BILL 22 – 2021
FREEDOM OF INFORMATION AND PROTECTION OF PRIVACY AMENDMENT ACT, 2021

HER MAJESTY, by and with the advice and consent of the Legislative Assembly of the Province of British Columbia, enacts as follows:

1 Section 2 (1) (c) of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, is amended by striking out "rights" and substituting "right".

2 Sections 3 and 4 are repealed and the following substituted:

Application

3 (1) Subject to subsections (3) to (5), this Act applies to all records in the custody or under the control of a public body, including court administration records.

(2) Part 3 applies

(a) to all employees, officers and directors of a public body, and

(b) in the case of an employee that is a service provider, to all employees and associates of the service provider.

(3) This Act does not apply to the following:

(a) a court record;

(b) a record of

(i) a judge of the Court of Appeal, Supreme Court or Provincial Court,

(ii) a master of the Supreme Court, or

(iii) a justice of the peace;

(c) a judicial administration record;

(d) a record relating to support services provided to a judge of a court referred to in paragraph (b) (i);

(e) a personal note, communication or draft decision of a person who is acting in a judicial or quasi-judicial capacity;

(f) a record that is created by or for, or is in the custody or under the control of, an officer of the Legislature and that relates to the exercise of functions under an Act;

(g) a record that is created by or for, or is in the custody or under the control of, the auditor general under the Auditor General for Local Government Act and that relates to the exercise of functions under that Act;

(h) a record of a question or answer to be used on an examination or test;

(i) a record containing teaching or research materials of

(i) a faculty member, as defined in the College and Institute Act and the University Act, of a post-secondary educational body,

(ii) a teaching assistant or research assistant employed at a post-secondary educational body, or

(iii) another person teaching or carrying out research at a post-secondary educational body;

(j) a record placed in the archives of a public body, or the digital archives or museum archives of government, by or for a person or agency other than a public body;

(k) a record relating to a prosecution if not all proceedings in respect of the prosecution have been completed;

(l) a record of a service provider that is not related to the provision of services for a public body.

(4) This Act, other than sections 30, 30.3, 30.5 (2), 33 and 65.3 to 65.6, does not apply to

(a) an officer of the Legislature, including all employees of the officer of the Legislature and, in the case of an employee that is a service provider, all employees and associates of the service provider, or

(b) the auditor general under the Auditor General for Local Government Act, including all employees of that auditor general and, in the case of an employee that is a service provider, all employees and associates of the service provider.

(5) Part 2 does not apply to the following:

(a) a record that is available for purchase by the public;

(b) a record that does not relate to the business of the public body;

(c) a record of metadata that

(i) is generated by an electronic system, and

(ii) describes an individual's interaction with the electronic system;

(d) an electronic record that has been lawfully deleted by an employee of a public body and can no longer be accessed by the employee.

(6) This Act does not limit the information available by law to a party to a proceeding.

(7) If a provision of this Act is inconsistent or in conflict with a provision of another Act, this Act prevails unless the other Act expressly provides that it, or a provision of it, applies despite this Act.

Information rights

4 (1) Subject to subsections (2) and (3), an applicant who makes a request under section 5 has a right of access to a record in the custody or under the control of a public body, including a record containing personal information about the applicant.

(2) The right of access to a record does not extend to information that is excepted from disclosure under Division 2 of this Part, but if that information can reasonably be severed from a record, an applicant has a right of access to the remainder of the record.

(3) The right of access to a record is subject to the payment of fees, if any, required under section 75.

3 Section 5 (1) (a) is amended by striking out "sufficient" and substituting "enough" and by striking out "records sought" and substituting "record sought".

4 Section 6 (2) is amended by striking out "must create a record for an applicant" and substituting "must create for an applicant a record to which section 4 gives a right of access".

5 Section 7 is amended

(a) by repealing subsection (4) and substituting the following:

(4) If the head of a public body determines that an applicant is to pay fees under section 75 (1) (a) or (b), the 30 days referred to in subsection (1) of this section do not include the period of time from that determination until one of the following occurs:

(a) the head of the public body excuses the applicant from paying all of the fees for services;

(b) the head of the public body excuses the applicant from paying some of the fees for services and the applicant agrees to pay the remainder and, if required by the head of the public body, pays the deposit required;

(c) the applicant agrees to pay the fees for services set out in the written estimate and, if required by the head of the public body, pays the deposit required;

(d) the applicant pays the application fee. , and

(b) in subsection (5) by striking out "the fee required" and substituting "a fee required".

6 Section 8 (1) (c) (ii) is repealed and the following substituted:

(ii) the contact information of an officer or employee of the public body who can answer the applicant's questions about the refusal, and .

7 Section 9 (1) is amended by striking out "concerned".

8 Section 16 is amended

(a) in subsection (1) (a) (iii) by striking out "aboriginal government" and substituting "Indigenous governing entity",

(b) in subsection (1) (c) by striking out "aboriginal self government" and substituting "Indigenous self-government", and

(c) by repealing subsection (3) and substituting the following:

(3) Subsection (1) does not apply to information that is in a record that has been in existence for 15 or more years unless the information is

(a) law enforcement information, or

(b) information referred to in subsection (1) (a) (iii) or (c).

9 The following section is added:

Disclosure harmful to interests of an Indigenous people

18.1 (1) The head of a public body must refuse to disclose information if the disclosure could reasonably be expected to harm the rights of an Indigenous people to maintain, control, protect or develop any of the following with respect to the Indigenous people:

(a) cultural heritage;

(b) traditional knowledge;

(c) traditional cultural expressions;

(d) manifestations of sciences, technologies or cultures.

(2) Subsection (1) does not apply if the Indigenous people has consented in writing to the disclosure.

10 Section 21 (3) (b) is amended by striking out "in the custody or control of the archives of the government of British Columbia or" and substituting "in the custody or under the control of the digital archives or museum archives of government or".

