Vol. 146, No. 21 — October 10, 2012

Registration

SI/2012-72 October 10, 2012

PERSONAL INFORMATION PROTECTION AND ELECTRONIC DOCUMENTS ACT

Personal Health Information Custodians in Newfoundland and Labrador Exemption Order

P.C. 2012-1091 September 20, 2012

Whereas the Governor in Council is satisfied that the Personal Health Information Act, SNL 2008, c P-7.01, of Newfoundland and Labrador, which is substantially similar to Part 1 of the Personal Information Protection and Electronic Documents Act (see footnote a), applies to the personal health information custodians referred to in the annexed Order;

Therefore, His Excellency the Governor General in Council, on the recommendation of the Minister of Industry, pursuant to paragraph 26(2)(b) of the Personal Information Protection and Electronic Documents Act (see footnote b), hereby makes the annexed Personal Health Information Custodians in Newfoundland and Labrador Exemption Order.

PERSONAL HEALTH INFORMATION CUSTODIANS IN NEWFOUNDLAND AND LABRADOR EXEMPTION ORDER

EXEMPTION

1. Any personal health information custodian to which the Personal Health Information Act, SNL 2008, c P-7.01, applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act in respect of the collection, use and disclosure of personal health information that occurs in Newfoundland and Labrador.

COMING INTO FORCE

2. This Order comes into force on the day on which it is registered.

REGULATORY IMPACT ANALYSIS STATEMENT

(This statement is not part of the Order.)

Issue and objectives

Part 1 of the federal Personal Information Protection and Electronic Documents Act (PIPEDA) establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. On January 1, 2004, PIPEDA’s reach extended to all collections, uses and disclosures of personal information in the course of commercial activity, either within or outside a province. Pursuant to paragraph 26(2)(b), the Governor in Council may, by order, if satisfied that legislation of a province that is substantially similar to PIPEDA applies to an organization, a class of organizations, an activity or class of activities, exempt the organization, activity or class from the application of PIPEDA in respect of collection, use and disclosure of personal information within the province.

On February 15, 2010, the Province requested, from the Minister of Industry, recognition that the Newfoundland and Labrador Personal Health Information Act (PHIA) is substantially similar to PIPEDA. The regulatory process to obtain the Order in Council, for any province, cannot begin until the provincial law is in force. The PHIA recently came into force in Newfoundland and Labrador, on April 1, 2011. (see footnote 1)

Personal health information custodians subject to the Newfoundland and Labrador PHIA collect, use and disclose that information for the delivery or administration of health care in the province [PHIA, paragraph 4(1)(c)]. Such custodians include public bodies, health care providers, government agencies (such as the Centre for Health Information), the Newfoundland and Labrador Health Council, persons who operate health care facilities, pharmacies, ambulance services or a centre, program or service for community or mental health through which health care is provided by a health care professional or provider.

The objective of this Order is to recognize the Newfoundland and Labrador PHIA as substantially similar to PIPEDA and provide a common standard for privacy protection across both federal and provincial domains. Where federal, provincial and territorial regimes for the protection of personal information are in alignment, it ensures that organizations may be subject to a single set of rules throughout the marketplace. Such a regime also provides assurances to individuals that, regardless of where they are located, their personal information will be given the same level of protection.

Description and rationale

The proposed Order in Council specifies that the Newfoundland and Labrador PHIA is substantially similar to PIPEDA. More specifically, it exempts from the application of Part 1 of PIPEDA all personal health information custodians to whom the PHIA is applicable, in respect of the collection, use and disclosure of personal information that occurs within the province of Newfoundland and Labrador in the course of commercial activity.

PIPEDA will continue to apply to the collection, use and disclosure of personal health information outside the province in the course of commercial activity. It will also apply to personal health information collected, used or disclosed by non-custodians. Agents of health information custodians, who are brought within the purview of the PHIA in section 52, would also be included in the PIPEDA exemption.

