More topics

Section 26 - Purpose for which personal information may be collected

Last updated on January 26, 2024

Overview

Section 26 states that personal information may be collected only if such collection is authorized by or under legislation, essential for operating programs or activities, or collected for law enforcement purposes.

Section Reference

Section 26 of the  Freedom of Information and Protection of Privacy Act

No personal information may be collected by or for a public body unless

(a) the collection of that information is expressly authorized by or under an Act,

(b) that information is collected for the purposes of law enforcement, or

(c) that information relates directly to and is necessary for an operating program or activity of the public body.

Summary

Section 26 recognizes a public body's need to collect personal information in order to carry out its mandate and to provide services, but restricts that collection to a defined set of purposes.

Section 26 applies to information collected for a public body by a third party (i.e., a contractor) as well as to information collected by the public body itself.

Policy

  1. No personal information shall be collected by or for a public body unless one of the criteria in section 26(a) to (c) is satisfied.

  2. Public bodies shall ensure that the minimum amount of personal information necessary is collected for purposes permitted under section 26.

  3. Where an outside organization or contractor is collecting the personal information on behalf of a public body, the contract or agreement shall prescribe those records over which the public body retains custody or control.

Procedure

  1. Before collecting personal information, ensure that one of the three criteria set out in paragraphs 26(a) to (c) are met.

  2. Determine the minimum amount of personal information needed to administer a program during the design of forms, questionnaires or other collection instruments.

    Public bodies may establish internal procedures for:

  • the review of forms which collect personal information;
  • the evaluation of opinion polls;
  • the review of contracts for services involving the collection of personal information;
  • the review of policy manuals; and,
  • the regulation of other activities which entail the collection of personal information.

Additionally, the public body may conduct a Privacy Impact Assessment by completing the Privacy Impact Assessment Process to determine if personal information is being managed in accordance with the Act.

Interpretation

Interpretation Note 1:

Public bodies should have administrative controls in place to ensure that they collect the minimum amount of personal information necessary for purposes permitted under section 26. For example, they may establish internal procedures for the review of forms which collect personal information, the evaluation of opinion polls, the review of contracts for services involving the collection of personal information, the review of policy manuals and other activities which entail the collection of personal information.

"Collected"

Examples

  • Methods for collection may include interviews, questionnaires, surveys, polls, forms, telephone calls or letters.

  • Means of collection may include writing, audio or video taping, electronic tapes or disks and other non-textual media.

  • Collection may include the receipt of unsolicited information, such as from an applicant for a job with the provincial government or from an applicant for housing.

"By or for"

The public body may do its own collection or may authorize an outside agent to carry out the collection on its behalf, either under contract or through an agreement or arrangement with the other agency. Such an agreement or arrangement should be in writing.

Examples of collection by a public body

  • A Ministry carries out its own collection of personal information from applicants for social assistance.

  • A university collects personal information from students and faculty for the purposes of issuing parking permits.

Examples of collection for a public body

  • A private firm may be contracted by a Ministry to survey its social assistance clients for their opinions on the service they have received from the Ministry.

  • A Ministry contracts with societies to provide a variety of community health services such as the Nursing Respite Program, Alcohol and Drug Programs and Services to the Handicapped - At Home Program. These societies collect personal information directly from the clients to perform those services.

Interpretation Note 2 (Section 26(a)):

"Expressly authorized by or under an Act"

The collection of personal information may be expressly authorized by an Act if the Act specifies particular data elements that can or must be collected.

Example of authority for collecting specific personal information

  • Where the holder of a driver's licence issued under the Motor Vehicle Act changes her/his name, that Act requires the driver to notify the superintendent, in writing, of the former name and the new name.

The collection of personal information may be expressly authorized under an Act if the Act simply gives authority for a particular program. This is implied authority under an Act for the collection of personal information for the purpose of subsection 26(a).

Public bodies must then determine the minimal amount of personal information they need to be able to administer the program for the design of forms, questionnaires or other collection instruments.

Example of authority for a program for which personal information is needed

  • The Insurance (Motor Vehicle) Act gives the Insurance Corporation of British Columbia (ICBC) the authority to require an insured driver to provide the necessary reports and statements to make or approve a claim. ICBC determines the specific personal information it needs for those reports and statements.

Interpretation Note 3 (Section 26(b)):

Law enforcement

"Law enforcement"

Paragraph 26(b) acknowledges the fact that, for the purposes of law enforcement, public bodies must in some circumstances engage in wide-ranging information collections which are broader than allowed by paragraph 26(c). It would be difficult or impossible for a public body to show, at the moment of collection, how each and every piece of enforcement-related information "relates directly to" or "is necessary for" a public body's operating program or activity. The meaning or value of such personal information may only become evident years after its collection.

See section 15 (Disclosure harmful to law enforcement) for more details.

Examples

  • A public body may collect background information on a group of individuals suspected of advocating violence for the purpose of policing or for an investigation or proceeding that leads or could lead to a penalty or sanction being imposed.

  • The B.C. Securities Commission may do an investigation to determine whether or not a charge should be laid under the Securities Act. Even if the investigation reveals that there is not sufficient evidence to proceed, that investigation would fall under the definition of law enforcement.

Interpretation Note 4 (Section 26(c)):

Relates directly to and is necessary for

Public bodies should note that the word "and" between "relates directly to" and is "necessary for" in this phrase indicates that both conditions must be met before a collection of personal information can be made under this section. Such a strict definition requires public bodies to make a narrow interpretation of their need to collect personal information.

To "relate directly to", the information must have a direct bearing on the program or activity.

Examples

  • An applicant's work history is directly related to the assessment of that person's qualifications against the basic requirements of a job. Such information may be collected for use in screening applications to determine which applicants should be shortlisted for a competition.

  • The same person's background might include recreational activities and courses taken for personal interest which are not related to the requirements for the job. The public body should not collect this information on its application forms, even though an applicant's resume may contain such information.

Necessary for

The public body must have a demonstrable need for the information such that the operating program or activity would not be viable without it.

Examples

  • All provincial government ministries must collect personal information from current and potential employees in order to monitor their progress in complying with the government's stated objective of achieving employment equity. Ministries may collect this information under the Act regardless of the fact that there is no express statutory authorization for the collection.

  • Information on the income and assets of an applicant for social assistance is needed by the public body to determine if the person is eligible for assistance.

 "Operating program"

Examples 

  • The Guaranteed Available Income for Need (GAIN) program.
  • The driver licensing program.
  • The regulation of recreational fishing.
  • Kidney dialysis services.
  • Youth court services.
  • Public health protection.

"Activity" is an individual action designed to assist in carrying out an operating program.

Examples

  • Skills training assists a social assistance recipient to return to the workforce and is one facet of the social assistance program.

  • Driver testing is required in determining eligibility for a driver's licence as part of the driver licensing program.

Sectional Index of Commissioner's Orders

For orders organized by the Act's section numbers, Click here.

Last updated: July 18, 2007