11 Section 22 is amended

(a) in subsection (2) (d) by striking out "aboriginal people" and substituting "Indigenous peoples",

(b) by repealing subsection (3) (h) and substituting the following:

(h) the disclosure would reveal

(i) the identity of a third party who supplied, in confidence, a personal recommendation or evaluation, character reference or personnel evaluation, or

(ii) the content of a personal recommendation or evaluation, character reference or personnel evaluation supplied, in confidence, by a third party, if the applicant could reasonably be expected to know the identity of the third party, , and

(c) in subsection (4) (d) by striking out "section 35" and substituting "section 33 (3) (h)".

12 Section 23 (1) and (2) is amended by striking out "section 21 or 22," and substituting "section 18.1, 21 or 22,".

13 The following section is added to Division 1 of Part 3:

Unauthorized collection, use and disclosure of personal information prohibited

25.1 An employee, officer or director of a public body or an employee or associate of a service provider must not collect, use or disclose personal information except as authorized by this Act.

14 Section 27 is amended

(a) in subsection (1) (b) by striking out "sections 33 to 36" and substituting "section 33",

(b) in subsection (1) (c) (ii) by striking out "quasi judicial" and substituting "quasi-judicial",

(c) in subsection (1) by adding the following paragraphs:

(c.1) the information is collected from a body disclosing it in accordance with a provision of a treaty, arrangement or written agreement that

(i) authorizes or requires the disclosure, and

(ii) is made under an enactment of British Columbia, other than this Act, or an enactment of Canada,

(c.2) the information is collected from a body disclosing it under an enactment of another province or of Canada, , and

(d) by repealing subsection (2) (c) and substituting the following:

(c) the contact information of an officer or employee of the public body who can answer the individual's questions about the collection.

15 Section 29 (1) is repealed and the following substituted:

(1) An individual who believes there is an error or omission in personal information about the individual that is in the custody or under the control of a public body may request the head of the public body to correct the information.

16 Section 30 is amended by striking out "access, collection" and substituting "collection".

17 Sections 30.1, 30.2, 30.4 and 30.5 (1) are repealed.

18 Section 30.3 is amended

(a) by repealing paragraph (a), and

(b) in paragraph (e) by striking out "(a),".

19 Section 31.1 is repealed.

20 Section 32 is repealed and the following substituted:

Use of personal information

32 A public body may use personal information in its custody or under its control only

(a) for the purpose for which the information was obtained or compiled, or for a use consistent with that purpose,

(b) if the individual the information is about has identified the information and has consented, in the prescribed manner, to the use, or

(c) for a purpose for which the information may be disclosed to the public body under section 33.

21 Sections 33, 33.1, 33.2, 35 and 36 are repealed and the following substituted:

Disclosure of personal information

33 (1) A public body may disclose personal information in its custody or under its control only as permitted by subsections (2) to (9) or by section 33.3.

(2) A public body may disclose personal information in any of the following circumstances:

(a) in accordance with Part 2;

(b) if the information or disclosure is of a type described in section 22 (4) (e), (f), (h), (i) or (j);

(c) if the individual the information is about has identified the information and has consented, in the prescribed manner, to the disclosure;

(d) for the purpose for which the information was obtained or compiled, or for a use consistent with that purpose within the meaning of section 34 [definition of consistent purpose];

(e) in accordance with an enactment of British Columbia or of Canada that authorizes or requires the disclosure;

(f) if the information is made available to the public under an enactment that authorizes or requires the information to be made public;

(g) in accordance with a provision of a treaty, arrangement or written agreement that

(i) authorizes or requires the disclosure, and

(ii) is made under an enactment of British Columbia, other than this Act, or an enactment of Canada;

(h) to an officer or employee of the public body, or to a minister, if the information is necessary for the performance of the duties of the officer, employee or minister;

(i) to an officer or employee of a public body, or to a minister, if the information is necessary to protect the health or safety of the officer, employee or minister;

(j) to an officer or employee of a public body, or to a minister, if the information is necessary for the purposes of planning or evaluating a program or activity of a public body;

(k) to an officer or employee of a public body or an agency, or to a minister, if the information is necessary for the delivery of a common or integrated program or activity and for the performance of the duties, respecting the common or integrated program or activity, of the officer, employee or minister to whom the information is disclosed;

(l) to comply with a subpoena, warrant or order issued or made by a court or person in Canada with jurisdiction to compel the production of information in Canada;

(m) to the Attorney General or legal counsel for the public body

(i) for the purpose of preparing or obtaining legal advice for the government or public body, or

(ii) for use in civil proceedings involving the government or public body;

(n) to the minister responsible for the Coroners Act or a person referred to in section 31 (1) of that Act, for the purposes of that Act;

(o) for the purpose of collecting amounts owing to the government or a public body by

(i) an individual, or

(ii) a corporation of which the individual the information is about is or was a director or officer;

(p) for the purposes of

(i) a payment to be made to or by the government or a public body,

(ii) authorizing, administering, processing, verifying or cancelling a payment, or

(iii) resolving an issue regarding a payment;

(q) for the purposes of licensing, registering, insuring, investigating or disciplining persons regulated by governing bodies of professions or occupations;

(r) if the information was collected by observation at a presentation, ceremony, performance, sports meet or similar event

(i) that was open to the public, and

(ii) at which the individual the information is about appeared voluntarily;

(s) to the auditor general or a prescribed person or body for audit purposes;

(t) if the disclosure is necessary for

(i) installing, implementing, maintaining, repairing, troubleshooting or upgrading an electronic system or equipment that includes an electronic system, or

(ii) data recovery that is undertaken following the failure of an electronic system,

that is used by the public body, or by a service provider for the purposes of providing services to a public body;

(u) if the disclosure is necessary for the processing of information and the following apply:

(i) the processing does not involve the intentional accessing of the information by an individual;

(ii) any processing done outside of Canada is temporary;

(v) if the information is metadata and the following apply:

(i) the metadata is generated by an electronic system;

(ii) the metadata describes an individual's interaction with the electronic system;

(iii) if practicable, information in individually identifiable form has been removed from the metadata or destroyed;

(iv) in the case of disclosure to a service provider, the public body has prohibited subsequent use or disclosure of information in individually identifiable form without the express authorization of the public body;

(w) if the information

(i) was disclosed on social media by the individual the information is about,

(ii) was obtained or compiled by the public body for the purpose of enabling the public body to engage individuals in public discussion or promotion respecting proposed or existing initiatives, policies, programs or activities of the public body or respecting legislation relating to the public body, and

(iii) is disclosed for a use that is consistent with the purpose described in subparagraph (ii);

(x) to an Indigenous governing entity for the purposes of a program or activity that supports the exercise of the rights recognized and affirmed by section 35 of the Constitution Act.

