Appendices

• Age, sex and other demographic information
• Length of residence
• Attitudes toward a new teen drop-in health service
• Use of new service
• Health history

• To identify factors that influence community acceptance and use of teen drop-in health services
• To assess the impact over time of the new clinic on reducing health problems and teen pregnancies among teens in rural communities

• Observation of teen activities or review of service records in a number of rural communities, some with new teen health services and some without
• Interviews with health care providers and patients
• Interviews or surveys of teens and adults in the community

• Age, sex and other demographic information
• History of asthma and other medical conditions
• Medication history
• Meaning of illness

• To assess the impact on health of a new asthma drug
• To identify barriers to proper use of a drug
• To identify the impact of asthma on quality of life
• To explore the meaning of illness in asthma patients

• Clinical trials (see TCPS, Section 7 for more information about clinical trials)
• Interviews with asthma patients and parents
• Survey of asthma patients
• Focus groups of clinic personnel

• Age, sex and other demographic information
• Family history
• Health and treatment history
• Dietary habits
• Exposures to cancer risks in the environment
• Blood sample
• Meaning of "hereditary" and "risk", in relation to genetic screening

• To examine interactions of genes and the environment in causing cancer
• To determine the need for education materials (for physicians and patients) about the risk of inheriting cancer
• To assess the impact on family members of screening for disease

• Telephone or mailed surveys
• In-depth interviews
• Laboratory analyses of blood samples collected at the time of the interview
• Long-term follow up by telephone or mail

• Age, sex and other demographic information
• Length of residence
• Refugee status
• Health history
• Use of health resources

• To identify barriers to accessing health care
• To identify psychosocial and health issues associated with resettlement
• To assess use of complementary and alternative medicines

• Participant observation research
• In-depth interviews
• Analysis of patient files
• Analysis of personal letters and journals

• Health insurance registration
• Physician diagnoses in billing records for provincial health insurance plans
• Hospital records

• To examine interactions between the environment and health
• To describe trends in disease and wellness over time
• To evaluate the impact of changes in the health care system

• Government Ministries of Health
• Hospitals
• Statistical agencies

• Records of all births, deaths, cause of death in a geographically defined population (e.g. a province)

• To assess the burden of disease in a geographic area
• Linked with health records, to assess prenatal and post-natal care and health outcomes, and long-term outcomes of health conditions (e.g. length of survival and cause of death)

• Provincial and Territorial registrars
• Statistical agencies

• A database that holds permanent, ongoing personal data about a population group affected by a particular disease (e.g. cancer) or condition, for statistical, surveillance and/or research purposes.

• To identify potential research participants
• To look at trends in new cases of disease
• To look for associations of disease and risk factors
• To assess the effectiveness of treatment
• Linked with death records, to assess survival and ultimate cause of death

• Government agencies
• Disease agencies
• Hospitals
• Statistical agencies

• Detailed data on medical history, psychosocial factors, patient status, care and associated health outcomes

• To identify potential research participants
• To evaluate the efficacy of treatment
• To look at continuity of care

• Physicians
• Disease clinics and institutes (e.g. diabetes, heart disease)
• Industry sponsors

• Primary materials (blood, bone and cultured tissue)
• Secondary materials (copies of primary samples such as cellular protein)
• Tertiary materials (electronically stored information such as DNA sequences)
• Linked clinical information

• To develop diagnostic methods
• To assess the genetic basis of variability in drug efficacy and safety (pharmacogenetics)
• To discover the genetic and biochemical causes of disease (often linked to hospital data and/or genealogy information)

• Government public health and research laboratories
• Private companies
• Universities
• Hospitals
• Clinical genetics clinics

• Public health data on chronic and communicable disease
• Reports of adverse health effects from marketed products

• To search for causes of disease outbreaks or increasing numbers of new cases
• To document the burden of disease in populations
• To describe long-term trends in health status at the community or population level.

• Government Ministries of Health
• World Health Organization
• Statistical agencies

• Demographic information, workplace conditions, health services availability
• Self-reported personal behaviours, health status, medical conditions, lifestyle, attitudes, values, and experiences

• To describe and assess the broad determinants of health (individual, biological, social, cultural, and environmental) and their impact on populations and individuals
• To describe and assess psychosocial factors in illness and disease and their individual, biological, social, cultural and environmental determinants

• Government departments
• Statistical agencies
• Researchers
• Universities
• Research centres

• Organizations that collect, use and disclose personal information in the course of a commercial activity (e.g., health care providers in private practice, pharmacies, pharmaceutical companies, etc.)^{Footnote 108} which takes place within a province unless the province has enacted legislation deemed by the Governor in Council to be substantially similar to the Act.^{Footnote 109}
• Federal works, undertakings and businesses that collect, use or disclose personal information, including personal information about employees in any province or territory.
• All personal information collected, used or disclosed in cross-border commercial transactions.
• Does not apply to government institutions subject to the Privacy Act.

• Federal government institutions (any department or ministry of state of the Government of Canada listed in the schedule to the Act or any body or office listed in the schedule to the Act).

• All organizations (e.g., health care providers in private practice, pharmacies, pharmaceutical companies, not-for-profit organizations).
• Does not apply to personal information if Freedom of Information and Protection of Privacy Act applies.

• Public bodies (e.g., governmental bodies, health authorities, hospitals, mental health facilities and universities).

• Applies to custodians with respect to health information (e.g., health professionals, health care facilities, regional health authorities, provincial health boards).
• Legislation also impacts ethics committees and researchers.

• All organizations, including not-for-profit, corporations, professional regulatory associations.
• Does not apply to health information (as defined in the Health Information Act) where the information is collected, used or disclosed by an organization for health care purposes including health research and management of the health care system.

• Public bodies (e.g., government departments, educational bodies, health care bodies and designated agencies, boards and commissions).
• Does not apply to health information in records of a public body that is a custodian as defined in the Health Information Act.

• Municipalities.

• Trustees with respect to personal health information (e.g., government institutions, regional health authorities, health professionals, health care organizations, professional regulatory bodies).
• Legislation also impacts researchers.

• Government institutions (e.g., government departments, Crown Corporations, designated provincial boards, bodies and agencies).
• Does not apply to information that constitutes personal health information as defined in The Health Information Protection Act.

