- Download the Part X guide
- Terms used in this guide
- Does Part X of the CYFSA apply to you?
- Collection, use, and disclosure of personal information
- Consent and capacity
- Elements of consent
- Consent may be implied in some cases
- Consent may be written or verbal
- Presumption of consent’s validity
- Conditional consent and withdrawal of consent
- Capacity to consent
- Substitute decision-makers
- Safeguarding and managing personal information
- Access to records of personal information
- Individual’s right of access
- Access exceptions
- Is the record dedicated primarily to the provision of service to the individual?
- How are access requests made?
- Service provider’s response to access requests
- Substitute decision-makers can request access
- Correction of records
- Offences and immunity
- The role of the Information and Privacy Commissioner
a) What is personal information?
Part X applies to personal information, which means “recorded information about an identifiable individual.”10 It does not apply to records that contain no personal information. For example, this might include things like capital funding records, organizational policies, or building contracts.
Information is about an identifiable individual if:
- it is about the individual in a personal capacity
- the individual can be identified from the information (either alone or by combining it with other information)
Examples include a person’s name when combined with other information about them, such as their address, sex, age, education, or medical history. This is not a complete list; many other kinds of information may still qualify as personal information. Even without a name, a record may contain personal information, if the individual can be identified.
Personal information can be recorded in any format, including:
- paper records, such as written case notes
- electronic records, such as in a client information system
- photographs and video footage, including from security cameras
When a service provider is collecting information, the definition of “personal information” also includes information that is not recorded. This means that when a service provider collects personal information, they must follow the rules of Part X even if the information is collected verbally, for example through a phone call or intake interview.11
It doesn’t matter whether a record was created before or after Part X came into force. Even if an individual’s personal information was recorded many years before, they have a right to access their record and you must protect it against privacy breaches.12
This post is also available in: French