Vol. 145, No. 25 — December 7, 2011
SOR/2011-265 November 17, 2011
PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT
Personal Health Information Custodians in New Brunswick Exemption Order
P.C. 2011-1319 November 17, 2011
Whereas the Governor in Council is satisfied that the Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, of New Brunswick, which is substantially similar to Part 1 of the Personal Information Protection and Electronic Documents Act (see footnote a), applies to the personal health information custodians referred to in the annexed Order;
Therefore, His Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to paragraph 26(2)(b) of the Personal Information Protection and Electronic Documents Act (see footnote b), hereby makes the annexed Personal Health Information Custodians in New Brunswick Exemption Order.
PERSONAL HEALTH INFORMATION CUSTODIANS IN NEW BRUNSWICK EXEMPTION ORDER
1. Any personal health information custodian to which the Personal Health Information Privacy and Access Act, S.N.B. 2009, c. P-7.05, applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act in respect of the collection, use and disclosure of personal health information that occurs in New Brunswick.
COMING INTO FORCE
2. This Order comes into force on the day on which it is registered.
(This statement is not part of the Order.)
Issue and objectives
The Order in Council will specify that the New Brunswick Personal Health Information Privacy and Access Act (PHIPAA) is substantially similar to the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Part 1 of PIPEDA establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. On January 1, 2004, PIPEDA’s reach extended to all collections, uses and disclosures of personal information in the course of commercial activity, either within or outside a province. Pursuant to paragraph 26(2)(b), the Governor in Council may, by order, if satisfied that legislation of a province that is substantially similar to PIPEDA applies to an organization, a class of organizations, an activity or class of activities, exempt the organization, activity or class from the application of PIPEDA in respect of collection, use and disclosure of personal information within the province.
The PHIPAA recently came into force in New Brunswick (September 10, 2010). The province has requested from the Minister of Industry recognition that PHIPAA is substantially similar to PIPEDA.
The objective of this Order in Council is to exempt from the application of Part 1 of PIPEDA all personal health information custodians to whom the PHIPAA is applicable, in respect of the collection, use and disclosure of personal information that occurs within the province of New Brunswick in the course of commercial activity.
Personal health information custodians subject to the New Brunswick PHIPAA collect, disclose and maintain that information for the purpose of providing or assisting in the provision of health care or treatment or the planning and managing of the health care system. This includes public bodies, health care providers, the Minister, government agencies (such as Ambulance New Brunswick Inc.), the New Brunswick Health Council, regional health authorities, information managers and persons designated in future as a custodian under the PHIPAA.
Description and rationale
PIPEDA establishes a set of economy-wide principles and rules for the protection of personal information collected, used or disclosed in the course of commercial activity. PIPEDA helps to build trust and confidence in the Canadian marketplace, while encouraging provinces and territories to develop their own privacy laws in a manner that addresses their particular needs and circumstances. To this end, the Government of Canada included provisions in PIPEDA to exempt organizations or activities subject to provincial or territorial laws that are deemed to be substantially similar. Until this exemption is granted, PIPEDA applies in all provinces and territories.
In August 2002, Industry Canada published the policy and criteria used to determine whether provincial or territorial legislation would be considered as substantially similar. PIPEDA provides a standard around which provinces can legislate. Under the policy, laws that are substantially similar
- provide privacy protection that is consistent with and equivalent to that in PIPEDA;
- incorporate the 10 principles in the National Standard of Canada entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96, found in Schedule 1 of PIPEDA;
- provide for an independent and effective oversight and redress mechanism with powers to investigate; and
- restrict the collection, use and disclosure of personal information to purposes that are appropriate or legitimate.
In recognizing such laws as substantially similar, PIPEDA provides a common standard for privacy protection across both federal and provincial domains. Where federal and provincial territorial regimes for the protection of personal information are in alignment, it ensures that organizations may be subject to a single set of rules throughout the marketplace. Such a regime also provides assurances to individuals that, regardless of where they are located, their personal information will be given the same level of protection.
PIPEDA will continue to apply to the collection, use and disclosure of personal health information outside the province, in the course of commercial activity. It will also apply to personal health information collected, used or disclosed by non-custodians. Agents of health information custodians, who are brought within the purview of the PHIPAA in section 52, would also be included.
Provincial and territorial governments, along with the general public, the health-care sector and the business community, have long been aware of the federal government’s commitment to exempt from PIPEDA organizations subject to provincial/territorial laws that are substantially similar to PIPEDA. The legislation has been in place since 2000. Quebec (2000), Alberta and British Columbia (2004), and Ontario (2005 for health custodians only) have been granted exemptions. Information was also provided to the general public when Industry Canada published its policy and criteria for determining substantially similar provincial and territorial legislation in Part Ⅰ of the Canada Gazette on August 3, 2002.
On March 11, 2011, the New Brunswick Order-in-Council was published in the Canada Gazette, Part Ⅰ, for a consultation period of 30 days. No comments were received and consequently no changes were made to the Order.
Implementation, enforcement and service standards
As an independent Officer of Parliament, working independently from the government, the Privacy Commissioner of Canada investigates complaints from individuals with respect to the information-handling practices or organizations engaged in commercial activity. The Commissioner may investigate all complaints under section 12 of PIPEDA, except those pertaining to organizations subject to privacy laws that have been deemed substantially similar to PIPEDA, namely Quebec, British Columbia, and Alberta. Ontario falls into this category with respect to personal health information held by health information custodians under its health sector privacy law. PIPEDA continues to apply to the collection, use or disclosure by federal works, undertakings and businesses, including personal information about their employees. PIPEDA also continues to apply to the collection, use and disclosure of personal information across provincial or national borders, in the course of commercial activity involving organizations subject to PIPEDA or to substantially similar provincial legislation. Complaints in respect of these applications of PIPEDA are also investigated by the Privacy Commissioner of Canada.
The Commissioner focuses on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. In conducting investigations, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. The Commissioner or a complainant may take any matter related to a complaint to the Federal Court, which has the power to order an organization to change its practices and award damages to the aggrieved.
Electronic Commerce Policy
300 Slater Street, 18th Floor
S.C. 2000, c. 5
S.C. 2000, c. 5