The proposed amendments in Bill C-29, An Act to amend the Personal Information Protection and Electronic Documents Act are pretty broad-reaching. One of the provisions I've been anticipating is cleaning up the messy "lawful authority" term used in Section 7(3).
I am suprised by how this was proposed in the Bill (the underlined bits are added by Bill C-29):
(3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is ...(c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;
(c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that(i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,
(ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law, or
(iii) the disclosure is requested for the purpose of administering any law of Canada or a province;
(iv) the disclosure is requested for the purpose of communicating with the next of kin or authorized representative of an injured, ill or deceased individual, or
(v) the disclosure is requested for the purpose of performing policing services that are not referred to in subparagraph (i), (ii) or (iv);
But wait ... there's more. Section 7(3.1) clarifies "lawful authority" by saying what it isn't. (Which is already what you could clearly infer by reading the legislation as originally passed.)
(3.1) For greater certainty, for the purpose of paragraph (3)(c.1)
(a) lawful authority refers to lawful authority other than(i) a subpoena or warrant issued, or an order made, by a court, person or body with jurisdiction to compel the production of information, or
(ii) rules of court relating to the production of records; and
(b) the organization that discloses the personal information is not required to verify the validity of the lawful authority identified by the government institution or the part of a government institution.
For greater certainty? Really? Just to be clear, lawful authority is lawful authority. Crystal clear. Thanks.