I promised to keep the membership up-to-date on the consultation process for the Provincial Private Sector Privacy Legislation.

On November 13, 2002, here in Victoria, Richard Dancy (of AABC's PAAL Committee) and I met with Chris Norman, Director of Corporate Privacy and Information Access Branch, Ministry of Management Services. We discussed further some of the issues brought up during our previous meeting in August. We were invited to submit a short brief with our recommendations by the end of November (see below). Following our submission, Chris Norman informed me that CPIAB will keep the AABC up-to-date on the drafting process. Provincial legislation must be in place by 2004 (for more information, please visit the CPIAB web page - www.mser.gov.bc.ca/FOI_POP/psp/pspinbc.htm)

My thanks to Richard Dancy and Ian Forsyth for their expert assistance.

- Lara Wilson, President

*  *  *

Re: Private Sector Privacy Legislation

This brief contains the recommendations of the Archives Association of British Columbia (AABC) respecting the proposed legislation on protecting private sector privacy. There are two parts; we give our suggestions on archives-specific language in section (i), and the more detailed rationale is given separately in section (ii).

(i) Language

Purpose of the Act

The Act should recognize the preservation of British Columbia's private-sector documentary heritage as a public good that promotes knowledge and public accountability, and safeguards citizens' rights; and that in preserving and providing access to the historical record, there needs to be a balance between the individual’s right to privacy and the public interest.

Scope of the Act

There are two considerations with respect to the Act's scope.

First, the AABC recommends that the Act not apply retroactively to private records donated to public or private sector archives before the Act’s proclamation date. Private records are usually donated, by a private citizen or organisation to an archives, by means of a written donation agreement. The agreement is a legally binding contract transferring ownership and control of property according to specific terms and conditions negotiated between the parties. This includes access to the records. Retroactive application of the Act might serve to render null and void any access to information provisions inserted by the parties to the contract, and thereby frustrate their intent. Furthermore, it might restrict public access to previously accessible private records. Donors, the research community, and the public may be angered, and may even undertake litigation against the provincial government.

The second consideration is that the Act should specify its application to the private-sector records donated to public or private sector archives after the law is proclaimed. The AABC recommends an application to the records of private corporate bodies only, and not to family papers or personal papers, though we acknowledge that this is an ambiguous area.

We think that privacy rights of individuals in relation to family and personal papers can be protected with a clause like the following:

The Act applies to personal information contained in records deposited in an archives which were made or received by a corporate body or by officer of a corporate body in the conduct of his or her official duties; it applies to these records even where the officer has retained the records among his or her personal or family papers.

The Act does not apply to family and personal papers deposited in an archives except where these include corporate records as defined above.

This would cover cases where organisational business records have found their way into personal papers (e.g. constituency correspondence in an MLA's papers, patient information in a doctor's papers, university or student records in faculty papers, member information in a trade unionist's papers).

Definitions should address the criteria by which a group will be considered an organisation for the purposes of the Act (e.g. must it be registered under an Act, e.g. the Societies Act?).

Retention of personal information

The Act should specify a minimum retention period of 1 year for personal information used to make a decision that affected an individual (this would parallel the FOI Act, section 31). We recommend that the Act also state that organisations should develop written policies governing their retention of all records containing personal information with respect to minimum and maximum retention periods.

Individuals' right of access to their own personal information

In the section giving individuals a right of access to their personal information that is held by private-sector organisations, state that this applies even where organisations have deposited the records in an archives, and have transferred legal custody, control, and property rights over the records to another institution.

Disclosure for archival, historical and research purposes

A separate section of the Act should address the issues arising from its application to archival holdings. Language in this section should be harmonized with the public-sector Freedom of Information and Protection of Privacy Act, sections 22 (disclosure harmful to personal privacy), 33(m) (disclosure to an archives for archival purposes), 35 (disclosure for research or statistical purposes) and 36 (disclosure for archival or historical purposes).

This section would establish:

(i) the right of an organisation to disclose without consent third-party personal information contained in its records for archival purposes (i.e. permit it to provide access to archivists so they can undertake their work of appraising records, selecting records for acquisition, arranging and describing records and undertaking conservation activities on records).

(ii) the right of an organisation to donate records containing third-party personal information to archives without the consent of the individuals to whom the personal information belongs; and the right of archives to acquire such donations.

(iii) the right of access of individuals to third-party personal information contained in private sector records deposited in the archives, if such access would not constitute an unreasonable invasion of an individual's privacy.

This implies a harm test. The terms of this could be taken from section 22 of the FOI Act. The main considerations for archives fall under the following criteria:

- public availability of information (is the personal information already available in the public domain?);

- sensitivity of the personal information (what type is it, is it current or has its sensitivity diminished with the passage of time?);

- probability of injury (could the release of the information reasonably be expected to cause specific harm or injury that is current and probable, what detailed evidence of facts exist to prove this conclusion?);

- context of the record (can information in a record be linked to other records in order to reveal more personal information about an individual than is contained in the record?).

(iv) the right of an archives to disclose without consent personal information for research, statistical, archival, or historical purposes. The language could be taken directly from sections 35 and 36 of the FOI Act. These sections provide for disclosure without research agreements in limited circumstances (not an unreasonable invasion of privacy under terms of section 22; or person has been dead for 20 years or more; or record has been in existence for 100 years or more); and for disclosure only under a research agreement in other circumstances.

