On October 7, 2004, the BC Government introduced Bill 73 amending the Freedom of Information and Protection of Privacy Act (“FOIPPA”). Bill 73 is at the first reading stage. To date the Government has not indicated when the legislation may become law.
The recently introduced U.S. Patriots Act may give the United States broad access to personal information held by Canadian corporations having an American parent or subsidiary company, without obtaining prior consent. Bill 73 establishes new privacy provisions which are intended to limit the impact of this anti-terrorism legislation on public bodies in the Province of BC.
Bill 73 establishes new restrictions on public bodies and service providers regarding the storing, access or disclosure of personal information outside Canada. The proposed legislation also extends existing restrictions that apply to public bodies, public employees, service providers and employees and associates of service providers.
In addition, the amendments require public bodies and service providers to report to the BC Government any foreign demand for the unauthorized disclosure of personal information to which the FOIPPA applies. The legislation also protects an employee reporting a foreign demand for disclosure, or a potential contravention of the FOIPPA, from sanction by his or her employer. Bill 73 creates offences for violation of the new provisions, including fines of up to $2,000 for an individual, up to $25,000 for a partnership or individual service provider and up to $500,000 for a corporation.
The proposed legislation also amends or adds several definitions in the FOIPPA. For example, “service provider” is broadly defined as “a person retained under a contract to perform services for a public body”. The definition of “employee” in relation to a public body is expanded to include volunteers and service providers. These expanded definitions may increase the responsibilities of employers subject to the FOIPPA in dealing with personal information in their custody or control. Finally, the definition of “personal information” is amended to exclude “contact information”, defined as “information to enable an individual at a place of business to be contacted” including name, position, business telephone, address, email or fax. The exclusion of business contact information is consistent with the definition of “personal information” under provincial private sector privacy legislation, the Personal Information Protection Act.