(3) A public body may disclose personal information in any of the following circumstances:

(a) if

(i) the head of the public body determines that compelling circumstances that affect anyone's health or safety exist, and

(ii) notice of disclosure is mailed to the last known address of the individual the information is about, unless the head of the public body considers that the notice could harm anyone's health or safety;

(b) for the purpose of reducing the risk that an individual will be a victim of domestic violence, if domestic violence is reasonably likely to occur;

(c) to enable the next of kin or a friend of an injured, ill or deceased individual to be contacted;

(d) to a public body, or a law enforcement agency in Canada, to assist in a specific investigation

(i) undertaken with a view to a law enforcement proceeding, or

(ii) from which a law enforcement proceeding is likely to result;

(e) to a member of the Legislative Assembly who has been requested by the individual the information is about to assist in resolving a problem;

(f) to a representative of a bargaining agent who has been authorized in writing by the employee the information is about to make an inquiry;

(g) to the digital archives or museum archives of government or the archives of a public body, for archival purposes;

(h) for a research purpose, including statistical research, if

(i) the research purpose cannot be accomplished unless the information is disclosed in individually identifiable form, or the research purpose has been approved by the commissioner,

(ii) the information is disclosed on condition that it not be used for the purpose of contacting a person to participate in the research unless

(A) the research is in relation to health issues, and

(B) the commissioner has approved the research purpose, the use of the information for the purpose of contacting a person to participate in the research and the manner in which contact is to be made, including the information to be made available to the person contacted,

(iii) any data-linking is not harmful to the individual the information is about and the benefits to be derived from the data-linking are clearly in the public interest,

(iv) the head of the public body has approved conditions relating to the following:

(A) security and confidentiality;

(B) the removal or destruction of individual identifiers at the earliest reasonable time;

(C) the prohibition of subsequent use or disclosure of the information in individually identifiable form without the express authorization of the public body, and

(v) the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Act and the public body's policies and procedures relating to the confidentiality of personal information.

(4) In addition to the authority under any other provision of this section, the digital archives or museum archives of government or archives of a public body may disclose personal information in its custody or under its control for archival or historical purposes if

(a) the disclosure would not be an unreasonable invasion of personal privacy under section 22,

(b) the information is about an individual who has been deceased for 20 or more years, or

(c) the information is in a record that has been in existence for 100 or more years.

(5) In addition to the authority under any other provision of this section, a board or a francophone education authority, as those are defined in the School Act, may disclose personal information in its custody or under its control to a museum, an archives or a similar institution that is or forms part of a public body or an organization, as the latter is defined in the Personal Information Protection Act, if

(a) the disclosure would not be an unreasonable invasion of personal privacy under section 22 of this Act,

(b) the information is about an individual who has been deceased for 20 or more years, or

(c) the information is in a record that has been in existence for 100 or more years.

(6) In addition to the authority under any other provision of this section, a public body that is a law enforcement agency may disclose personal information

(a) to another law enforcement agency in Canada, or

(b) to a law enforcement agency in a foreign state under an arrangement, written agreement or treaty or under provincial or Canadian legislative authority.

(7) In addition to the authority under any other provision of this section, the Insurance Corporation of British Columbia may disclose personal information

(a) for the purposes of

(i) licensing or registering motor vehicles or drivers, or

(ii) verifying motor vehicle registration, insurance or driver licences, or

(b) if

(i) the information was obtained or compiled by the Insurance Corporation of British Columbia for the purposes of insurance it provides, and

(ii) the disclosure is necessary to investigate, manage or settle a specific insurance claim.

(8) In addition to the authority under any other provision of this section, a personal identity information services provider may disclose personal identity information

(a) to enable the personal identity information services provider to provide a service under section 69.2, or

(b) to a public body if the disclosure is necessary to enable the public body to identify an individual for the purpose of providing a service to the individual.

(9) In addition to the authority under any other provision of this section, a public body may disclose personal identity information to a personal identity information services provider if the disclosure is necessary to enable

(a) the public body to identify an individual for the purpose of providing a service to the individual, or

(b) the personal identity information services provider to provide a service under section 69.2.

Disclosure outside of Canada

33.1 A public body may disclose personal information outside of Canada only if the disclosure is in accordance with the regulations, if any, made by the minister responsible for this Act.

22 Section 34 is amended by striking out "section 32 (a), 33.1 (1) (r) (iii) or 33.2 (a), or paragraph (b) of the definition of "data linking" in Schedule 1" and substituting "section 32 (a) or 33 (2) (d) or (w)".

23 The heading to Division 3 of Part 3 is amended by striking out "Initiatives" and substituting "Programs".

24 Section 36.1 is repealed and the following substituted:

Data-linking programs

36.1 (1) This section does not apply to a data-linking program that is part of research for the purpose of which personal information may be disclosed under section 33 (3) (h).

(2) A public body conducting a data-linking program must comply with the regulations, if any, made for the purposes of this section.

25 The following Division is added to Part 3:

Division 4 – Privacy Management Programs and Privacy Breach Notifications

Privacy management programs

36.2 The head of a public body must develop a privacy management program for the public body and must do so in accordance with the directions of the minister responsible for this Act.

Privacy breach notifications

36.3 (1) In this section, "privacy breach" means the theft or loss, or the collection, use or disclosure that is not authorized by this Part, of personal information in the custody or under the control of a public body.

