Using personal information

Consent

Types of consent

A person can consent to the collection, use or disclosure of personal information for reasonable purposes (which is what a reasonable person would consider appropriate under the circumstances).

Someone may consent verbally or in writing, including via electronic communications.

Someone is ‘deemed to consent’ if he or she, without actually giving consent, voluntarily provides the information to the organization and it is reasonable for that purpose. This is also called ‘implied consent’.

Someone can also consent if they do not ‘opt out’ in a reasonable time when he or she receives clear and understandable notification and is given a reasonable opportunity to decline by the organization.

Even if an organization gets consent, it can only collect, use, or disclose personal information for the purposes provided in the notice and to the extent reasonable for that purpose. An organization may not provide false or misleading information in its notice.

Withdraw or change consent

Individuals have the right to withdraw or change their consent, subject to legal limitations. As soon as an organization is notified of this, the organization must inform the individual of the likely consequences it they are not obvious.

If a person changes his or her consent, the organization must abide by the new terms of consent. If the person withdraws his or her consent the organization must stop collecting, using or disclosing his or her personal information immediately.

Use with consent

An organization may use personal information only with the individual’s consent except in the limited circumstances where use without consent is allowed.

Use without consent

There are limited circumstances where information can be used without consent:

• it is clearly in the person’s interests and
  • that person’s consent cannot be obtained in a timely way, or
  • that person would not reasonably be expected to withhold consent
• there is a legal authority for the use
  • it is authorized by a statute of Alberta or Canada, a regulation of Alberta or Canada, a bylaw of a local government body, or a legislative instrument of a professional regulatory organization
  • it is in accordance with a form provided under a statute or regulation of Alberta
• if it is for a collective agreement
  • the use of information is necessary to comply with a collective agreement that is binding on the organization under section 128 of the Labour Relations Code
• it is for an inspection or audit
  • if the audit is either of or by the organization and is authorized by a statute or regulation of Alberta or Canada
  • if it’s by another organization and it’s not practical to use non-identifying information for the purpose of the audit
• it is for an investigation or legal proceeding
  • it is reasonable for the purposes of an investigation or legal proceeding
• the information is publicly available, as prescribed in the regulations:
  • the information is contained in a telephone directory available to the public and the subscriber can refuse to have the personal information appear in the directory
  • the information is business contact information
  • the information is contained in a registry
  • the information in contained in a public record of a quasi-judicial body and is being collected for a purpose for which the record was created
  • the information is in a publication and it is reasonable to assume the individual provided that information to the publication
• when the information may be disclosed by an organization without consent
  • if the information may be disclosed by an organization without the consent of the individual under section 20: Disclosing Information
• it is for an award, honour, benefit, scholarship or similar prize
  • it is necessary to determine a person’s suitability to receive an honour, award or similar benefit, including an honorary degree, scholarship or bursary
• it is to create a credit report
  • if a credit reporting organization was permitted to collect the information and the credit reporting organization only uses the information to create a credit report
• it is to collect or pay a debt
  • it is necessary to collect a debt owed to the organization
  • it is necessary to pay a debt owed by the organization to the person
• it is for an emergency
  • it is necessary to respond to an emergency that threatens the life, health, or security of a person or the public
• it is for archival or research purposes
  • the organization using the information is an archival institution and the use of the information is reasonable for archival purposes or research
  • the use of the information meets the requirements respecting archival purposes or research set out in the regulations and it isn’t reasonable to obtain the consent of the individual the information is about
• it is in accordance with section 22: PIPA’s disclosure respecting acquisition of a business
  • an organization may use personal information on a limited basis with other organizations for the purposes of a business transaction
• it is by a trade union relating to a labour relations dispute
  • the use is for the purpose of informing or persuading the public about a matter of significant interest or importance relating to a labour relations dispute involving the trade union,
  • the use is reasonably necessary for that purpose, and
  • it is reasonable to use without consent considering all relevant circumstances including the nature and sensitivity of the information