• Local authorities (e.g., municipalities, universities, regional health authorities, special care homes, designated boards, commissions and bodies).
• Does not apply to information that constitutes personal health information as defined in The Health Information Protection Act.

• Trustees with respect to personal health information (e.g., health professionals, health care facilities, public bodies (including government departments and universities), health services agencies).
• Legislation also impacts health information privacy committees, the institutional research review committees and researchers.

• Public bodies (e.g. universities, certain hospitals, regional health authorities, municipalities, government departments and agencies).
• Does not apply to personal health information to which The Personal Health Information Act applies.

• Health information custodians, and agents of health information custodians, with respect to personal health information (e.g., Ontario Ministry of Health and Long-Term Care, public health units, hospitals, health care practitioners who provide health care, long-term care facilities, pharmacies, medical laboratories, ambulances, community health and mental health programs whose primary purpose is health care, Canadian Blood Services).
• Legislation also provides rules for research ethics boards, health data institutes, prescribed registries, persons who provide goods and services that enable a custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information, recipients of health information (e.g. researchers, employers and insurers).
• The legislation also applies to all persons with respect to the collection, use and disclosure of the health number.

• Institutions (e.g., ministries, agencies, boards and most commissions of the government of Ontario, community colleges).
• Where a health information custodian is also an institution under the Freedom of Information and Protection of Privacy Act ("FIPPA") or a part of an institution under FIPPA, FIPPA continues to apply to such a health information custodian only in some circumstances.
• Where a FIPPA institution is not a health information custodian, only FIPPA applies, even where information at issue is health information.

• Institutions (e.g. municipalities, boards of health, designated agencies, boards, commissions, corporations or other bodies)

• Public bodies (e.g., universities, cegeps, health care facilities, government departments and agencies).

• Persons carrying on an enterprise (e.g., health care providers in private practice, pharmacies and private research companies).

• Public bodies (e.g., government departments, agencies, boards, designated education and health bodies).

• Public bodies (e.g., universities, hospitals, government departments and agencies).

• Municipalities.

• Public bodies (e.g., government departments, school boards, regional health authorities).

• Public bodies (e.g., universities, health boards, municipalities, government departments).

• Public bodies (e.g., government departments, agencies, boards, commissions and corporations).

• Public bodies (e.g., government departments, agencies, boards).

• Public bodies (e.g., government departments, agencies, boards).

Element #1 provides that researchers should, at the outset of the research design process, identify and document research objectives as a basis for determining what data will be needed for the research. The precise identification and documentation of the purposes for collection, use and disclosure of personal (health) information is critical for the purpose of complying with various requirements under privacy legislation, including requirements relating to the principles of limiting collection of personal information, obtaining consent for collection, use and disclosure of personal (health) information, and accountability and transparency. Statutory references to each of these requirements under Canadian privacy legislation can be found in the following concordance tables in this section:

• Element #2 - Limiting the Collection of Personal Data
• Element #4 - Managing and Documenting Consent
• Element #5 - Informing Prospective Research Participants about the Research
• Element #10 - Ensuring Accountability and Transparency in the Management of Personal Data

Section 4 (Collection of personal information)

Section 5 (Personal information to be collected directly from individual)

Section 11 (Limitations on collection of personal information)

Section 12 (Collection from source other than the individual)

Section 26 (Purposes for which information may be collected)

Section 27(1) (How personal information is to be collected)

Sections 18 to 21 (Collection of health information)

Section 22 (Duty to collect health information from individual directly)

Section 24 (Collection of health information by affiliate)

Section 57 (Duty to collect, use or disclose health information with highest degree of anonymity possible)

Section 58 (Duty to collect, use or disclose health information in a limited manner)

Section 68(a) (Health information to be used in data matching to be collected in accordance with the Act)

Section 7(1)(b) (Direct collection)

Section 11 (Limitations on collection)

Section 33 (Purposes for which information may be collected)

Section 34(1) (Direct collection)

Section 11 (Collection of health numbers)

Section 23 (Collection on a need to know basis)

Section 24 (Restrictions on collection)

Section 25(1) (Direct collection)

Section 25 (Purpose of information)

Section 26 (Manner of collection)

Section 13(1) (Restrictions on collection)

Section 13(2) (Limit on amount of information collected)

Section 14 (Source of information)

Section 26 (Collection of health numbers)

Section 36 (1) (Purpose of collection)

Section 36(2) (Limit on amount of information collected)

Section 37(1) (Manner of collection)

Section 30 (Extent of information)

Section 34 (2) (Limits on collecting health numbers)

Section 36(1) (Indirect collection)

Section 38(2) (Collection of personal information)

Section 39(1) (Direct collection)

Section 5 (Necessary information)

Section 6 (Collection from the person concerned)

Section 31 (Purpose of Collection of Information)

Section 32 (Direct collection)

Schedule A, Principle 4 (Limiting Collection)

Schedule B, Principle 4 (Individuals from whom personal information may be collected)

Section 32 (Purpose for which personal information may be collected)

Section 33 (How personal information is to be collected)

Section 29 (Purpose for which personal information may be collected)

Section 30 ( How personal information is to be collected)

Section 40 (Purpose of collection of information)

Section 41 (Collection of information from individual concerned)

Section 40 (Purpose of collection of information)

Section 41 (Collection of information from individual concerned)

Sections 7(2)(c): Conditions for use by an organization for statistical, or scholarly study or research purposes:

• purpose cannot be achieved without using the information;
• information is used in a manner that ensures confidentiality;
• impracticable to obtain consent; and
• organization informs the Commissioner of the use before information is used.

Section 7(3)(f): Conditions for disclosure by an organization for statistical, or scholarly study or research purposes:

• purpose cannot be achieved without disclosing the information;
• impracticable to obtain consent; and
• organization informs the Commissioner of the disclosure before information is disclosed.

Section 8(2)(j): Conditions for use and disclosure by a government institution for research or statistical purposes:

Head of the government institution:

• is satisfied that the purpose for disclosure cannot reasonably be accomplished unless the information is provided in identifiable form; and
• obtains from the person or body a written undertaking that no subsequent disclosure of the information will be made in identifiable form.

