Dixon, Tim --- "Contact: Advice on the Confidentiality of Personal Information" [1995] PrivLawPRpr 60; (1995) 2(5) Privacy Law & Policy Reporter 93

---

Contact: Advice on the Confidentiality of Personal Information

Commission d'acces a l'information du Quebec - January 1995

Act respecting the protection of personal information in the private sector 1993 - Act respecting access to documents held by public bodies and the protection of personal information (continued from (1995) 2 PLPR 75)

Management of personal information in universities

The Act requires that public bodies only collect information necessary for carrying out their duties. This information must not be released without the consent of the individual concerned. The guidelines cover a range of record-keeping activities:

1. The Commission concluded that universities are not to keep social insurance numbers of past students.
2. All or part of the master list of students or graduates may only be passed out with the consent of the students concerned, unless it is required in order to implement other legislation.
3. Consent for the release of personal information can be obtained from students at the time of registration.
4. The consent of students must precede the transmission of their results to a registration information centre.
5. Educational institutions should obtain consent before displaying examination and subject results, if the information relating to the individual is 'nominative information'; that is, if it may identify an individual, such as through a mark besides a name, or a student number which begins either with a year of registration or with the first three letters of the individual's name.
6. Institutions which currently display on envelopes student numbers which contain birth dates should cease this practice. The Commission suggests three possible changes: using window envelopes, no longer indicating the date of birth, and using two series of labels, one without the permanent code on the back of the envelope and the other with the permanent code inside the envelope.

Boards of elected officials and members of boards of directors

The Commission has also established guidelines for the circumstances in which elected officials and members of boards of directors may access records which contain personal information.

Many of Quebec's statutes governing public bodies give elected officials and members of boards of directors a range of responsibilities and powers which enable these individuals to access the files of the public bodies which they manage. These files may contain personal information which is not generally available to others. The guidelines state that no such official or member of the board of directors should use such access rights for personal purposes, and that any access to files of personal information should reflect the wishes of at least the majority of members of the institution. Other statutes confer special independent powers on mayors and members of cabinet, allowing them to consult personal information files on their own initiative without seeking the permission of the decision-making body. Organisations should also determine the categories of persons who have access to personal information files, and the organisation should be open about the content of these categories.

Access to medical diagnosis

An employer who acts as an insurer under the disability insurance plan established in the public sector, may require that a diagnosis be shown on a medical certificate. After hearing a wide range of complaints, the Commission determined that such access was necessary for the insurer to determine whether coverage applies and the likely duration of the disability.

The Commission notes that in balancing management interests with individual rights, the Commission did not have clear legislative provisions granting or denying the employer the right to access employees' medical records. '[T]he concept of necessity conveyed by the Act ... also had its limits and that it should be interpreted according to relative and contextual criteria.' The contextual criteria used by the Commission involved the charters of human rights and freedoms, and traditions relating to labour relations in Quebec.

Access rights should be restricted to individuals in specific categories, such as those responsible for implementing the guide to assessing periods of absence due to disability; the public body's medical officer; and the personnel manager, if the information is necessary in resolving an issue related to the file. However, the personnel manager is explicitly prevented from obtaining an employee's psychiatric record.

Tim Dixon