy or the FOIPP coordinator;

  • take steps to recover the personal information from all sources to which it has been disclosed;

  • determine the impact of the disclosure, and advise senior staff as appropriate;

  • advise, where appropriate, the individual whose information has been disclosed of the disclosure, explain the steps being taken to recover the information, and inform the individual of his/her right to complain to the Information and Privacy Commissioner;

    •
  • advise both the IM/IT Privacy and Legislation Branch (KIS), and the Office of the Information and Privacy Commissioner (OIPC) in situations where the disclosure may have a serious public or personal impact;
     
  • examine policies and processes that may have led to the breach of privacy and revise if necessary; and

  • provide staff education regarding privacy issues involved in the breach to reduce the potential of a future occurrence.

Protection of public body from legal suit

Section 74.1 states that a person who discloses personal information not authorized by the Act, commits an offence. The fines for committing such an offence are up to $500,000 for a corporation; up to $25,000 for a partnership or an individual who is a service provider; and up to $2,000 for an individual who is not a service provider (for example, an employee). Section 74.1(8) states that in the defence of a prosecution of an offence under section 74.1, the person charged can try to prove that they exercised due diligence to avoid committing the offence.

Top of page.

INTERPRETATION

Interpretation Note 1 (Section 33(a)):

Section 33 protects privacy by limiting the purposes for which a public body may disclose personal information. Section 33.1 (Disclosure inside or outside of Canada) and section 33.2 (Disclosure inside Canada only) set out the circumstances under which a public body may disclose personal information.

SECTIONAL INDEX OF COMMISSIONER'S ORDERS

For orders organized by the Act's section numbers, Click here.