Section 21: Conditions for disclosure by organizations:

• Research purpose cannot be accomplished unless the personal information is provided in an identifiable form;
• information will not be used to contact persons to ask them to participate in the research;
• linkage of the personal information to other information is not harmful to the individuals and the benefits to be derived from the linkage are clearly in the public interest;
• the organization to which the personal information is to be disclosed has signed a data sharing agreement; and
• it is impracticable for the organization to seek the consent of the individual.

Section 35: Conditions for disclosure by public bodies:

• Research purpose cannot reasonably be accomplished unless information is provided in identifiable form or research purpose is approved by Commissioner;
• information is disclosed on condition that it not be used to contact a person to participate in the research;
• any record linkage is not harmful to the individuals and the benefits to be derived from the record linkage are clearly in the public interest;
• head of the public body concerned has approved conditions relating to (i) security and confidentiality; (ii) removal or destruction of individual identifiers at the earliest reasonable time; (iii) prohibition of any subsequent use or disclosure of the information in individually identifiable form without express authorization of the public body; and
• recipient has signed an agreement to comply with the approved conditions, the Act and any of the public body's policies and procedures relating to the confidentiality of personal information.

Sections 27(1)(d) and 35(1)(a): Conditions for use and disclosure by a custodian:

• Custodian submits a proposal to an ethics committee;
• ethics committee is satisfied with respect to importance of research, qualifications of researcher, safeguards and that it is not reasonable or practical to obtain consent; and
• custodian has complied with/agreed to conditions suggested by the ethics committee.

See also section 49 (Research proposal), section 50 (Role of ethics committee), section 51 (Bar to research), section 52 (Application for disclosure of health information), section 53 (Conditions and consents), section 54 (Agreement between custodian and researcher) and section 55 (Consent of the individual is required if additional information is needed).

Section 12(2): Conditions for disclosure by an archival institution:

• Disclosure is necessary for the research purpose;
• disclosure is not harmful to the individual concerned;
• research purpose is not contrary to the purposes and intent of the Act; and
• either (i)a reasonable person, taking into consideration all relevant circumstances, would find that disclosure of the personal information was appropriate at the time, or (ii) the information is disclosed under a research agreement.

Section 14(3): Conditions for disclosure by an organization that is not an archival institution:

• Research agreement required;
• recipient agrees to comply with the same requirements as those established in respect of archival institutions;
• research has been approved by a research ethics review committee; and
• researcher has agreed to any additional conditions imposed by the ethics review committee.

Section 42: Conditions for disclosure by public bodies:

• Research purpose cannot reasonably be accomplished unless that information is provided in identifiable form or research purpose has been approved by Commissioner,
• record linkage is not harmful to individuals and benefits to be derived from record linkage are clearly in public interest,
• head of public body has approved conditions relating to (i) security and confidentiality, (ii) removal or destruction of identifiers at the earliest reasonable time, and (iii) prohibition of subsequent use or disclosure without express authorization of that public body, and
• recipient signed an agreement to comply with approved conditions, Act and public body's policies and procedures relating to confidentiality of personal information.

Section 29(2): Conditions for disclosure by a trustee or designated archive:

• Only where not reasonably practicable for consent to be obtained and if:
  1. research purposes cannot reasonably be accomplished using de-identified personal health information or other information;
  2. reasonable steps are taken to protect privacy of individual by removing all personal health information that is not required for the purposes of the research;
  3. in the opinion of research ethics committee, the potential benefits of the research project clearly outweigh the potential risk to the privacy of the individual; and
  4. (i) in the opinion of the trustee or designated archive, the research project is not contrary to public interest; (ii) research project is approved by a research ethics committee approved by minister; and (iii) recipient enters into an agreement with trustee or designated archive.

Section 29(2)(k): Conditions for disclosure by public body:

• Head of public body must be satisfied that purpose for disclosure is not contrary to public interest and cannot reasonably be accomplished unless information is provided in identifiable form; and
• agreement must be signed by recipient not to make a subsequent disclosure of the information in identifiable form.

Section 28(2)(k): Conditions for disclosure by local body:

• Head of local body must be satisfied that purpose for disclosure is not contrary to public interest and purpose cannot reasonably be accomplished unless information is provided in identifiable form; and
• recipient provides written agreement not to make subsequent disclosure of the information in identifiable form.

Section 24: Conditions for disclosure by trustees:

• Research project must be approved by:
  1. health information privacy committee if personal health information is maintained by government or a government agency; and
  2. institutional research review committee, if personal health information is maintained by a trustee other than the government or a government agency.
• Approval may be given only if applicable committee has determined that:
  1. research is of sufficient importance to outweigh the intrusion into privacy;
  2. research purpose cannot reasonably be accomplished unless personal health information is provided in identifiable form;
  3. unreasonable or impractical for researcher to obtain consent; and
  4. research project contains (i) reasonable safeguards to protect confidentiality and security of the personal health information, and (ii)procedures to destroy the information or remove all identifying information at earliest opportunity consistent with the purposes of the project.
• Agreement required between trustee and recipient.
• Consent required for direct contact with individuals except where information consists only of individuals' names and addresses.

Section 47(4): Conditions for disclosure by public body:

• Advice requested from review committee has been received and considered;
• head is satisfied that (i) the information is requested for bona fide research purpose, (ii) research cannot reasonably be accomplished unless information is provided in identifiable form, (iii) unreasonable or impractical for recipient to obtain consent, and (iv) disclosure of information, and any information linkage, is not likely to harm individuals and benefits to be derived from research and any information linkage are clearly in the public interest;
• head of public body has approved conditions relating to (i)protection of personal information, including use, security and confidentiality, (ii) removal or destruction of identifiers at earliest reasonable time, and (iii) prohibition of subsequent use or disclosure of personal information in identifiable form without written authorization of the public body; and
• recipient has entered into a written agreement to comply with approved conditions.

Section 44(1): Conditions for use by health information custodians and disclosure by health information custodians to researchers:

• Researcher must submit to custodian (i) an application in writing, (ii) a research plan, and (iii) a copy of the decision of a research ethics board that approves research plan; and
• researcher must enter into an agreement with custodian agreeing to comply with conditions and restrictions that custodian may impose relating to use, disclosure, return or disposal of information.

