Direct collection

When service providers collect information directly, they usually do so with consent. This consent may be implied or you can choose to seek explicit consent.26

Implied consent is consent that is not given specifically, but which can be inferred based on the individual’s actions and the facts of a particular situation. For example, if a youth expresses interest in a program and volunteers their personal information to enroll, their consent for the collection of their information may be implied.

In this guide, we use the term explicit consent to refer to consent that is more than just implied. It must be stated explicitly, either verbally or in writing. For example, although explicit consent is not required for direct collections of personal information, you may decide it is a good practice to ask all new clients to sign a consent form before you collect their information.

Under Part X, when you directly collect personal information from any person, you must give them notice that you may use or disclose their information in accordance with Part X.27 There are various ways you could give this notice. For example, you could advise the individual that their information may be used or disclosed in accordance with Part X and answer any questions they may have. You could also direct the person to a written statement about your information practices under Part X.

Sometimes you may need to collect information directly from an individual who is not capable of giving consent.28 For example, a children’s aid society conducting a protection investigation may need to interview a toddler separately from his parents. Service providers may directly collect personal information from an incapable person without consent in three situations. The collection must be reasonably necessary either to:

  • provide a service, where it is not possible to obtain consent (for example, from a substitute decision-maker) in a timely manner
  • assess, reduce or eliminate a risk of serious harm to any person or group
  • assess, reduce or eliminate a risk of harm to a child (if you are a children’s aid society)

 

Some of the rules for collection, use and disclosure of personal information are based on whether something is “reasonably necessary.” What does this mean?

  • Part X does not define the term “reasonably necessary.” It is context-specific.
  • In general, for something to be necessary, it must be more than merely helpful.
  • The standard here is one of reasonableness. For example, even if you don’t know for sure, is it reasonable to believe that the collection of information is necessary to assess, reduce or eliminate a risk of serious harm to a person or group?

 

26. CYFSA, s. 295(2)
27. CYFSA, s. 290
28. CYFSA, s. 289

This post is also available in: French