PIPEDA establishes a set of economy-wide principles and rules for the protection of personal information collected, used or disclosed in the course of commercial activity. PIPEDA helps to build trust and confidence in the Canadian marketplace, while encouraging provinces and territories to develop their own privacy laws in a manner that addresses their particular needs and circumstances. To this end, the Government of Canada included provisions in PIPEDA to exempt organizations or activities subject to provincial or territorial laws that are deemed to be substantially similar. Until this exemption is granted, PIPEDA applies within provinces and territories.

In August 2002, (see footnote 2) Industry Canada published the policy and criteria used to determine whether provincial or territorial legislation would be considered as substantially similar. PIPEDA provides a standard around which provinces may wish to legislate. Under the policy, laws that are substantially similar

• provide privacy protection that is consistent with and equivalent to that in PIPEDA;
• incorporate the 10 principles in the National Standard of Canada entitled Model Code for the Protection of Personal Information, CAN\CSA-Q830-96, found in Schedule 1 of PIPEDA;
• provide for an independent and effective oversight and redress mechanism with powers to investigate; and
• restrict the collection, use and disclosure of personal information to purposes that are appropriate or legitimate.

The Newfoundland and Labrador PHIA has been assessed against these criteria and it has been deemed to be substantially similar to PIPEDA.

Consultation

Provincial and territorial governments, along with the general public, the health care sector and the business community, have long been aware of the federal government’s commitment to exempt from PIPEDA organizations subject to provincial/territorial laws that are substantially similar to PIPEDA. The legislation has been in place since 2000. Quebec (2000), Alberta (2004), British Columbia (2004), Ontario (2005, for health custodians only) and New Brunswick (2011, for health custodians only) have been granted exemptions. Information was also provided to the general public when Industry Canada published its policy and criteria for determining substantially similar provincial and territorial legislation in the Canada Gazette, Part Ⅰ, on August 3, 2002. (see footnote 3)

The proposed Order declaring the PHIA substantially similar to PIPEDA was prepublished in the Canada Gazette, Part Ⅰ, on March 24, 2012, followed by a 30-day comment period. No comments were received following the Part Ⅰ publication.

Implementation, enforcement and service standards

As an independent officer of Parliament, working independently from the government, the Privacy Commissioner of Canada investigates complaints from individuals with respect to the information-handling practices or organizations engaged in commercial activity. The Commissioner may investigate all complaints under section 12 of PIPEDA, except those pertaining to organizations subject to privacy laws that have been deemed substantially similar to PIPEDA, namely Quebec, British Columbia, Alberta, Ontario and New Brunswick, with respect to personal health information held by health information custodians under Ontario’s and New Brunswick’s health sector privacy laws. PIPEDA continues to apply to the collection, use or disclosure of personal information by federal works, undertakings and businesses, including personal information about their employees. PIPEDA also continues to apply to the collection, use and disclosure of personal information across provincial or national borders, in the course of commercial activity involving organizations subject to PIPEDA or to substantially similar provincial legislation. Complaints in respect of these applications of PIPEDA are also investigated by the Privacy Commissioner of Canada.

The Commissioner focuses on resolving complaints through negotiation and persuasion, using mediation and conciliation if appropriate. In conducting investigations, the Commissioner has the power to summon witnesses, administer oaths and compel the production of evidence. The Commissioner or a complainant may take any matter related to a complaint to the Federal Court, which has the power to order an organization to change its practices and award damages to the aggrieved.

Contact

Bruce Wallace
Director
Security and Privacy Policy
Digital Policy Branch
Industry Canada
300 Slater Street, 18th Floor
Ottawa, Ontario
K1A 0C8
Telephone: 613-949-4759
Fax: 613-941-1164
Email: Bruce.Wallace@ic.gc.ca

Footnote a
 S.C. 2000, c. 5

Footnote b
 S.C. 2000, c. 5

Footnote 1
 http://assembly.nl.ca/Legislation/sr/statutes/p07-01.htm

Footnote 2
 www.gazette.gc.ca/rp-pr/p1/2002/2002-08-03/html/notice-avis-eng.html

Footnote 3
 Ibid.