See also sections 34(2) and (3) (Use and disclosure of health numbers) 37(1)(j) and (3) (Permitted use for research), section 44(2) (Elements of Research plan), section 44(3) and (4) (Consideration and decision of board), section 44(5) (Content of research agreement), section 44(6) (Compliance by researcher), sections 44(10) and (11) (Research approved outside Ontario) and section 50(1)(b) (Disclosure outside Ontario).

See also section 39(1)(c) (Disclosure to prescribed person who compiles or maintains a registry of personal health information for purposes of facilitating or improving the provision of health care or that relates to the storage or donation of body parts or bodily substances), section 45 (Disclosure to prescribed entities for planning and management of health systems) and section 47 (Disclosure for analysis of health system).

Section 12 (Disclosure of health number):

• Researchers with custody or control of health numbers, by reason of a use or disclosure authorized under the Act for research purposes, may disclose the health number to a registry prescribed under the Act, an entity prescribed for the purposes of planning and management of health systems or another researcher if,
  • the disclosure is part of a research plan approved under the Act, or
  • the disclosure is necessary for the purpose of verifying or validating the information or the research.

Section 15 (Requirement for research ethics board)

Section 16 (Requirement for a research plan)

Section 17 (Disclosure by researcher)

Section 18(3) and (4) (Rules applicable to section 45 prescribed entities for use and disclosure of personal health information for research purposes)^{Footnote 116}

Section 13(4) and (5) (Rules applicable to registries of personal health information for use and disclosure of personal health information for research purposes)^{Footnote 117}

Section 21(1)(e): Conditions for disclosure by public body:

• Disclosure is consistent with conditions or reasonable expectations of disclosure under which the personal information was provided, collected or obtained;
• research cannot be reasonably accomplished unless information is provided in identifiable form; and
• recipient has agreed to comply with the conditions relating to security and confidentiality prescribed by the regulations.^{Footnote 118}

Section 10(1): Terms and conditions a person must agree to before a head may disclose personal information to that person for a research purpose:

• Person shall use the information only for a research purpose set out in the agreement or for which the person has written authorization from the institution;
• the person shall name in the agreement any other persons who will be given access to personal information in a form in which the individual to whom it relates can be identified;
• before disclosing personal information to other persons, the person shall enter into an agreement with those persons to ensure that they will not disclose it to any other person;
• the person shall keep the information in a physically secure location to which access is given only to the person and to the persons given access;
• the person shall destroy all individual identifiers in the information by the date specified in the agreement; the person shall not contact any individual to whom personal information relates directly or indirectly without the prior written authority of the institution;
• the person shall ensure that no personal information will be used or disclosed in a form in which the individual to whom it relates can be identified without the written authority of the institution; and
• the person shall notify the institution in writing immediately if the person becomes aware that any of the conditions set out in this section have been breached.

Section 21: Conditions for disclosure:

• Written request must be made to the commission.
• Commission must be satisfied that (i) intended use is not frivolous and the ends contemplated cannot be achieved unless the information is communicated in identifiable form and (ii) information will be used in manner that ensures its confidentiality.
• Authorization is granted for such period and on such conditions as may be fixed by the Commission. It may be revoked before the expiry of the period granted if Commission has reason to believe that the authorized person or body does not respect the confidentiality of the information disclosed or the other conditions.

Section 125: Conditions for disclosure:

• Same conditions as above.

Section 39: Conditions for disclosure by public body:

• Research purpose cannot reasonably be accomplished unless information is provided in identifiable form or research purpose has been approved by Commissioner;
• any record linkage is not harmful to individuals and benefits to be derived from record linkage are clearly in public interest;
• head of a public body has approved conditions relating to (i) security and confidentiality, (ii) removal or destruction of individual identifiers at earliest reasonable time, and (iii) prohibition of subsequent use or disclosure of information in identifiable form without express authorization of that public body; and
• recipient signs agreement to comply with approved conditions, Act and public body's policies and procedures relating to confidentiality of personal information.

Section 29: Conditions for disclosure by public body:

• Research purpose cannot reasonably be accomplished unless information is provided in identifiable form;
• any record linkage is not harmful to individuals and benefits to be derived from record linkage are clearly in public interest;
• head of a public body has approved conditions relating to (i) security and confidentiality, (ii) removal or destruction of individual identifiers at earliest reasonable time, and (iii) prohibition of subsequent use or disclosure of information in identifiable form without express authorization of that public body; and
• recipient signs agreement to comply with approved conditions, Act and public body's policies and procedures relating to confidentiality of personal information.

Section 485(4): Conditions for disclosure by municipality:

• Research purpose cannot reasonably be accomplished unless information is provided in individually identifiable form;
• any record linkage is not harmful to individuals the information is about and the benefits to be derived from record linkage are clearly in the public interest;
• the responsible officer has approved conditions relating to (i) security and confidentiality, (ii) the removal or destruction of individual identifiers at the earliest reasonable time, and (iii) the prohibition of any subsequent use or disclosure of that information in individually identifiable form without the express authority of the municipality; and
• the person to whom the information is disclosed has signed an agreement to comply with the approved conditions, this Part of the Act, and any of the municipality's policies and procedures relating to the confidentiality of personal information.

Section 41: Conditions for disclosure by public body:

• Same conditions as for Nova Scotia

Section 38: Conditions for disclosure by public body:

• Same conditions as for Nova Scotia

Section 49: Conditions for disclosure by public body:

• Same conditions as for Nova Scotia

Section 49: Conditions for disclosure by public body:

• Same conditions as for Nova Scotia

Schedule 1, 4.3 and 4.3.1 (Consent Requirement)

Schedule 1, 4.3.4, 4.3.6 and 4.3.7 (Form of Consent)

Schedule 1, 4.3.2, 4.3.5, 4.3.8 (Elements of Consent)

Sections 6 and 7 (Consent Requirement)

Section 8 (Form of Consent)

Section 9 (Elements of Consent)

Section 6 (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to disclosure of personal information must be in writing and specify to whom the personal information may be disclosed and how the personal information may be used.

