- Download the Part X guide
- Terms used in this guide
- Does Part X of the CYFSA apply to you?
- Collection, use, and disclosure of personal information
Consent and capacity
- Elements of consent
- Consent may be implied in some cases
- Consent may be written or verbal
- Presumption of consent’s validity
- Conditional consent and withdrawal of consent
- Capacity to consent
- Substitute decision-makers
- Safeguarding and managing personal information
Access to records of personal information
- Individual’s right of access
- Access exceptions
- Is the record dedicated primarily to the provision of service to the individual?
- How are access requests made?
- Service provider’s response to access requests
- Substitute decision-makers can request access
- Correction of records
- Offences and immunity
- The role of the Information and Privacy Commissioner
How are access requests made?
While you can choose to respond to verbal or informal requests for access, the request must be in writing for the procedural access rules of Part X to apply.98 There is no requirement in the CYFSA for individuals to use a certain form or to submit the request in a certain way. Even if you’d prefer for individuals to make access requests by filling out a designated form, you must still respond to requests that come in other formats, such as email.
In addition, there is no requirement for a person requesting access to a record to specify that they are seeking access under Part X of the CYFSA. However, it may be helpful to clarify this with the requester in certain circumstances, such as where more than one privacy and access law could apply.
Access requests must include enough detail to enable you to identify and locate the record with reasonable effort. If a request does not contain enough detail, you must offer to assist the requester in clarifying the request.99 You should do so as soon as you receive a request that is not sufficiently detailed. Once the request contains sufficient detail, your 30-day timeline for response begins.
A former client emails you to request a copy of her complete file. She provides her first and last name, but no other identifying details. You check your case management system and see three people with the same name. This means you are unable to identify which are the requester’s records.
You assist the requester in clarifying her request by replying the following day to advise that you require additional information, such as her date of birth, to locate the records. One week later, you receive a reply containing the necessary information. At this point, the access request has been made, and you have 30 days in which to respond.