Non-personal data

Overview

The Protection of Privacy Act (POPA) defines non-personal data that includes data derived from personal information, that has been generated, modified, or anonymized so that it does not identify any individual.

Creation of non-personal data

A public body may create non-personal data for only one or more of the following purposes:

• research and analysis
• planning, administering, delivering, managing, monitoring or evaluating a program or services
• One or more prescribed purposes identified in the regulations

Each time non-personal data is created, a public body must maintain a record which includes a description of the personal information or data derived from the personal information used.

The public body must also ensure that the identity of the individual who is the subject of the non-personal data cannot be identified or re-identified from the data.

Additional requirements are prescribed in the regulation, including public bodies must establish a data quality assurance process.

Use of non-personal data

Non-personal data may be used for any reason so long as the purpose(s) for creation, as outlined in POPA, are met.

Disclosure of non-personal data

So long as the creation of non-personal data was created for the purposes outlined in POPA, a public body may disclose non-personal data:

• to another public body for any purpose
• to a person other than a public body only if:
  • the disclosure supports research, analysis, or the planning, delivery, or evaluation of a program or service
• the head of the public body has approved based on the following conditions:
  • security and confidentiality
  • prohibition of actual or attempted re-identification of non-personal data
  • prohibition of further use or disclosure without express authorization
  • timely destruction of non-personal data unless otherwise authorized

The intent of POPA is not to limit a public body’s ability to report, summarize or release statistical or aggregate data.

Disclaimer

All persons reviewing Technology and Innovation’s Protection of Privacy Act site are reminded that it has no legislative sanction and has been provided for guidance and convenience of reference only. The official Statutes and Regulations should be consulted for all purposes of interpreting and applying the law.