Section 34(1) and (3) (Consent Requirement)

Section 34(2), (4), (5) and (6) (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to disclosure of personal health information must be in writing or be provided electronically and must include:

1. authorization for custodian to disclose the health information specified in the consent;
2. purpose for which the health information may be disclosed;
3. identity of person to whom health information may be disclosed;
4. acknowledgment that individual providing consent has been made aware of reasons why the health information is needed and the risks and benefits to the individual of consenting or refusing to consent;
5. date consent is effective and date, if any, on which consent expires; and
6. statement that consent may be revoked at any time by the individual providing it.^{Footnote 120}

• Revocation of consent must be provided in writing or electronically.

Section 6(2) (Electronic Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

An electronic consent or a revocation of an electronic consent is valid only if the level of authentication is sufficient to identify the individual who is granting the consent or revoking the consent, as the case may be.

Section 7 (Consent Requirement)

Section 8 (Form of Consent)

Section 9 (Withdrawal or variation of consent)

Section 10 (Consent obtained by deception)

Section 6(1) (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to use or disclosure of personal information must be in writing and must specify to whom the personal information may be disclosed.

Sections 5, 26 and 27 (Consent Requirement)

Sections 6(1) and (2), and 7 (Elements of Consent)

Sections 6(3),(4) and (5) (Form of Consent)

Section 18 (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to be in writing unless the head of the public body determines that it is not reasonably practicable.

Section 11 (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to be in writing unless the head of the local body determines that it is not reasonably practicable.

Section 29 (Consent Requirement)

Sections 18(1), 18(5), 18(6) and 19 (Elements of Consent)

Section 18(2), (3) and (4) (Form of Consent)

Sections 12 and 13 (Consent Requirement)

Section 14 (Elements and Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent must be manifest, free and enlightened^{Footnote 121}

Section 6 (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to use or disclose personal information must (a) be in writing and (b) specify to whom the personal information may be disclosed and how the personal information may be used.

Sections 7(2) and 8 (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to use of personal information must (i) be in writing, (ii) identify the information, and (iii) specify to whom the information may be disclosed and how the information may be used.^{Footnote 122}

Schedule A, Principle 3 (Consent Requirement)

Schedule B, 3.1 and 3.2 (Form of Consent)

Section 2 (Consent to disclosure of personal information)

Supplemental Requirement to CIHR Privacy Best Practices:

Consent to disclosure to be in writing and specify to whom the personal information may be disclosed and how it may be used.

Section 5 (Form of Consent)

Supplemental Requirement to CIHR Privacy Best Practices:

The consent of an individual to a public body's use or disclosure of his or her personal information must be in writing and specify to whom the personal information may be disclosed and how it may be used.

Supplemental Requirement to CIHR Privacy Best Practices:

The consent of an individual to a public body's use or disclosure of his or her personal information must be in writing and specify to whom the personal information may be disclosed and how it may be used.

Section 2 (Who may act for minors and others)

Section 3 (Who may act for deceased persons)

Section 4 (Determination of nearest relative)

Section 5 (Substitute decision-maker)

Sections 23 and 26 (Persons who are entitled to consent to the collection, use, or disclosure of personal health information)

Section 25 (Authority of substitute decision-maker)

Section 27 (Appointment of representative)

Schedule 1, 4.2 (Purpose for collection must be identified at the time of collection and must be documented)

Schedule 1, 4.3.2 (Knowledge and consent)

Section 27(2) (Information to be given regarding purposes for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

   

Sections 21(2) and 22(3) (Information to be given regarding purposes for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the specific legal authority for the collection.

Section 34(2) (Information to be given regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

Section 25(2) (Individual to be informed of purposes of collection)

Section 57(l) (Lieutenant Governor in Council may make regulations prescribing any matter to be included in notice)

Section 37(2) (Individual must be informed of the purposes for the collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information

Section 39(2) (Information to be given regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

Section 29(2) (Individual must be informed of primary purposes of collection)

Supplemental Requirement to CIHR Best Practices:

• Individual must be told of the legal authority for collecting the information

Section 4(1) (When notice not required)

• Institutions not required to give notice of collection if providing notice would frustrate purpose of the collection or might result in an unjustifiable invasion of another individual's privacy. Head of institution must make available a statement describing purpose of collection and reason why notice not given.

Section 65 (Information to be given regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Every person who, on behalf of a public body, collects nominative information from the person concerned or from a third person must first identify himself and inform the person concerned that the collection is either mandatory or optional and of the consequences of failing to provide the information.

Section 32(2) (Right to be informed regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

Section 8 (Requirement before use)

Supplemental Requirement to CIHR Privacy Best Practices:

• Before information about an individual may be used, the individual must identify the information and give consent in writing specifying to whom the information may be disclosed and how the information may be used

Section 33(2) (Information regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

Section 30(2) (Information regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

Section 41(2) (Information regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

Section 41(2) (Information regarding purpose for collection)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual must be told of the legal authority for collecting the information.

Schedule 1, 4.7 (Safeguards for protecting personal information)

Schedule 1, 4.1.4 (Policies and practices to be implemented to protect personal information)

Section 5 (Policies and practices)

Section 34 (Protection of personal information)

Section 30 (Protection of personal information)

Supplemental Requirements to CIHR Privacy Best Practices:

• Information must be stored in Canada and accessed only in Canada unless the individual the information is about has identified the information and has consented, in the prescribed manner^{Footnote 132}, to it being stored in or accessed from, as applicable, another jurisdiction or if it is stored in or accessed from another jurisdiction for the purpose of disclosure allowed under the Act (section 30.1).
• Where a public body receives a foreign demand for disclosure, the head of the public body must inform the Minister responsible for the Act (section 30.2(2)).

Section 60 (Duty to protect health information)

Section 63 (Duty to establish or adopt policies and procedures)

Section 8 (Record of safeguards to be maintained)

Supplemental Requirements to CIHR Privacy Best Practices:

• Written agreement required with respect to safeguards for health information that is to be stored, used or disclosed outside Alberta unless used for continuing treatment and care (section 8(4) and (5)).

