Section 27 - How personal information is to be collected

Overview

Section 27 stipulates how public bodies must collect personal information.

Section Reference

Section 27 of the Freedom of Information and Protection of Privacy Act

(1) A public body must collect personal information or cause personal information to be collected directly from the individual the information is about unless

(a) another method of collection is authorized by

(i) that individual,

(ii) the commissioner under section 42(1)(i), or

(iii) another enactment,

(a.1) the collection of the information is necessary for the medical treatment of an individual and it is not possible

(i)  to collect the information directly from that individual, or

(ii)  to obtain authority under paragraph (a)(i) for another method of collection,

(b) the information may be disclosed to the public body under sections 33 to 36 or

(c) the information is collected for the purpose of

(i) determining suitability for an honour or award, including an honorary degree, scholarship, prize or bursary,

(ii) a proceeding before a court or a judicial or quasi judicial tribunal,

(iii) collecting a debt or fine or making a payment, or

(iv) law enforcement.

(2) A public body must ensure that an individual from whom it collects personal information or causes personal information to be collected is told

(a) the purpose for collecting it,

(b) the legal authority for collecting it, and

(c) the title, business address and business telephone number of an officer or employee of the public body who can answer the individual's questions about the collection.

(3) Subsection (2) does not apply if

(a) the information is about law enforcement or anything referred to in section 15(1) or (2),

(b) the minister responsible for this Act excuses a public body from complying with it because doing so would

(i) result in the collection of inaccurate information, or

(ii) defeat the purpose or prejudice the use for which the information is collected, or

(c) the information

(i)  is not required, under subsection (1), to be collected directly from the individual the information is about, and

(ii)  is not collected directly from the individual the information is about.

Summary

Under section 27 public bodies must, with limited exceptions, collect personal information directly from the person to whom it pertains. Public bodies must also notify individuals of the purpose for which they are collecting information, the legal authority for the collection and the title, business address and business telephone number of a public body employee who can answer questions about the collection.

These requirements do not apply if the collection is for a matter covered by subsection 27(3).

Policy

1. If authorized under section 27(1)(a), public bodies may indirectly collect personal information about a person from another person or organization. The indirect collection must still meet the requirements of section 26.

2. Indirect collection of personal information under section 27(1)(c)(i) must be for the purpose of determining the person’s achievements and qualifications prior to awarding the honour or award.

3. (i) When asking the person to consent to the indirect collection of their own personal information under section 27(1)(a)(i), notify the person, in writing, of: 

• the nature of the personal information to be collected;

• the purpose of and reasons for the indirect collection;

• the legal authority for collecting the information;

• the consequences of refusing to authorize the indirect collection; and,

• the person within the public body from whom they may obtain more information about the indirect collection.

(ii) Wherever possible, obtain written authorization from the individual for indirect collection of their personal information.

(iii) If authorization is given verbally, document the conversation and send a letter to the person concerned verifying the consent.

4. Under subsection 27(3)(b) public bodies must seek approval in writing from the minister responsible for this Act prior to any collection of personal information without the notification required in subsection 27(2).

Procedure

1. Before collecting personal information from another source under subsection 27(1)(a)(i), the public body obtains written authorization from the person about whom information is sought or their designate. Such authorization shall take the form of informed consent in compliance with the requirements of Regulation 155/2012, section11.

2. When seeking to indirectly collect personal information under this section 27(1)(a)(ii) public bodies make a request for permission to the Information and Privacy Commissioner in writing. The request should include:

• a description of the type of information to be collected;
• the reasons why the collection is necessary; and,
• the reasons why the information cannot be collected directly.

3. Notifications under section 27(2) must be in writing wherever possible. If notification is done verbally, public bodies should follow up with a written notification to the person concerned. Notification must precede the collection of the information.

4. Notification under section 27(2) must appear on all forms/documents used to collect personal information.

5. During verbal collection, notification under section 27(2) should be given at the beginning of an interview (e.g., at the start of an interview for employment, or investigative audit, before information is obtained orally from members of the public for programs or services, etc.).

6. When informing the individual of the legal authority for collecting the personal information under section 27(2)(b) public bodies must identify:

• the enactment, and specific section under which the program operates (if not specific authority);
• the regulation, order, municipal bylaw, contractual agreement; or
• the duties or obligations at common law that authorizes the collection.  

7. Public bodies that set aside the notification requirements under subsection 27(3)(a) must document instances where personal information has been collected indirectly.

8. To be excused under 27(3)(b) from complying with the notification requirements of section 27(2), a written request must be made to the Minister Responsible for the Act. The request should include:

• a description of the type of information to be collected;
• the reasons why the collection is necessary; and,
• the reasons why the information cannot be collected directly.

