Memorandum of Understanding with Ontario

September 23, 2014

Between
The Office of the Privacy Commissioner of Canada (“OPC”) and the Office of the Information and Privacy Commissioner of Ontario (“OIPC”) (“the Participants”)

RECOGNIZING

That the OPC and OIPC have oversight responsibilities with respect to the protection of personal information in their respective jurisdictions;

That the OPC, pursuant to the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”), is responsible for protecting personal information in the private sector in Canada;

That the OIPC, pursuant to the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sch A (“PHIPA”), is responsible for protecting personal health information in Ontario;
That PHIPA has been found to be substantially similar to PIPEDA;

That there are circumstances where the Participants may have a mutual interest in a matter pursuant to their respective mandates;

That s. 23 of PIPEDA authorizes the OPC to consult, coordinate its activities and share information with a person who, under provincial laws, has similar functions and duties with respect to the protection of personal information;

That s. 66(e) of PHIPA authorizes the OIPC to assist in investigations and similar procedures conducted by a person who performs similar functions to the OIPC under the laws of Canada, except that in providing assistance, the OIPC shall not use or disclose information collected by or for the OIPC under PHIPA;

Also that s. 68(3) of PHIPA permits the OIPC to disclose information in the course of exercising The OIPC’s functions under PHIPA where the disclosure is required for the purpose of exercising those functions;

That the Participants have similar functions and duties with respect to the protection of personal information;

The benefits of consultation, coordination and information sharing (where not prohibited) with respect to their mandates under PIPEDA and PHIPA;

HAVE REACHED THE FOLLOWING UNDERSTANDING:

---

I. Objective

The objective of this Memorandum is to establish a framework to allow the Participants to consult, cooperate and share relevant information with respect to matters arising under PIPEDA and PHIPA in which the Participants are mutually interested.

II. Procedures Relating to Mutual Assistance

1. Each Participant will designate a primary contact for the purposes of requests for assistance and other communications under this Memorandum.
2. Participants may communicate and cooperate with each other, as appropriate, about matters arising under PIPEDA and PHIPA in which they are mutually interested.
3. Subject to Section III, the Participants may share information that could be relevant to an ongoing or potential investigation of a complaint or audit under PIPEDA or PHIPA or that could assist the Participants in the exercise of their functions or duties with respect to the protection of personal information.
4. The Participants will notify each other without delay, if they become aware that information shared under this Memorandum is not accurate, complete, and up-to-date.
5. Subject to Section III, Participants may, as appropriate and subject to relevant legal restrictions, refer complaints to each other, or provide each other notice of possible contraventions.
6. Participants will use their best efforts to resolve any disagreements related to co-operation that may arise under this Memorandum through the contacts designated under Section II. A, and, failing resolution in a reasonably timely manner, by discussion between the heads of the Participants.

III. Limitations on Assistance and Use

1. For greater certainty, nothing in this Memorandum requires Participants to provide assistance where it is outside the scope of this Memorandum, or more generally where it would be inconsistent with applicable laws, or important interests or priorities.
2. Participants will only share personal information pursuant to this Memorandum to the extent that it is necessary for fulfilling the purposes of this Memorandum and will use best efforts to obtain the consent of the individual(s) concerned before doing so.
3. The Participants acknowledge that nothing in this memorandum is to be construed as authorizing the OIPC to share information collected by or for the OIPC under PHIPA unless the disclosure is required for the purpose of exercising the OIPC’s own functions under PHIPA;
4. Participants will not use any information obtained pursuant to this Memorandum for purposes other than those for which the information was originally shared.

IV. Confidentiality

1. Information shared under this Memorandum is to be treated as confidential and will not be further disclosed without the consent of the Participant who provided it.
2. Each participant will use best efforts to safeguard the security of any information received under this Memorandum and respect any safeguards agreed to by the Participants. In the event of any unauthorized access or disclosure of the information, the affected Participant will take all reasonable steps to prevent a recurrence of the event and will promptly notify the other Participant of the occurrence.
3. The Participants will oppose, to the fullest extent possible consistent with applicable laws, any application by a third party for disclosure of confidential information or materials received under this Memorandum, unless the Participant who provided the information or materials consents to its release. The Participants who receives such an application will notify forthwith the Participant that provided it with the information or materials.

V. Retention of Information

Information received under this Memorandum will not be retained for longer than is required to fulfill the purpose for which it was shared or than is required by applicable laws. The Participants will use best efforts to return any information that is no longer required if the Participant who provided the information makes a written request that such information be returned at the time it is shared. If no request for return of the information is made, the Participants will dispose of the information using methods prescribed by the Participant who provided the information or if no such methods have been prescribed, by other secure methods, as soon as practicable after the information is no longer required.

VI. Duration of Cooperation

1. This Memorandum takes effect on the date it is signed.
2. Assistance in accordance with this Memorandum will be available concerning matters occurring before as well as after this Memorandum is signed.
3. This Memorandum may be terminated at any time on written notice by either Participant. However, prior to providing such notice, each Participant will use best efforts to consult with the other Participant.
4. On termination of this Memorandum, the Participants will, in accordance with Section IV, maintain the confidentiality of any information communicated to them by the other Participant in accordance with this Memorandum, and return or destroy, in accordance with the provisions of Section V, information obtained from the other Participant in accordance with this Memorandum.

VII. Legal Effect

Nothing in this Memorandum is intended to:

1. Create binding legal obligations.
2. Create obligations or expectations of cooperation that would exceed a Participant’s jurisdiction.

Signed in duplicate in the English and French languages, each version being equally authentic.