Section 6 (Policies and practice)

Section 34 (Protection of information)

Section 38 (Protection of personal information)

Sections 40(1)(h)and(i) and 40(4) (Authorization to disclose personal information to officers and employees for purposes of carrying out their functions)

Section 16 (Duty to protect)

Section 23 (Collection, use and disclosure on a need-to-know basis)

Supplemental Requirement to CIHR Privacy Best Practices:

• Individual to be informed about disclosures of personal health information made without consent (section 10(1)).

Section 18 and 19 (Security Safeguards)

Section 20(3) (Limitation on trustee's employees)

Section 2 (Written security policy and procedure)

Section 3 (Access restrictions and other precautions)

Section 4 (Additional safeguards for electronic health information systems)

Section 5 (Authorized access for employees and agents)

Section 6 (Orientation and training for employees)

Section 7 (Pledge of confidentiality for employees)

Section 8 (Audit)

Supplemental Requirements to CIHR Privacy Best Practices:

• Audit of security safeguards to be conducted every 2 years (sections 2 and 8).
• Each employee and agent must sign a pledge of confidentiality that includes an acknowledgement that he or she is bound by the policy and procedures and is aware of the consequences of breaching them (section 7).

Section 10 (Information Practices)

Section 12 (Security)

Section 13 (Handling of Records)

Supplemental Requirements to CIHR Privacy Best Practices:

• An individual shall be notified at the first reasonable opportunity if the information is stolen, lost, or accessed by unauthorized persons. However, a researcher shall not notify the individual unless the health information custodian obtains the individual's consent to having the researcher contact the individual and informs the researcher that the individual has given consent (section 12(2) and(3)).
• A health information custodian may disclose personal health information to an entity prescribed pursuant to section 45 of the Act^{Footnote 133}, if the Commissioner has approved the practices and procedures of the entity (sections 45(3)).
• The Commissioner must approve the practices and procedures of a health data institute (sections 47(9) and (10)).

Section 6(3) (Prescribed requirements for health information network provider.)

Supplemental Requirements to CIHR Privacy Best Practices:

• Health information custodian may transfer records of personal health information for archive purposes to a person who, (a) has put in place reasonable measures to ensure that personal health information in the person's custody or control is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the information are protected against unauthorized copying, modification or disposal (section 14(1)).
• Prescribed registries^{Footnote 134} must put in place practices and procedures approved by the Commissioner and summary of the practices and procedures must be made available to the public (sections 13(2) and 13(3)).

Section 10 (Safety measures)

Section 20 (Authorized employee access to personal information without consent for the performance of duties of employees)

Section 62 (Authorization to receive personal information for the discharge of duties)

Section 76 (Declaration to the Commission required when establishing a file on individual)

Supplemental Requirement to CIHR Privacy Best Practices:

• Anytime a file is established concerning an individual, the public body must make a declaration to the Commission containing, among other things, the categories of persons who have access to the file in carrying on their duties.

Section 35 (Protection of personal information)

Section 37(1)(g) and (g.1) (Authorization to disclose personal information to officers and employees for purposes of carrying out their functions)

Section 24(3) (Treatment of personal information)

Section 27(f) (Authorization to disclose personal information to officers and employees for purposes of carrying out their functions)

Section 36 (Protection of personal information)

Section 39(1)(f) (Authorization to disclose personal information to officers and employees for purposes of carrying out their functions)

Section 51(e) (Commissioner's power to comment on privacy implications of using information technology in the storage of personal information)

Section 33 (Protection of Personal Information)

Section 36(1)(f) (Authorization to disclose personal information to officers and employees for purposes of carrying out their functions)

Section 42 (Protection of Personal Information)

Section 48(k) (Authorization to disclose personal information to officers and employees for purposes of carrying out their functions)

Section 42 (Protection of Personal Information)

Section 48(k) (Authorization to disclose personal information to officers and employees for purposes of carrying out their functions)

Sections 64, 70(2) and (3) and 71(2) and (3): Each custodian must prepare a privacy impact assessment and must submit it to the Information and Privacy Commissioner for review and comment before implementing any proposed administrative practices and information systems or any proposed change to any such existing practices and systems in accordance with the privacy impact assessment tool referenced in Schedule A attached hereto.

Section 46(5) (Requirement for the Department to conduct a privacy impact assessment in certain situations)

Ombudsman Manitoba, Access and Privacy Division - Privacy Compliance Tool Checklist [ PDF (9,27 KB) ]

Manitoba Health - Privacy Impact Assessment (PIA) Guide (Not available on-line)

Information and Privacy Commissioner/Ontario - Privacy Diagnostic Tool (PDT) Workbook [ PDF (222 KB) ]

Management Board of Cabinet - Privacy Impact Assessment Guidelines

Office of the Information and Privacy Commissioner for Newfoundland and Labrador - Privacy Audit, A Compliance Review Tool

Centre for Health Information - Privacy Impact Assessment for Researchers [ PDF ]

Section 1(1)(g) (Definition of "data matching")^{Footnote 140}

Section 68 (General prohibition on data matching)

Section 69 (Permitted data matching by custodians)

Section 70 (Data matching between custodians; privacy impact assessment required)

Sections 71 and 32 (Data matching between custodians and non-custodians; privacy impact assessment required; obligation to notify Privacy Commissioner)

Section 72 (Data matching for research; obligation to comply with provisions regarding disclosure for research purposes without consent (sections 48-56))

Section 107(5) (Offence to fail to notify Commissioner)

Section 46 - Approval must be obtained from head of the public body to use or disclose personal information for linking or matching purposes. The head may have to refer the proposal to the review committee for advice.

Section 47(4) - Any information linkage, must not be likely to harm individuals and benefits to be derived from research and any information linkage must clearly be in the public interest.

Section 68.1 (Permitted data matching/Requirement for written agreement)

Section 69 (Obligation to maintain confidentiality)

Section 70 (Submission of data matching agreements to Commission/ Public body; Tabling of agreement in National Assembly; Obligation to publish in Gazette)

Section 41 - Record linkages cannot be harmful to the individuals the information is about and the benefits to be derived from the linkage must be clearly in the public interest.

Section 51(e) - Commissioner may comment on implications for protection of privacy of using or disclosing personal information for record linkage.

Section 21(1) (Requirement and content of data sharing agreements)

Supplemental Requirement to CIHR Privacy Best Practices:

• Prohibition from using personal information to contact a person to participate in the research (section 21(1)(c)).

