On June 7, 2012, Lisa Fong of Ng Ariss Fong co-presented a Webinar on Privacy and Confidentiality with Angela Westmacott of Victoria-based law firm Lovett Westmacott. During the question-and-answer period, Lisa and Angie received numerous written questions from participants, only some of which they could address during the Webinar. We now address the remaining questions over the next few releases of our professional regulation blog, Suite210. If you missed the webinar, it can be purchased for view starting here.
We received several questions relating to Part 3 of BC’s Freedom of Information and Privacy Protection Act (FIPPA), and in particular, section 33(1)(l).
1) How should a request from another professional regulator, for information about a registrant, be treated under FIPPA? Are redactions of personal info (including medical records) still required?
FIPPA authorizes every public body in BC to disclose personal information – anyone’s personal information – to “governing bodies of professions and occupations” (including bodies outside of Canada) for regulatory purposes, namely, for “licensing, registration, insurance, investigation or discipline” of persons: FIPPA s. 33.1(1)(l).
Practically, while this section indicates discretion to disclose, a professional regulator can likely make a request under Part 2 of FIPPA that would trigger mandatory disclosure, subject to exceptions under Part 2, Division 2.
In other words, professional regulators can disclose the personal information of a registrant (or anyone else) without redaction. But if another governing body should insist on information the professional regulator does not wish to disclose, the outcome will depend on whether an exception to disclosure exists under Part 2, Division 2.
In such circumstances, grounds for a regulator to withhold information from another regulator may be rare. Personal information will not be exempt from disclosure to another regulator based only on personal privacy (s. 22(1)), since s. 22(4) defines disclosure authorized by an enactment of BC or Canada (e.g., disclosure to another regulator authorized by s. 33.1(1)(l)) is not an unreasonable invasion of personal privacy.
2) How broad is 33.1(1)(l) and to whom can the information be disclosed? Is it only to other professional regulators? Does 33.1(1) trump any confidentiality provision in a regulator’s own statute, as well as the common law, by virtue of the ‘trumping” provision in FIPPA?
Section 33.1 in Part 3 of FIPPA sets out when a public body may choose to disclose personal information inside or outside of Canada. Section 33.1(1)(l) allows a public body to disclose personal information “for the purposes of licensing, registration, insurance, investigation or discipline of persons regulated inside or outside of Canada by governing bodies of professions and occupations”.
Section 33.1(1)(l) may, however, be open to different interpretations, which remain open to dispute, as there do not appear to be any Orders of the BC Privacy Commissioner or any court cases interpreting s.33.1(1)(l).
Without controversy, s.33.1(1)(l) permits a public body like a professional regulator to disclose information for its own purposes relating to the “licensing, registration, insurance, investigation or discipline” of its own registrants.
The question of the bodies to whom a public body may disclose personal information under s.33.1(1)(l) is more complicated, as the provision refers to “governing bodies of professions and occupations” that engage in regulating persons, but does not specify only “public” governing bodies, or bodies with specific constating statutes.
Section 33.1(1)(l) would seem clearly to authorize disclosure by a public body in BC to another professional regulator with its own constating statute (though in other provinces such a regulator might not be clearly “public” in nature). The question remains, however, whether a “private” body like a professional association or union, created under a “general” statute (like the BC Society Act or the BC Labour Relations Code), with powers to investigate or discipline members under codes of conduct, and possibly with occupational title protection (e.g., under Part 10 of the BC Society Act), comes within s.33.1(1)(l). For example, a regulator might receive a request from a professional society that regulates professionals in a foreign jurisdiction where no statute addresses the profession. If you receive such a request, we would be very interested in hearing from you, and helping you unravel the problem.
The last part of this question is whether FIPPA will trump the confidentiality provision set out in a regulatory body’s enabling statute. As discussed at Part E (paras. 44-51) of the written materials for the June 7th Webinar on Privacy and Confidentiality, the simple answer is “yes”, unless the confidentiality provision of a constating statute expressly ousts FIPPA. For this reason, disclosure of information by a professional regulatory body in British Columbia to its extra-provincial counterpart can occur in spite of a wide confidentiality provision governing the BC body (so long as FIPPA has not been expressly ousted).
3) Does s. 33.1(1)(l) re purposes of licensing, etc. permit sharing of info with other regulators (e.g. in other provinces) even without express consent?
This question has already been addressed in part above under the second question. Section 33.1(1)(l) may be relied on by British Columbia regulators to disclose personal information to extra-provincial regulators, and to obtain information from other public bodies in British Columbia. The second issue here is whether express consent is required for disclosure under section 33.1(1)(l). Section 33.1(1)(b) provides discretion for public bodies to disclose personal information when the individual to whom the information relates has consented in the prescribed form required under the Act. There is no requirement in FIPPA for express consent when information is disclosed pursuant to section 33.1(1)(l). However, obtaining a registrant’s consent to information-sharing may be necessary for professional regulatory bodies outside British Columbia to reciprocate the sharing of personal information of a common person, as section 33.1(1)(l) in this province’s FIPPA is unique in Western Canada.
4) Can you make some comments on cooperation between regulators in different jurisdictions (eg. other provinces and related regulatory areas) and their ability to share information of mutual interest about regulated industry members?
This question closely relates to question three above. Section 33.1(1)(l) provides authority for public bodies in British Columbia to disclose information for the purposes of “licensing, registration, insurance, investigation or discipline” of members of regulated professions or occupations both inside and outside Canada. Whether regulators in other jurisdictions can reciprocate will depend, however, on whether they have similar authority under their own statutes. In Western Canada, BC’s FIPPA is unique in expressly authorizing this type of information disclosure. Other provinces and territories may require express statutory authority, or the express consent of the registrant to whom the personal information relates, before this information can be shared with a BC regulatory body. In jurisdictions where self-regulating professions are not governed by any privacy protection legislation, regulators may need express consent or statutory authority for disclosure, to avoid running afoul of any implied terms of confidentiality over a registrant’s personal information.
We address the topic of section 33.1(1)(l) and information-sharing between professional regulators in Western Canada in more detail in our Mini-Webinar on Privacy and Confidentiality, available for viewing on our website starting here.
Lisa Fong and Benjamin Ralston