Interpretation

Interpretation Note 1 (Subsection 27(1)):

Directly from the individual the information is about

This means that the person to whom the information pertains must provide the information, for example, by completing an application form, responding to questions in an interview (the answers need to be recorded in some way) or writing a letter. 

Interpretation Note 2 (Paragraph 27(1)(a)):

Another Method

This provision means that another person or organization may provide the information about the individual (in an interview or letter, or by electronic means) provided such collection is authorized by the individual, the Commissioner, or by another enactment. The indirect collection must still meet the requirements of section 26 (Purpose for which personal information may be collected).

That individual

A public body may collect personal information about an individual from another source if the person concerned has authorized the collection. See Policy #3 for more details.

The Commissioner under section 42(1)(i)

Section 42(1)(i) of the Act gives the Information and Privacy Commissioner the power to authorize a public body to make indirect collection of personal information. This provision acts to control indirect collections in cases where section 27 does not authorize it. The Commissioner decides how this will be done.

Some Acts and regulations authorize public bodies to make indirect collections of personal information.

Examples

• The Insurance (Motor Vehicle) Act compels medical practitioners to provide the Insurance Corporation of British Columbia with a report of the injuries, diagnosis and treatment of an insured person injured in an accident. The same Act requires employers to provide information on loss of earnings.

• The Vital Statistics Act authorizes indirect collection of the personal particulars of a deceased person from the person's relatives or from other adults present at, or having knowledge of, the person's death.

Interpretation Note 3 (Paragraph 27(1)(b)):

May be disclosed ... under sections 33 to 36

This paragraph permits a public body to collect personal information from a second public body, where the second public body is authorized to disclose the personal information to the first public body under sections 33 to 36. These sections allow the disclosure of personal information in limited and specific circumstances.

This provision reduces the response burden on members of the public where the same personal information may be required by more than one public body. It also reduces the financial costs of collecting personal information by the public bodies that share it.

Interpretation Note 4 (Paragraph 27(1)(c)):

Determining suitability for an honour or award, including an honorary degree, scholarship, prize or bursary

A public body may wish to consider the achievements or qualifications of a number of people for an honour or award before bestowing it on one or several of them. This provision allows the public body to collect personal information about the people under consideration without their knowledge.

Example

• The City of Vancouver considers 25 nominations for Citizen of the Year. Before deciding which person to honour, city officials interview the friends, neighbours and associates of all 25 of the nominees.

A proceeding before a court or a judicial or quasi judicial tribunal

This provision allows public bodies (e.g., Crown prosecutors) to collect personal information indirectly when they require it for court, judicial or quasi-judicial proceedings. This helps to protect the integrity of the judicial process. 

A "proceeding" is a matter, cause or action before a court or tribunal (adapted from the Dictionary of Canadian Law, 1991).

A "court" is an assembly of judges or other persons acting to administer justice in civil and criminal cases.

"Judicial" means of, done by or proper to a court of law; having the function of judgement [OED)]; relating to or connected to the administration of justice [Black's].

A "tribunal" is a body or person that exercises a judicial or quasi-judicial function outside the regular court system (DCL).

A "Judicial tribunal" is a body or person exercising a judicial function outside the regular court system.

Quasi-judicial tribunal

Administrative tribunals (sometimes said to perform a "quasi-judicial" function) are special courts or bodies outside the ordinary judicial framework, generally established under federal or provincial statutes to decide matters that may arise in the administration of some particular area of government (e.g., boards dealing with labour relations, workmen's compensation, public utilities, liquor control or rent review). The required procedures for such tribunals vary greatly.

Generally, quasi-judicial tribunals are under a duty to act in accordance with the rules of natural justice (Dictionary of Canadian Law). A person is acting in a judicial or quasi-judicial capacity if he or she is required to:

• investigate facts, hear all parties to the matters at issue, weigh evidence or draw conclusions as a basis for their action;

• exercise discretion of a judicial nature; and,

• render a decision following the consideration of the issues rather than simply making a recommendation.

The following are some examples of quasi-judicial tribunals:

• Assessment Appeal Board
• Liquor Appeal Board
• Commercial Appeals Commission
• Workers' Compensation Review Board
• Courts of Revision created pursuant to the Assessment Act

Collecting a debt or fine

For section 27(1)(c)(iii), public bodies may collect personal information from other sources when they are collecting a debt or fine but cannot locate the debtors, or believe they would not obtain accurate information needed to collect the debt from the persons concerned.

Example (collecting a debt):

• A public body might approach a bank manager for information on the state of a person's bank account. The public body needs to know if the person is being truthful when he or she says that garnishment of his/her account to collect a debt would cause undue hardship.

Making a payment

When public bodies cannot locate people to whom they must make a payment, they may approach others to obtain enough information to locate such people. This provision of the Act allows public bodies to collect personal information by indirect means in order to pay money owed.

