Human Resources Legislative Update

Guidance for Organizations Sharing Information for Investigation/Fraud Purposes Issued by OPC

Human Resources Legislative Update

Guidance for Organizations Sharing Information for Investigation/Fraud Purposes Issued by OPC

Date: April 3, 2017

The Office of the Privacy Commissioner of Canada (OPC) recently provided guidance on the new provisions of the Personal Information Protection and Electronic Documents Act (PIPEDA) that allow organizations to share information for investigation and fraud prevention purposes.

The amendments, in force since 2015, give organizations significant flexibility to address cyber-crime and fraud by allowing them to disclose personal information without the knowledge or consent of an individual to another organization in certain circumstances. Paragraph 7(3)(d.1) of PIPEDA permits disclosure without consent for investigation purposes where it is reasonable to expect that obtaining consent would compromise an investigation into the breach of an agreement or contravention of Canadian law. Paragraph 7(3)(d.2) permits disclosure without consent for fraud prevention purposes where it is reasonable to expect that obtaining consent would compromise the ability to prevent, detect or suppress the fraud. Organizations can now appeal to other organizations for assistance in addressing a wide-range of security issues. In the past, they were constrained from cooperating by disclosing personal information. This constraint is now significantly qualified.

The allowances are broadly-worded though rest on “reasonableness” – a matter left to the interpretation of the OPC (and ultimately the Federal Court). The OPC has now issued a caution, setting the following expectations for organizations to follow:

  • perform due diligence and exercise good judgment when relying on the exceptions;
  • carefully consider the explicitly outlined requirements in the provisions;
  • respect the express limits set out in the provisions and make disclosures that are proportionate to need; and
  • document the rationale for disclosures.

Organizations should pay heed to the OPC guidance when applying these new and seemingly permissive provisions.

Sonya Sehgal is a 2016-2017 Articling Student with Hicks Morley.