(2) Subject to subsection (5), if a privacy breach involving personal information in the custody or under the control of a public body occurs, the head of the public body must, without unreasonable delay,

(a) notify an affected individual if the privacy breach could reasonably be expected to result in significant harm to the individual, including identity theft or significant

(i) bodily harm,

(ii) humiliation,

(iii) damage to reputation or relationships,

(iv) loss of employment, business or professional opportunities,

(v) financial loss,

(vi) negative impact on a credit record, or

(vii) damage to, or loss of, property, and

(b) notify the commissioner if the privacy breach could reasonably be expected to result in significant harm referred to in paragraph (a).

(3) The head of a public body is not required to notify an affected individual under subsection (2) if notification could reasonably be expected to

(a) result in immediate and grave harm to the individual's safety or physical or mental health, or

(b) threaten another individual's safety or physical or mental health.

(4) If notified under subsection (2) (b), the commissioner may notify an affected individual.

(5) A notification under subsection (2) (a) or (b) must be made in the prescribed manner.

26 Section 42 (1) (h) is repealed.

27 Section 43 is repealed and the following substituted:

Power to authorize a public body to disregard a request

43 If the head of a public body asks, the commissioner may authorize the public body to disregard a request under section 5 or 29, including because

(a) the request is frivolous or vexatious,

(b) the request is for a record that has been disclosed to the applicant or that is accessible by the applicant from another source, or

(c) responding to the request would unreasonably interfere with the operations of the public body because the request

(i) is excessively broad, or

(ii) is repetitious or systematic.

28 Section 44 (5) is amended by striking out "produced by the public body concerned" and substituting "produced under subsection (3) by the public body".

29 Section 44.1 (1) is amended by striking out "he or she considers" and substituting "the commissioner considers".

30 Sections 45 (1) and 46 are amended by striking out "investigation or inquiry" and substituting "investigation, audit or inquiry".

31 Section 47 (1) is amended by striking out "performing their duties, powers and functions" and substituting "performing their duties or exercising their powers and functions".

32 Section 52 (1) is amended by striking out "any decision, act or failure to act" and substituting "any decision, act or failure to act, other than to require an application fee,".

33 Section 54.1 is amended

(a) in subsection (1) (a) by striking out "head of a public body" and substituting "head of the public body",

(b) in subsection (1) (a) and (b) by striking out "sever the records" and substituting "sever information from the records", and

(c) in subsection (2) by striking out "severing a record" and substituting "severing information from a record" and by striking out "concerned".

34 Section 60 (2) is amended by striking out "his or her functions" and substituting "the adjudicator's functions".

35 Section 60.1 is repealed and the following substituted:

Adjudicator may authorize commissioner to disregard requests

60.1 The commissioner may ask an adjudicator designated under section 60 to authorize the commissioner as head of a public body to disregard a request made under section 5 or 29.

36 Section 61 (2) is amended by striking out "investigation, inquiry or review" and substituting "investigation, audit or inquiry".

37 The following Part is added:

Part 5.1 – Offences

Offence Act

65.1 Section 5 of the Offence Act does not apply to this Act.

Offence to wilfully mislead, obstruct or fail to comply with commissioner

65.2 A person who wilfully does any of the following commits an offence:

(a) makes a false statement to, or misleads or attempts to mislead,

(i) the commissioner or anyone acting for or under the direction of the commissioner in the performance of duties or exercise of powers and functions under this Act, or

(ii) an adjudicator or anyone acting for or under the direction of an adjudicator in the performance of duties or exercise of powers and functions under this Act;

(b) obstructs

(i) the commissioner or anyone acting for or under the direction of the commissioner in the performance of duties or exercise of powers and functions under this Act, or

(ii) an adjudicator or anyone acting for or under the direction of the adjudicator in the performance of duties or exercise of powers and functions under this Act;

(c) fails to comply with an order made by

(i) the commissioner under section 54.1 or 58, or

(ii) an adjudicator under section 65 (2).

Offence to wilfully evade access provisions

65.3 A person who wilfully conceals, destroys or alters any record to avoid complying with a request for access to the record commits an offence.

Privacy offences

65.4 (1) An individual, other than an individual who is a service provider or an employee or associate of a service provider, who wilfully does any of the following commits an offence:

(a) collects personal information except as authorized by Part 3;

(b) uses personal information except as authorized by Part 3;

(c) discloses personal information except as authorized by Part 3;

(d) fails to notify the head of a public body of unauthorized disclosure as required by Part 3.

(2) A service provider or an employee or associate of a service provider who does any of the following commits an offence:

(a) collects personal information except as authorized by Part 3;

(b) uses personal information except as authorized by Part 3;

(c) discloses personal information except as authorized by Part 3;

(d) fails to notify the head of a public body of unauthorized disclosure as required by Part 3;

(e) dismisses, suspends, demotes, disciplines, harasses or otherwise disadvantages an employee, or denies the employee a benefit, because the employee has done, or the employer believes that the employee will do, anything described in section 30.3 (b) to (d).

(3) A service provider commits an offence if an employee or associate of the service provider commits any of the offences under subsection (2).

(4) It is a defence to a charge under subsections (2) and (3) if the person charged demonstrates that the person exercised due diligence to avoid committing the offence.

Corporate liability

65.5 If a corporation commits an offence under section 65.3 or 65.4, an officer, director or agent of the corporation who authorizes, permits or acquiesces in the commission of the offence also commits an offence, whether or not the corporation is prosecuted for the offence.

Penalties

65.6 (1) A person who commits an offence under section 65.2 is liable on conviction to a fine of up to $50 000.

(2) A person who commits an offence under section 65.3 or 65.4 is liable on conviction,

(a) in the case of an individual, other than an individual who is a service provider, to a fine of up to $50 000,

(b) subject to paragraph (c), in the case of a service provider, including a partnership that or an individual who is a service provider, to a fine of up to $50 000, and

(c) in the case of a corporation, to a fine of up to $500 000.

Time limit for laying an information to commence a prosecution

65.7 (1) The time limit for laying an information to commence a prosecution for an offence under sections 65.3 and 65.4 is

(a) one year after the date on which the act or omission that is alleged to constitute the offence occurred, or

(b) if the minister responsible for this Act issues a certificate described in subsection (2), one year after the date on which the minister learned of the act or omission referred to in paragraph (a) of this subsection.

