Collecting Personal Information
Government organizations are required to collect personal information in accordance with the rules set out under the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). Health information custodians are required to collect personal health information in accordance with the rules set out under the Personal Health Information Protection Act (PHIPA).
Government organizations collect personal information as part of their role in providing services to the public. Individuals give their personal information to a government organization when they fill out an application for programs or services, such as a health card or a building permit. Under FIPPA and MFIPPA, “no person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.”
Government organizations must provide notice to individuals whenever personal information is collected. The notice should specify the legal authority for the collection, the primary purpose of the collection, and who to contact to obtain more information about the collection. For more information about how to provide notice of collection, please refer to Practices No. 8 - Providing Notice of Collection.
Health information custodians generally collect personal health information for the purpose of providing or assisting in providing health care. This information may be collected in several ways, such as when a doctor makes notes about a patient in their medical file or an individual undergoes testing at a laboratory. In general, custodians may only collect personal health information if the individual consents or if PHIPA specifically permits the collection without consent. Consent for the collection of personal health information may be express or implied. With limited exceptions, health information custodians must collect personal health information directly from the individual involved. Custodians may only collect personal health information if other information will not serve the purpose of the collection and may only collect as much information as is necessary to meet the purpose of the collection.
Custodians must take reasonable steps to inform the public about their information practices and how individuals may exercise their rights under PHIPA. Some suggested methods of meeting this requirement include the use of visible brochures, posters, notices posted on walls and verbal explanations. For more information on the collection of personal health information under PHIPA, please refer to our paper, A Guide to the Personal Health Information Protection Act.