Example (making a payment):

• A public body determines that the vacation payment for a terminated employee was incorrectly calculated and cannot locate the employee to pay the balance owing. It contacts the neighbours of the former employee to find out if they have a forwarding address for this person. If the neighbours know the new address, the public body is permitted to collect it in order to pay the former employee the money.

Law enforcement

"Law enforcement" is defined in Schedule 1 of the Act as

(a)  policing, including criminal intelligence operations,

(b)  investigations that lead or could lead to a penalty or sanction being imposed, or

(c) proceedings that lead or could lead to a penalty or sanction being imposed."

Much or all of the personal information about a person who is under investigation is collected from other sources, for a number of reasons: investigators do not wish to alert the person concerned that an investigation is taking place; the person would not provide accurate information; the person concerned would likely destroy evidence.

Example

• A police officer investigating a break and enter crime might approach a confidential source or a contact on another police force for assistance in compiling evidence against the alleged thief.

Interpretation Note 5 (Paragraph 27(2)):

Must tell

The Act imposes an obligation on public bodies to notify individuals of the purpose for which they are collecting information, the authority for the collection and the title, business address and business telephone number of a public body employee who can answer questions about the collection.

This notification should be in writing wherever possible. If notification is done verbally, public bodies should follow up with a written notification to the person to whom the information pertains.

The requirement to notify recognizes the person's right to know and understand the purpose of the collection and how the information will be used. It also allows the person to make an informed decision as to whether or not to give the information in cases where a response is not mandatory (e.g., during a survey on a public body's services).

An individual from whom it collects

The requirements for notification apply to direct and indirect collections of personal information. That is:

• The person to whom the information pertains must be notified of the purpose of the collection, the authority for the collection and the title, business address and business telephone number of an employee of the public body who can answer questions about the collection; and

• Where one person is asked for personal information about another person (indirect collection), the first person must also be informed of the purpose and authority for the collection of personal information about the second person, as well as the title, business address and business telephone number of a public body employee who can answer questions about the collection.

Interpretation Note 6 (Paragraph 27(2)(b)):

Legal authority

This provision promotes people's awareness of the reasons for which public bodies collect personal information by requiring that they be informed of the "legal authority" for requesting the information. It also discourages public bodies from collecting personal information needlessly, or without authority.

The legal authority encompasses federal and provincial Acts, regulations, orders, municipal bylaws, contractual agreements and other duties or obligations at common law.

Interpretation Note 7 (Paragraph 27(2)(c)):

Answer the individual's questions about the collection

The officer or employee designated to answer the individual's questions about the collection of personal information should be familiar with the program area which uses the information. This officer or employee must be able to explain why the personal information is being collected and how it will be used, retained and disclosed to other organizations, or at a minimum, be able to redirect the individual to those other employees and officers of the public body who would be best able to answer the individual’s questions.

Interpretation Note 8 (Paragraph 27(3)):

Subsection (2) does not apply if

The requirements of subsection 27(2) may be set aside if the collection meets one of the three criteria discussed below. Few collections meet these strict criteria.

Interpretation Note 9 (Paragraph 27(3)(a)):

Law enforcement or anything referred to in section 15(1) or (2)

Paragraph 27(3)(a) permits public bodies to set aside the notification requirements when they are collecting personal information that they need for law enforcement purposes or for any matter referred to in subsection 15(1) or (2) of the Act.

Law enforcement officials usually do not reveal the fact that an investigation is currently underway, information on the targets of their investigations nor the extent of the information they have gathered. Sometimes, even acknowledging the existence of an investigation to the subject could harm law enforcement. Thus, law enforcement officials are not subject to the same obligations to inform respondents as other public bodies.

This exemption from the notification requirements recognizes the fact that law enforcement officials, in particular, may have difficulty in obtaining accurate personal information about persons they are investigating if the person from whom the information is collected is informed of the reasons for collection.

See section 15 of the manual for a detailed discussion of the definition of "law enforcement" and the protection of law enforcement information.

Interpretation Note 10 (Paragraph 27(3)(b)):

Excuses a public body from complying

This provision ensures that the requirement to notify is waived as seldom as possible and that decisions to waive notification are subjected to scrutiny by an impartial body.

Defeat the purpose of the collection or prejudice the use

This provision acknowledges the fact that, in some cases, informing the person of the purpose of the collection would negate or hinder the program or activity for which the information is collected.

Example

• A survey firm might not reveal the purpose of the survey if such knowledge could influence the way respondents answered the survey questions and thereby distort the results.

• A psychologist might not inform test subjects of the purpose of various psychological tests if it could lead them to give less spontaneous or less truthful answers and skew the results of the tests.

Sectional Index of Commissioner's Orders

For orders organized by the Act's section numbers, Click here.

For a summary of Commissioner's orders and policy interpretation of key points, Click here.

Last updated: July 19, 2007