(2) A certificate issued by the minister responsible for this Act certifying the date referred to in subsection (1) (b) is proof of that date.

38 Section 69 is amended

(a) in subsection (1) in the definition of "personal information bank" by striking out "a collection of" and substituting "an aggregation of",

(b) in subsection (3) (a) by striking out "in the custody or control of" and substituting "in the custody or under the control of",

(c) in subsections (5) and (5.3) by striking out "must conduct a privacy impact assessment in accordance with the directions of the minister" and substituting "must conduct a privacy impact assessment and must do so in accordance with the directions of the minister",

(d) in subsections (5.2) and (5.4) by striking out "or a data-linking initiative",

(e) in subsection (5.5) by striking out "of a data-linking initiative or",

(f) by repealing subsections (5.6) and (8), and

(g) by adding the following subsection:

(10) The minister responsible for this Act may, under subsection (5) or (5.3), give different directions for different categories of personal information.

39 Section 69.1 is amended

(a) in subsection (3) (a) by striking out "in the custody or control of" and substituting "in the custody or under the control of",

(b) by repealing subsection (5) and substituting the following:

(5) A ministry that is a health care body must conduct a privacy impact assessment, and must do so in accordance with the directions of the minister responsible for this Act, in relation to

(a) a health information bank in its custody or under its control, and

(b) a health information-sharing agreement to which it is a party. , and

(c) by adding the following subsection:

(6) The minister responsible for this Act may, under subsection (5), give different directions for different categories of personal information.

40 Section 70 is repealed and the following substituted:

Certain records available without request

70 (1) The head of a public body must make available to the public, without a request for access under this Act, the following records if they were created for the purpose of interpreting an enactment or for the purpose of administering a program or activity that affects the public:

(a) manuals, instructions or guidelines issued to the officers or employees of the public body;

(b) substantive rules or policy statements adopted by the public body.

(2) The head of a public body may sever from a record made available under this section any information the head of the public body would be entitled under Part 2 of this Act to refuse to disclose to an applicant.

(3) If information is severed from a record, the record must include a statement of

(a) the fact that information has been severed from the record,

(b) the nature of the information severed from the record, and

(c) the reason for severing the information from the record.

(4) The head of a public body may require a person who asks for a copy of a record made available under this section to pay a fee to the public body.

41 Section 71 is amended

(a) in subsection (1.1) (a) by striking out "section 33.1 or 33.2" and substituting "section 33", and

(b) by adding the following subsections:

(1.3) The head of a public body may sever from a record made available under this section any information the head of the public body would be entitled under Part 2 of this Act to refuse to disclose to an applicant.

(1.4) If information is severed from a record, the record must include a statement of

(a) the fact that information has been severed from the record,

(b) the nature of the information severed from the record, and

(c) the reason for severing the information from the record.

42 Section 71.1 is amended

(a) in subsection (2) (a) by striking out "section 33.1 or 33.2" and substituting "section 33", and

(b) by adding the following subsections:

(6) The head of a public body may sever from a record made available under this section any information the head of the public body would be entitled under Part 2 of this Act to refuse to disclose to an applicant.

(7) If information is severed from a record, the record must include a statement of

(a) the fact that information has been severed from the record,

(b) the nature of the information severed from the record, and

(c) the reason for severing the information from the record.

43 Sections 74 and 74.1 are repealed.

44 Section 75 is repealed and the following substituted:

Fees

75 (1) The head of a public body may require an applicant who makes a request under section 5 to pay to the public body the following:

(a) a prescribed application fee;

(b) prescribed fees for the following services:

(i) locating and retrieving the record;

(ii) producing the record;

(iii) preparing the record for disclosure, except for time spent severing information from the record;

(iv) shipping and handling the record;

(v) providing a copy of the record.

(2) Subsection (1) (b) (i) does not apply to the first 3 hours spent on a request.

(3) Subsection (1) does not apply to a request for the applicant's own personal information.

(4) If an applicant is required to pay fees for services under subsection (1) (b), the head of the public body

(a) must give the applicant a written estimate of the total fees before providing the services, and

(b) may require the applicant to pay a deposit in an amount set by the head of the public body.

(5) If the head of a public body receives an applicant's written request to excuse payment of all or part of the fees required under subsection (1) (b), the head of the public body may excuse payment, if, in the head of the public body's opinion,

(a) the applicant cannot afford the payment or for any other reason it is fair to excuse payment, or

(b) the record relates to a matter of public interest, including the environment or public health or safety.

(6) The head of a public body must respond to a request under subsection (5) in writing and within 20 days after receiving the request.

(7) The fees that prescribed categories of applicants are required to pay for services under subsection (1) (b) may differ from the fees other applicants are required to pay for the services but may not be greater than the actual costs of the services.

45 Section 76 is amended

(a) in subsection (2) (h) by striking out "incompetents,",

(b) in subsection (2) by adding the following paragraph:

(i.1) prescribing an application fee and fees for services; , and

(c) by repealing subsection (2.1) (b) and substituting the following:

(b) for the purposes of section 36.1,

(i) establishing how data-linking programs must be conducted, and

(ii) exempting a data-linking program or class of data-linking program from regulations made under subparagraph (i) of this paragraph.

46 Section 76.1 is amended

(a) in subsection (1) (a) (i) by striking out "member" and substituting "member, director or officer",

(b) in subsection (1) (a) (ii) by striking out "agencies, or" and substituting "agencies or a public body,",

(c) in subsection (1) (a) (iii) by striking out "enactment;" and substituting "enactment, or",

(d) in subsection (1) (a) by adding the following subparagraph:

(iv) if the minister responsible for this Act determines that it would be in the public interest to add the agency, board, commission, corporation, office or other body to Schedule 2; ,

(e) in subsections (1) (c) and (2) (b) by striking out "delete" and substituting "remove", and

(f) by adding the following subsection:

(3) The minister responsible for this Act may make regulations establishing measures that must be taken by a public body respecting programs, projects and systems in which the public body discloses personal information outside of Canada.

