On March 26, 2020 the Minister of Citizens' Services (the "Minister") issued Ministerial Order No. M085 (the "Order") under sections 33.1(3) and 33.2(a) and (c) of the Freedom of Information and Protection of Privacy Act, R.S.B.C. 1996, c.165 ("FIPPA"), the privacy legislation that governs the collection, use and disclosure of personal information by a governmental entity in British Columbia (each, a "Public Body"). The Order creates temporary exceptions to FIPPA's restrictions on the disclosure of personal information outside of Canada, permitting certain disclosures of personal information outside of Canada to allow a Public Body to better adapt to the COVID-19 pandemic. The Order will remain in effect until June 30, 2020, unless rescinded or extended by the Minister.
Freedom of Information and Protection of Privacy Act
FIPPA generally restricts a Public Body and the service providers providing services for Public Bodies from disclosing, accessing or storing personal information outside of Canada, with few limited exceptions. This has, historically, limited the adoption of certain technological solutions that rely on the storage of personal information outside of Canada or the access of personal information from outside of Canada. The Order temporarily removes these restrictions where disclosures outside of Canada are made to address issues that have arisen due to the COVID-19 pandemic.
Ministerial Order No. M085
Under the Order, two temporary exceptions to FIPPA have been created:
1. Under section 33.1(3) of FIPPA, a Public Body in the health care sector such as a hospital, regional hospital district, mental health facility, regional health authority and British Columbia Emergency Health Services (each, a "Health Care Body") may now disclose personal information outside of Canada, for the purpose for which the personal information was obtained or compiled, or for a use consistent with that purpose, for the purposes of:
a. communicating with individuals respecting COVID-19;
b. supporting a public health response to the COVID-19 pandemic; or
c. coordinating care during the COVID-19 pandemic.
2. Under section 33.2(a) or (c) of FIPPA, a Public Body may now use tools and applications (including communication and collaboration software tools created by third party service providers) to disclose personal information outside of Canada, for the purpose for which the personal information was obtained or compiled, or for a use consistent with that purpose, provided that:
a. the third-party tools or applications are being used to support and maintain the operation of programs or activities of the Public Body;
b. the third-party tools or applications support public health recommendations or requirements related to minimizing transmission of COVID-19 (e.g. social distancing, working from home, etc.); and
c. any disclosure of personal information is limited to the minimum amount reasonably necessary for the performance of duties by an employee, officer or minister of the public body.
A Public Body must not disclose information under the two exceptions unless the head of the Public Body is satisfied that any third-party application used is reasonably secure (as required by section 30 of FIPPA). Public Bodies must also make all reasonable efforts to remove and retain personal information disclosed to third-party applications as soon as it is operationally reasonable.
The Order temporarily removes a hurdle that has prevented a Public Body from using certain technological innovations made available by service providers with operations outside of Canada; often where it could do so more efficiently or economically.
For the duration of the Order, a Public Body may procure solutions from service providers that ordinarily would not satisfy FIPPA's "Canada-only" storage and disclosure requirements so long as those solutions fit the new exceptions. As a result of the temporary nature of the Order, a Public Body should only make changes or adopt new tools and applications in the short term, and not ones that they cannot easily abandon.
The Order should give options and flexibility to enable the BC government to use its existing tools and acquire other tools to more quickly address the COVID-19 pandemic, by effectively communicating and sharing information with other jurisdictions and organizations like the World Health Organization.