Section 35 (Requirement and content of data sharing agreements)

Supplemental Requirement to CIHR Privacy Best Practices:

• Prohibition from using personal information to contact a person to participate in the research.

Section 54(1) (Agreement between researcher and custodian)

Supplemental Requirement to CIHR Privacy Best Practices:

• Data sharing agreement must include obligation of recipient to pay the costs of (i) preparing information for disclosure, (ii) making copies of health information, and (iii) obtaining consents. Data sharing agreement must also contain obligation of researcher not to attempt to contact an individual who is the subject of the information in order to obtain additional information unless the individual has consented.

Sections 12(2), 12(3) and 14(3) (Requirement and content of data sharing agreement)

Supplemental Requirement to CIHR Privacy Best Practices:

• Data sharing agreement must include obligation of recipient of information to not contact any individual to whom the personal information relates, directly or indirectly, without the prior written authority of the public body and that the person must notify the public body in writing immediately if the person becomes aware that any of the conditions set out in the agreement have been breached.

Section 8 (Content of data sharing agreement)

Supplemental Requirement to CIHR Privacy Best Practices:

• Data sharing agreement must include obligation of recipient of information to not contact any individual to whom the personal information relates, directly or indirectly, without the prior written authority of the public body and notify the public body in writing immediately if the person becomes aware that any of the conditions set out in the agreement have been breached and that, if a person fails to meet the conditions of the agreement, the agreement may be immediately cancelled and that the person may be guilty of an offence pursuant to the Act.

Section 9 (Content of data sharing agreement)

Supplemental Requirement to CIHR Privacy Best Practices:

• Data sharing agreement must include agreement of recipient not to contact any individual to whom personal information relates, directly or indirectly, without the prior written authority of the public body and to notify the public body in writing immediately if the person becomes aware that any of the conditions set out in this section have been breached. Agreement must be in prescribed form.

Section 8 (Content of data sharing Agreements)

Supplemental Requirement to CIHR Privacy Best Practices:

• Data sharing agreement must include provisions requiring: an identification of any other persons who will be given access to the personal information by the recipient; a condition that the recipient must not contact any individual to whom the personal information relates, directly or indirectly, without the prior written authority of the public body; notice to the public body in writing immediately if the person becomes aware that any of the conditions set out in the agreement have been breached; a condition that, if a recipient fails to meet the conditions of the agreement, the agreement may be immediately terminated by the public body.

Section 8 (Content of data sharing Agreements)

Supplemental Requirement to CIHR Privacy Best Practices:

• Same as for the Northwest Territories

Schedule 1, 4.5, 4.5.2 and 4.5.3 (Limiting use, disclosure and retention)

Supplemental Requirements to CIHR Privacy Best Practices:

Data retention guidelines should include minimum and maximum retention periods.

Section 4 (Retention of personal information that has been used by a government institution for an administrative purpose)

Supplemental Requirements to CIHR Privacy Best Practices:

Personal Information shall be retained (a) for at least two years following the last time the personal information was used for an administrative purpose unless the individual consents to its disposal and (b) where a request for access to the information has been received, until such time as the individual has had the opportunity to exercise all his rights under the Act. However, the information may be destroyed in an emergency in order to prevent the removal of the information from the control of the institution (section 4).

A copy of every request for access received as well as a record of any information disclosed pursuant to such a request must be maintained for a period of 2 years following the date of the request (section 7).

Section 35 (Retention of personal information)

Supplemental Requirements to CIHR Privacy Best Practices:

If an individual's personal information is being used to make a decision that directly affects the individual, the information must be retained for at least one year.

Section 31 (Retention of personal information)

Supplemental Requirements to CIHR Privacy Best Practices:

If an individual's personal information is being used to make a decision that directly affects the individual, the information must be retained for at least one year.

Section 3 (Storage and Destruction, Other Enactments)

Section 41 (Maintaining certain disclosure information)

Section 60(2)(b) (Safeguards for proper disposal)

Supplemental Requirements to CIHR Privacy Best Practices:

A custodian that discloses a record containing individually identifying diagnostic, treatment and care information must retain that information for a period of 10 years following the date of the disclosure (section 41(2).

Section 35 (Accuracy and retention)

Supplemental Requirements to CIHR Privacy Best Practices:

If an individual's personal information is being used to make a decision that directly affects the individual, the information must be retained for at least one year or such shorter time as approved by the individual in writing, the public body and the body that approved the retention and disposition schedule if applicable.

Sections 214(2) and (3) (Destruction of records)

Supplemental Requirements to CIHR Privacy Best Practices:

• A council may pass a bylaw respecting destruction of records and documents of the municipality. The bylaw must provide that if an individual's personal information will be used by the municipality to make a decision that directly affects the individual, the municipality must retain the personal information for at least one year after using it so that the individual has a reasonable opportunity to obtain access to it.

Section 17 (Retention and destruction of information)

Supplemental Requirements to CIHR Privacy Best Practices:

• Written retention policy must be established.
• Trustee who destroys personal health information must keep a record of (i) the individual whose personal information is destroyed (ii) the time period to which the information relates, (iii) the method of destruction, and (iv) the person responsible for supervising the destruction.

Section 40 (Retention of information)

Supplemental Requirement to CIHR Privacy Best Practices:

If personal information about an individual is used to make a decision that affects the individual, the public body must establish and comply with a written policy concerning the retention of the personal information (subsections 40(1) and (2)).

Section 13 (Handling of records)

Supplemental Requirement to CIHR Privacy Best Practices:

Information shall be retained for as long as necessary to allow the individual to exhaust any recourse under the Act where a request for access has been made.

Section 40(1) (Retention of personal information)

Section 40(4) (Disposal of personal information)

Section 5 (Retention)

Supplemental Requirements to CIHR Privacy Best Practices:

• Information shall be retained for at least one year after use, unless the individual to whom the information relates consents to its earlier disposition.
• The minimum period of retention of personal information contained in a telecommunications logger tape is 45 days rather than one year.