47 Section 79 is repealed.

48 Schedule 1 is amended

(a) by repealing the definition of "aboriginal government" and substituting the following:

"Indigenous governing entity" means an Indigenous entity that exercises governmental functions, and includes but is not limited to an Indigenous governing body as defined in the Declaration on the Rights of Indigenous Peoples Act; ,

(b) by repealing the definition of "access",

(c) in the definition of "agency" by striking out "for the purposes of sections 33.2 (d) and 36.1 (3) (b) (i)" and substituting "for the purposes of section 33 (2) (k)", and by striking out "data-linking initiative" and substituting "data-linking program",

(d) by repealing the definitions of "data linking" and "data-linking initiative" and substituting the following:

"common key" means information about an identifiable individual that is common to 2 or more data sets;

"data-linking" means the linking, temporarily or permanently, of 2 or more data sets using one or more common keys;

"data-linking program" means a program of a public body that involves data-linking if at least one data set in the custody or under the control of a public body is linked with a data set in the custody or under the control of one or more other public bodies or agencies without the consent of the individuals whose personal information is contained in the data set;

"data set" means an aggregation of information that contains personal information; ,

(e) in the definition of "health care body" by repealing paragraph (b),

(f) by adding the following definition:

"Indigenous peoples" has the same meaning as in the Declaration on the Rights of Indigenous Peoples Act; ,

(g) by repealing the definition of "intimate partner" and substituting the following:

"intimate partner" means, with respect to an individual, any of the following:

(a) an individual who is or was a spouse, dating partner or sexual partner of the individual;

(b) an individual who is or was in a relationship with the individual that is similar to a relationship described in paragraph (a); , and

(h) by repealing the definition of "social media site".

49 Schedule 2 is amended by adding the following:

50 Schedule 2 is amended by striking out the following:

Transitional Provisions

Transition – data-linking programs

51 A data-linking initiative that started before section 24 of this Act is brought into force is subject to section 36.1 of the Freedom of Information and Protection of Privacy Act as it read before the coming into force of section 24 of this Act.

Consequential Amendments

Assessment Act

52 Section 68 (4) (a) of the Assessment Act, R.S.B.C. 1996, c. 20, is amended by striking out "section 33.1 or 33.2" and substituting "section 33".

Child, Family and Community Service Act

53 Section 74 (2) of the Child, Family and Community Service Act, R.S.B.C. 1996, c. 46, is amended

(a) by repealing paragraph (e) and substituting the following:

(e) the only provisions of section 33 that apply to a director are the following:

(i) section 33 (2) (a) [in accordance with Part 2];

(ii) section 33 (2) (c) [individual consent];

(iii) section 33 (2) (j) [evaluating program or activity];

(iv) section 33 (2) (k) [common or integrated program or activity];

(v) section 33 (2) (p) [payment to government or a public body];

(vi) section 33 (3) (b) [domestic violence];

(vii) section 33 (3) (g) [to archives for archival purposes];

(viii) section 33 (3) (h) [research purposes];

(ix) section 33 (4) [by archives for archival or historical purposes];

(x) section 33 (8) [identity management services], except that the reference to "any other provision of this section" is to be read as a reference to any provision referred to in subparagraph (i) to (vi) and (viii) to (x) of this paragraph. , and

(b) in paragraph (e.1) by striking out "section 33.1 (1) (q) or (r) or (7) or 33.3" and substituting "section 33.1 (2) (r) or (w) or 33.3".

54 Section 79 is amended

(a) in paragraph (j) by striking out "made in Canada to" and substituting "made to", and

(b) in paragraph (k) by striking out "made in Canada and necessary" and substituting "necessary".

Civil Resolution Tribunal Act

55 Section 86 (2) of the Civil Resolution Tribunal Act, S.B.C. 2012, c. 25, is repealed.

Criminal Records Review Act

56 Section 6 (3) of the Criminal Records Review Act, R.S.B.C. 1996, c. 86, is amended by striking out "section 33.1 (1) (m), 33.2 (i) or" and substituting "section 33 (3) (a) or (d) or".

E-Health (Personal Health Information Access and Protection of Privacy) Act

57 Section 10 (1) (b) of the E-Health (Personal Health Information Access and Protection of Privacy) Act, S.B.C. 2008, c. 38, is amended by striking out "section 33.1 (1) (c)" and substituting "section 33 (2) (e)".

58 Section 18 is amended

(a) in subsection (1) (a) by striking out "section 33.2 (f) and (i)" and substituting "section 33 (2) (s) and (3) (d)", and

(b) in subsection (2) (a) by striking out "section 33.1 (1) (a), (c), (e), (e.1), (g), (i), (i.1), (m), (m.1), (n), (p), (p.1), (p.2) or (t), (6) or (7)" and substituting "section 33 (2) (a), (e), (h), (l), (m), (o), (p), (t), (u) or (v), (3) (a), (b) or (c), (8) or (9)".

59 Section 19 (1) (c) (iii) is amended by striking out "aboriginal government" and substituting "Indigenous governing entity".

Employer Health Tax Act

60 Section 90 (9) of the Employer Health Tax Act, S.B.C. 2018, c. 42, is amended by striking out "sections 32 [use of personal information], 33 [disclosure of personal information], 33.1 [disclosure inside or outside Canada] and 33.2 [disclosure inside Canada only]" and substituting "sections 32 [use of personal information] and 33 [disclosure of personal information]".

Employment and Assistance Act

61 Section 30 (2.3) of the Employment and Assistance Act, S.B.C. 2002, c. 40, is amended by striking out "section 35" and substituting "section 33 (3) (h)".

Employment and Assistance for Persons with Disabilities Act

62 Section 21 (2.3) of the Employment and Assistance for Persons with Disabilities Act, S.B.C. 2002, c. 41, is amended by striking out "section 35" and substituting "section 33 (3) (h)".

Family Law Act

63 Section 243 (4) (c) of the Family Law Act, S.B.C. 2011, c. 25, is amended by striking out "section 33.1 (1) (s)" and substituting "section 33 (3) (h)".

Family Maintenance Enforcement Act

64 Section 43 (2) of the Family Maintenance Enforcement Act, R.S.B.C. 1996, c. 127, is amended by striking out "section 33.1 (1) (s)" and substituting "section 33 (3) (h)".

