Section 31 - Retention of personal information

Overview

Section 31 requires public bodies to keep personal information for at least one year (longer periods are permitted) wherever public bodies have used that information in a way that has an impact on an individual’s life.

Section Reference

Section 31 of the Freedom of Information and Protection of Privacy Act

31 If an individual’s personal information

(a) is in the custody or under the control of a public body, and

(b) is used by or on behalf of the public body to make a decision that directly affects the individual,

the public body must ensure that the personal information is retained for at least one year after being used so that the affected individual has a reasonable opportunity to obtain access to that personal information.

Summary

Section 31 requires public bodies or persons acting on their behalf are required to retain record(s) containing personal information for at least one year after using the record(s) to make a decision about an individual in a way that has an impact on that individual’s life. This is to allow the individual a reasonable opportunity to access this information under section 5 (How to make a request) of the Act.

Policy

1. If a public body or person acting on behalf of a public body uses an individual’s personal information to make a decision, which directly affects that individual, it must retain that information for at least one year after using it.

2. Public bodies governed by the Document Disposal Act must obtain authorization from the government records retention and disposition authority prior to disposal of any records.

3. Public bodies should ensure their record retention and disposal schedules include a retention period for surveillance videotapes and other non-written recorded personal information, where applicable.

4. If it is the policy within a public body that unsolicited resumes are not considered, the retention requirements of section 31 do not apply to resumes received in that fashion.

5. If the public body receives a request for access to personal information during the one-year retention period, the personal information requested must be retained for at least one year beyond the date on which the access request was closed. If the applicant receives a copy of the information and subsequently asks the Information and Privacy Commissioner to review the public body’s decision on disclosure, the information must be retained for at least one year from the date on which the Commissioner makes a finding.

Procedure

1. Public bodies or persons acting on their behalf should place a note to file or some form of annotation on an individual’s record indicating the date a decision was made – that directly affected the individual - based on the personal information contained in the record.

2. If a public body or persons acting on its behalf does not use the personal information to make a decision directly affecting the individual, the Act does not require the personal information to be retained. Disposal may occur in accordance with regular retention regulations for the public body.

   Example

• If a public body or persons acting on its behalf uses personal client information to evaluate program effectiveness within a target demographic and does not subsequently use that information to affect an individual, then the retention requirements of section 31 do not apply. The retention requirements of the Document Disposal Act still apply to this information however, and disposal activities must be in accordance with approved disposal schedules.

3. In cases where information has been used solely for research or statistical purposes and where no decision, adverse or otherwise, has been made about the respondents, section 31 does not apply.

   Example

• Personal information gathered in a survey is used to study trends or gather opinions. The personal information is usually rendered anonymous and rolled up into an aggregate form. In these cases, the questionnaires or other collection instruments may be destroyed as soon as the desired information has been extracted, according to the requirements of the Document Disposal Act.

4. Public bodies subject to the Document Disposal Act should determine what obligations they may have under that act. Retention and disposition schedules established under the Document Disposal Act may apply. This section specifies the minimum period of time that personal information must be retained. It does not excuse public bodies from any longer retention period that may be required.

Interpretation

Interpretation Note 1:

"Makes a decision"

A public body or persons acting on its behalf "makes a decision" about a person when it uses personal information in its custody or under its control in some way that has an effect on the person concerned, for example, to determine whether or not a person is qualified for a job or entitled to a benefit or to a service.

Examples

• A Ministry uses personal information on a person's income and assets to decide if the person is eligible for social assistance.

• The Motor Vehicle Branch uses personal information on a person's driving skill and performance to decide if the person qualifies for a driver's license.

• A hospital uses personal information about a patient to determine the level and type of care to give the person.

• A public body uses an individual's resume and references to determine whether the individual is qualified for an employment position.

Interpretation Note 2:

Retention

To "retain" personal information is to keep control or custody of it, to maintain possession of it. Section 31 instructs public bodies or persons acting on their behalf to retain personal information, which means not disposing of it in any way for at least one year. This requirement gives people time to exercise their right of access to their personal information.

Retention of records for public bodies under the Document Disposal Act is controlled by retention and disposition schedules approved under that Act.

Longer retention permitted

Public bodies or persons acting on their behalf may keep personal information longer than one year, depending on their operational needs and as determined in approved retention and disposal schedules. Public bodies or persons acting on their behalf should not, however, retain personal information indefinitely as this increases the potential that out-of-date and incomplete information would be available for use. The opportunities for unauthorized access or disclosure would also increase.

Scheduling of records

Each public body subject to the Document Disposal Act should schedule all personal information for retention and disposal in accordance with applicable policies and standards.

Storage elsewhere

Section 31 does not prevent the public body or persons acting on its behalf from storing personal information in another location for the retention period, as long as it can retrieve the information readily to respond to a request for access.

A "reasonable opportunity" is a chance [to obtain access] that is within the limits of reason or which is suitable under the circumstances.

The Act recognizes that people may not request access to their personal information immediately upon being informed of a decision that affects them. At the same time, the Act does not oblige public bodies to keep large quantities of personal information for excessive periods, with all the problems such indefinite retention would entail.

Sectional Index of Commissioner's Orders

For orders organized by the Act's section numbers, Click here.

For a summary of Commissioner's orders and policy interpretation of key points, Click here.

Last updated: July 20, 2007