Sections 2 to 6 (Disposal of personal information)

Supplemental Requirements to CIHR Privacy Best Practices:

• Authorization of the head of the institution must authorize the destruction of the information.
• The head shall ensure that the institution maintains a disposal record setting out what personal information has been destroyed and the date.

Section 30(1) (Retention of personal information)

Section 30(4) (Disposal of personal information)

Section 5 (Retention of personal information)

Supplemental Requirement to CIHR Privacy Best Practices:

Personal information to be retained for the shorter of one year after use or the period set out in a by-law or resolution made by the institution or made by another institution affecting the institution, unless the individual to whom the information relates consents to its earlier disposal.

Section 12 (Use of file)

Section 36 (Retention where request for access or rectification has been denied)

Section 73 (Destruction)

Supplemental Requirement to CIHR Privacy Best Practices:

• Section 73 does not apply to the processing of personal information collected and used as a working tool by a natural person and which is used by him for scientific research purposes to the extent that the information is not disclosed to any person other than the person concerned or to a body other than that to which he belongs, and that it is used judiciously (section 78).

Section 33 (Retention when information is used to make a decision)

Supplemental Requirement to CIHR Privacy Best Practices:

• If an individual's personal information is being used to make a decision that directly affects the individual, the information must be retained for at least one year.

Section 24(4) (Treatment of personal information)

Supplemental Requirement to CIHR Privacy Best Practices:

• If an individual's personal information is being used to make a decision that directly affects the individual, the information must be retained for at least one year.

Section 483(4) (Retention of personal information)

Supplemental Requirement to CIHR Privacy Best Practices:

• Where a municipality uses an individual's personal information to make a decision that directly affects the individual, the municipality shall retain that information for at least one year after using it so that the individual has a reasonable opportunity to obtain access to it.

Section 37 (Retention of personal information)

Supplemental Requirement to CIHR Privacy Best Practices:

• If an individual's personal information is being used to make a decision that directly affects the individual, the information must be retained for at least one year.

Section 34 (Retention of personal information)

Supplemental Requirement to CIHR Privacy Best Practices:

• Public body must retain information it uses to make a decision affecting an individual for at least one year after such use.

Section 44 (Duties of public body)

Supplemental Requirement to CIHR Privacy Best Practices:

• Public body must retain information it uses to make a decision affecting an individual for at least one year after such use.

Section 44 (Duties of public body)

Supplemental Requirement to CIHR Privacy Best Practices:

• Public body must retain information it uses to make a decision affecting an individual for at least one year after such use.

Schedule 1, 4.1 (Accountability)

Schedule 1, 4.8 (Openness)

Section 4 (Compliance with the Act)

Section 5 (Policies and Procedures)

Section 2 (Purposes of this Act)

Section 69(2) and (3) (Personal information directory of ministries)

Section 69(5) (Duty of a ministry to prepare privacy impact assessment)

Section 69(6) (Directory of personal information banks to be maintained by public body that is not a ministry)

Section 70 (Policy manuals to be made available)

Section 2 (Purposes of the Act)

Section 62 (Duty to identify responsible affiliate)

Section 63 (Duty to establish or adopt policies and procedures)

Section 64 (Duty to prepare privacy impact assessment)

Section 66(6) (Accountability for information disclosed to an information manager)

Section 8(2) (Designating responsible individual)

Section 8(6) (Custodian responsible for affiliates' compliance)

Section 5 (Compliance with Act)

Section 6 (Policies and Procedures)

Section 2 (Purposes of this Act)

Section 87 (Directory of public bodies)

Section 87.1 (Directory of personal information banks)

Section 88 (Records available without request)

Section 89 (Access to manuals)

Preamble (Accountability obligations)

Section 9 (Right to be informed)

Section 64 (Directory to be produced)

Section 65 (Access to manuals)

Section 2 (Purposes of this Act)

Section 25(5) (Information transferred to information manager for processing deemed to be maintained by the transferring trustee)

Section 2 (Written security policy and procedures)

Section 6 (Orientation and training of employees)

Section 2 (Purposes of this Act)

Sections 75(1) and (2) (Directory to be maintained)

Section 75(3) (Obligations regarding personal information bank)

Section 76 (Records to be made available)

Section 10 (Information Practices)

Sections 15 to 17 (Accountability and Openness)

Sections 6(3) subparagraph 2 (Health information network provider to provide plain language description of services provided and safeguards in place to protect against unauthorized use and disclosure)

Sections 6(3) subparagraph 3 (Information to be made available to the public by health information network provider)

Sections 6(3) subparagraph 4 (Information to be made available to health information custodians)

Sections 6(3) subparagraph 5 (Health information network provider to perform assessment of risks to security and integrity of personal health information in providing services and detailing affect on privacy)

Sections 31 to 36 (Information to be published or available)

Sections 44 to 46 (Obligations regarding Personal Information Banks)

Section 1 (Purposes of this Act)

Section 24 (Publications of information re institutions)

Section 25 (Information available for inspection)

Section 26 (Head shall make annual report)

Section 34 (Obligations re personal information bank index)

Section 67.3 (Register to be kept of every disclosure of personal information)

Section 71 (Personal information files must be established)

Section 76 (Declaration to the Commission required when establishing a file on individual)

Section 2 (Purposes of this Act)

Section 73 (Records available without request)

Section 2 (Purposes of this Act)

Section 48 (Directory respecting records of public body)

Schedule A, Principle 1 (Accountability)

Schedule A, Principle 8 (Openness)

Section 3 (Purpose)

Section 67(1)(c) (Designation and delegation by the head of public body)

Section 69 (Directory of information)

Section 1(1) (Purpose of the Act)

Section 63 (Information Directory)

Section 64 (Records available without request)

Section 1 (Purpose of this Act)

Section 70 (Directory of public bodies and records)

Section 71 (Policy manuals must be made available to the public)

Section 72 (Records available without request)

Section 1 (Purpose of this Act)

Section 70 (Directory of public bodies and records)

Section 71 (Policy manuals must be made available to the public)

Section 72 (Records available without request)

Section 27(1)(d) (Approval of Ethics Committee)^{Footnote 150}

Section 50 (Role of Ethics Committee)

Section 44(1) (Approval of Research Ethics Board)

Section 44(3) and (4) (Considerations and Decisions of Research Ethics Board)