Income Tax Act

65 Section 64 (8) of the Income Tax Act, R.S.B.C. 1996, c. 215, is amended by striking out "sections 32, 33, 33.1 and 33.2" and substituting "sections 32 and 33".

Ministry of Environment Act

66 Section 6.1 (2) of the Ministry of Environment Act, R.S.B.C. 1996, c. 299, is amended

(a) by striking out "section 33.1 (1) (c)" and substituting "section 33 (2) (e)", and

(b) by striking out "inside or outside Canada".

Pharmaceutical Services Act

67 Section 23 of the Pharmaceutical Services Act, S.B.C. 2012, c. 22, is amended

(a) in subsection (1) (a) by striking out "section 33.2 (f) or (i)" and substituting "section 33 (2) (s) or (3) (d)", and

(b) in subsection (2) (a) by striking out "section 33.1 (1) (a), (c), (e), (e.1), (g), (i), (i.1), (m), (m.1), (n), (p), (p.1), (p.2) or (t), (6) or (7)" and substituting "section 33 (2) (a), (e), (h), (l), (m), (o), (p), (t), (u) or (v), (3) (a), (b) or (c), (8) or (9)".

68 Section 29 (1) (b) is amended by striking out "section 33.1 (1) (c)" and substituting "section 33 (2) (e)".

Police Act

69 Section 182 of the Police Act, R.S.B.C. 1996, c. 367, is amended by striking out "Except as provided by this Act and by section 3 (3)" and substituting "Except as provided by this Act and by section 3 (4)".

School Act

70 Section 170.2 (5) (b) of the School Act, R.S.B.C. 1996, c. 412, is amended by striking out "section 33.2 (d)" and substituting "section 33 (2) (k)".

Secure Care Act

71 Section 49 of the Secure Care Act, S.B.C. 2000, c. 28, is repealed and the following substituted:

49 Section 3 (3) of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c. 165, is amended by adding the following paragraph:

(g.1) a record that is created by or for, or is in the custody or under the control of, the Secure Care Board and that relates to the exercise of that board's functions under the Secure Care Act; .

Speculation and Vacancy Tax Act

72 Section 120 (10) of the Speculation and Vacancy Tax Act, S.B.C. 2018, c. 46, is amended by striking out "sections 32 [use of personal information], 33 [disclosure of personal information], 33.1 [disclosure inside or outside Canada] and 33.2 [disclosure inside Canada only]" and substituting "sections 32 [use of personal information] and 33 [disclosure of personal information]".

Vital Statistics Act

73 Section 41.1 (2) (b) of the Vital Statistics Act, R.S.B.C. 1996, c. 479, is amended by striking out "aboriginal government" and substituting "Indigenous governing entity".

Commencement

74 The provisions of this Act referred to in column 1 of the following table come into force as set out in column 2 of the table:

Explanatory Notes

SECTION 1: [Freedom of Information and Protection of Privacy Act, section 2] makes a minor amendment for consistency.

SECTION 2: [Freedom of Information and Protection of Privacy Act, sections 3 and 4]

• amends and reorganizes provisions respecting the application of the Act;
• makes a minor amendment for consistency;
• amends the provision respecting information access rights.

SECTION 3: [Freedom of Information and Protection of Privacy Act, section 5] makes minor amendments for consistency.

SECTION 4: [Freedom of Information and Protection of Privacy Act, section 6] is consequential to amendments made by this Bill to the Act.

SECTION 5: [Freedom of Information and Protection of Privacy Act, section 7] is consequential to amendments made by this Bill to the Act.

SECTION 6: [Freedom of Information and Protection of Privacy Act, section 8] updates the types of contact information public bodies must give to applicants.

SECTION 7: [Freedom of Information and Protection of Privacy Act, section 9] removes a word for consistency.

SECTION 8: [Freedom of Information and Protection of Privacy Act, section 16] updates terminology respecting Indigenous governments and extends to information relating to Indigenous governments the exception from the 15-year record age limit.

SECTION 9: [Freedom of Information and Protection of Privacy Act, section 18.1] adds a disclosure exception respecting the rights of Indigenous peoples.

SECTION 10: [Freedom of Information and Protection of Privacy Act, section 21] makes a minor amendment for consistency and updates a name reference.

SECTION 11: [Freedom of Information and Protection of Privacy Act, section 22]

• updates terminology respecting Indigenous governments;
• adds to a disclosure exception a reference to third party identity;
• updates a section reference consequential to amendments made by this Bill to the Act.

SECTION 12: [Freedom of Information and Protection of Privacy Act, section 23] applies the scheme for third party notice to the new disclosure exception added by this Bill to the Act.

SECTION 13: [Freedom of Information and Protection of Privacy Act, section 25.1] adds a prohibition on unauthorized collection, use and disclosure of personal information.

SECTION 14: [Freedom of Information and Protection of Privacy Act, section 27]

• updates a section reference consequential to amendments made by this Bill to the Act;
• makes a minor amendment for consistency;
• adds provisions authorizing indirect collection of personal information;
• updates the types of contact information public bodies must give to individuals whose personal information they collect from the individuals.

SECTION 15: [Freedom of Information and Protection of Privacy Act, section 29] reorganizes a provision and replaces gendered language with gender-neutral language.

SECTION 16: [Freedom of Information and Protection of Privacy Act, section 30] is consequential to amendments made by this Bill to the Act.

SECTION 17: [Freedom of Information and Protection of Privacy Act, sections 30.1, 30.2, 30.4 and 30.5] repeals provisions respecting storage and access outside of Canada, foreign demands for disclosure, unauthorized disclosure and notification of unauthorized disclosure.

SECTION 18: [Freedom of Information and Protection of Privacy Act, section 30.3] is consequential to amendments made by this Bill to the Act.

SECTION 19: [Freedom of Information and Protection of Privacy Act, section 31.1] repeals a provision consequential to amendments made by this Bill to the Act.

SECTION 20: [Freedom of Information and Protection of Privacy Act, section 32] makes minor amendments for style consistency and updates a section reference consequential to amendments made by this Bill to the Act.