We would point out that the Legislative Assembly's Special Committee to Review the Freedom of Information and Protection of Privacy Act recommended in its 1999 Report (Recommendation #8) "That section 36(d) of the FIPPA be amended to reduce the general restriction on archived personal information from 100 to 70 years." This is a recommendation the AABC has made on several occasions and we reiterate it now with respect to a time-threshold clause in a parallel private-sector Act. A 100-year restriction is excessive and unnecessary, because the person who is the subject of the record(s) will be a minimum of 70 years old if it is assumed that the information is about a newborn on the date the record is created.

(ii) Rationale for AABC recommendations

Purpose of the Act

One of the core privacy principles is a limitation on use, disclosure and retention. The CSA Model Code states (principle 5) that "Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes." Taken without qualification, this would destroy the legitimacy of archives, since archival research is founded upon the secondary use of primary sources. This is true of scholarly research, genealogical inquiries, and the use of archives for legal redress of past inequities. The internment of Japanese-Canadians during World War II, aboriginal land claims, immigration of Nazi war criminals, tainted blood scandal, and the exposure of abuse at residential schools furnish prominent examples of citizens using personal information for purposes other than those for which it was collected in order to protect legal rights. Private-sector archival records (especially church archives) have been vital sources of evidence in this context.

This is not to deny the legitimacy of the privacy principle, but to recognize the legitimacy of archival preservation as a public good, acknowledge that these goods may conflict, and that the legislation should enable society to strike a balance.

Scope of the Act

We acknowledge that for purposes of privacy protection, the drawing of a principled distinction between corporate records and personal or family papers in a piece of legislation may be difficult; and that if the language in a section on disclosure for archival and historical purposes is well-drafted, application of the act to family and personal papers becomes less problematic. Nevertheless, with the aim of trying to make a distinction, we offer the following examples and analysis.

Example: the papers of an MLA include constituency correspondence containing sensitive personal information. The records are then donated to an archives as private, personal papers. The privacy rights of constituents need to be protected.

In this case, it could be argued that the MLA acquired third-party personal information not as a private individual but as an elected official of the Legislative Assembly in the course of carrying out his or her official duties. The constituent supplies personal information in the expectation that it is required if the MLA is to be able to perform his or her job of acting on behalf of the constituent. A similar situation can arise in other private papers. For example, faculty papers in university archives often include records a professor made or received while carrying out university duties (e.g. sitting on a tenure review committee, marking student assignments). One could argue that, strictly speaking, these are not "private records" but rather university records that happen to be intermixed with private papers. The practice at Simon Fraser University, for example, is to handle access to these types of records in accordance with the provisions of the FOI Act, even though the records are found in a donation of private papers.

In these kind of cases, the privacy rights of individuals could be protected by applying the act to records made or received by a corporate body, or by an individual officer of a corporate body in the course of carrying out his or her duties as an officer – regardless of who had custody of the record or where they were filed. In this way the act would not apply to personal or family papers as such, but would apply to organisational business records which the officer retained among his or her own papers.

Another example illustrates the negative consequences of not making this distinction. Author A donates his papers to an archives, and these include correspondence between A and B containing their opinions about C. This is not personal information supplied or received in an organisational context for the purpose of conducting a transaction. It is information freely circulated between private individuals. If the act applies to these records, A and B's opinions about C become the personal information of C and C has certain rights in relation to them. Donor A may wish his papers to be open, but C demands restrictions on access to the correspondence on the grounds that it is his personal information. Conversely, A may wish to restrict access to the correspondence for a certain number of years but C has the right of access to them because it his personal information. In these scenarios, the application of the act would seem to be an illegitimate intrusion of public power into private matters: the free expression of opinion by private citizens on the one hand and the free disposition of personal and private property on the other.

We urge therefore that the act distinguish between personal information created (made or received) by officers in the context of organisational business (which should be covered by the act) from personal information freely circulated between individuals as private individuals (which should be excluded from the act). The act should apply to corporate records that have found their way into personal or family papers, but not to personal or family papers as such.

Retention of personal information

Except for the 1-year minimum retention of personal information used in decision-making, we do not recommend that the Act prescribe specific retention periods. However, by stating that organisations "should" develop written retention policies tailored to their own business requirements (as the PIPED Act does in Schedule 1, clause 4.5.2), the Act would provide a principle that could be elaborated in sectoral codes and guidelines: the idea that personal information has a "shelf life", that sound information and records management supports effective administration of access and privacy rights and minimizes the risk of unauthorized access.

Individuals' right of access to their own personal information

Donors and archives negotiate access restrictions and incorporate these into Donor Agreements. These agreements typically do not distinguish between third-party access rights and an individual's own access rights to his or her own personal information. Donors and archives will need to adjust this practice in future, since these agreements will be subordinate to the Act. Having an explicit statement in the Act to this effect will likely help smooth the adjustment, or at least make clear the need for it.

Disclosure for archival, historical and research purposes

This section would enable archival repositories to undertake their work with private sector records: appraising records containing personal information (which may or may not be acquired); acquiring the records; providing access to the records.

It would establish rights for 4 groups: organisations considering donating records (permitting them to disclose the records to archivists for purposes of appraisal); donors (permitting them to make donations); archives (permitting them to appraise, acquire and provide access); and researchers (permitting them the right of access subject to specific and limited exceptions).

Respectfully submitted on behalf of the AABC,
Lara Wilson - President
Richard Dancy - Public Awareness, Advocacy, and Archives Legislation Committee

Back to Table of Contents

© 2003 Archives Association of British Columbia