SECTION 21: [Freedom of Information and Protection of Privacy Act, sections 33, 33.1, 33.2, 35 and 36] repeals provisions for disclosure of personal information and re-enacts them in a single section, adding a requirement that disclosure to recipients outside of Canada be in accordance with regulations made under the ministerial regulation-making authority added by this Bill to the Act.

SECTION 22: [Freedom of Information and Protection of Privacy Act, section 34] updates section references consequential to amendments made by this Bill to the Act.

SECTION 23: [Freedom of Information and Protection of Privacy Act, heading to Division 3 of Part 3] updates a Division heading consequential to amendments made by this Bill to the Act.

SECTION 24: [Freedom of Information and Protection of Privacy Act, section 36.1] repeals and replaces a provision for data-linking programs.

SECTION 25: [Freedom of Information and Protection of Privacy Act, Division 4 of Part 3] adds a Division for privacy management programs and privacy breach notifications.

SECTION 26: [Freedom of Information and Protection of Privacy Act, section 42] repeals a provision consequential to amendments made by this Bill to the Act.

SECTION 27: [Freedom of Information and Protection of Privacy Act, section 43] expands the grounds for commissioner authorization to disregard requests.

SECTION 28: [Freedom of Information and Protection of Privacy Act, section 44] makes a minor amendment for style consistency.

SECTION 29: [Freedom of Information and Protection of Privacy Act, section 44.1] removes gendered language.

SECTION 30: [Freedom of Information and Protection of Privacy Act, sections 45 and 46] adds "audit" for consistency.

SECTION 31: [Freedom of Information and Protection of Privacy Act, section 47] makes a minor amendment for consistency.

SECTION 32: [Freedom of Information and Protection of Privacy Act, section 52] is consequential to amendments made by this Bill to the Act.

SECTION 33: [Freedom of Information and Protection of Privacy Act, section 54.1] makes minor amendments for grammar.

SECTION 34: [Freedom of Information and Protection of Privacy Act, section 60] removes gendered language.

SECTION 35: [Freedom of Information and Protection of Privacy Act, section 60.1] is consequential to amendments made by this Bill to the Act.

SECTION 36: [Freedom of Information and Protection of Privacy Act, section 61] adds "audit" and removes "review" for consistency.

SECTION 37: [Freedom of Information and Protection of Privacy Act, Part 5.1] adds a Part for new offences and existing offences.

SECTION 38: [Freedom of Information and Protection of Privacy Act, section 69]

• makes minor amendments for consistency;
• requires privacy impact assessments;
• repeals provisions consequential to amendments made by this Bill to the Act;
• adds regulation-making authority to discriminate.

SECTION 39: [Freedom of Information and Protection of Privacy Act, section 69.1]

• makes a minor amendment for consistency;
• requires privacy impact assessments;
• adds regulation-making authority to discriminate.

SECTION 40: [Freedom of Information and Protection of Privacy Act, section 70] reorganizes a provision and makes an amendment for consistency.

SECTION 41: [Freedom of Information and Protection of Privacy Act, section 71] adds a provision for severing information from records, and related requirements, for consistency.

SECTION 42: [Freedom of Information and Protection of Privacy Act, section 71.1] adds a provision for severing information from records, and related requirements, for consistency.

SECTION 43: [Freedom of Information and Protection of Privacy Act, sections 74 and 74.1] repeals provisions consequential to amendments made by this Bill to the Act.

SECTION 44: [Freedom of Information and Protection of Privacy Act, section 75] adds authority to charge an application fee and fees for services.

SECTION 45: [Freedom of Information and Protection of Privacy Act, section 76]

• updates terminology;
• adds authority to prescribe an application fee and fees for services;
• adds authority to exempt by regulation classes of data-linking programs from requirements added by this Bill to the Act.

SECTION 46: [Freedom of Information and Protection of Privacy Act, section 76.1]

• expands the basis on which entities may be added to Schedule 2 of the Act;
• makes an amendment for consistency;
• adds authority for the minister to make regulations respecting programs, projects and systems in which personal information is disclosed outside of Canada.

SECTION 47: [Freedom of Information and Protection of Privacy Act, section 79] repeals a provision consequential to amendments made by this Bill to the Act.

SECTION 48: [Freedom of Information and Protection of Privacy Act, Schedule 1] removes gendered language and adds and removes definitions consequential to amendments made by this Bill to the Act.

SECTION 49: [Freedom of Information and Protection of Privacy Act, Schedule 2] adds 2 public bodies to Schedule 2 of the Act.

SECTION 50: [Freedom of Information and Protection of Privacy Act, Schedule 2] removes a public body from Schedule 2 of the Act.

SECTION 51: [Transition – data-linking programs] provides a transitional rule respecting data-linking programs, consequential amendments made by this Bill to the Act.

SECTION 52: [Assessment Act, section 68] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTIONS 53 AND 54: [Child, Family and Community Service Act, sections 74 and 79] are consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 55: [Civil Resolution Tribunal Act, section 86] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 56: [Criminal Records Review Act, section 6] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTIONS 57 TO 59: [E-Health (Personal Health Information Access and Protection of Privacy) Act, sections 10, 18 and 19] are consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 60: [Employer Health Tax Act, section 90] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 61: [Employment and Assistance Act, section 30] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 62: [Employment and Assistance for Persons with Disabilities Act, section 21] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 63: [Family Law Act, section 243] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 64: [Family Maintenance Enforcement Act, section 43] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 65: [Income Tax Act, section 64] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 66: [Ministry of Environment Act, section 6.1] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTIONS 67 AND 68: [Pharmaceutical Services Act, sections 23 and 29] are consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 69: [Police Act, section 182] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 70: [School Act, section 170.2] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 71: [Secure Care Act, section 49] makes an amendment (to a provision, in a not-in-force Act, that amends the Freedom of Information and Protection of Privacy Act) consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 72: [Speculation and Vacancy Tax Act, section 120] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.

SECTION 73: [Vital Statistics Act, section 41.1] is consequential to amendments made by this Bill to the Freedom of Information and Protection of Privacy Act.