Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31
Regulations under this Act:
R.R.O. 1990, Reg. 459 Disposal of personal information
R.R.O. 1990, Reg. 460 General
The purposes of the Act are twofold:
(a) to provide the right of an individual to access information in records held by government institutions.
The guiding principles governing this Act state that information should be available to the public, necessary exemptions from the right of access should be limited and specific, and decisions on the disclosure of government information should be reviewed independently of government.
(b) to protect the privacy of individuals with respect to personal information about themselves held by government institutions and to provide individuals with the right to access that information.
Government institutions include: ministries of the Government of Ontario or any agency, board, commission, corporation or other body designated as an institution in this Act’s regulations.
To access records, an individual must make a request in writing to the institution that is believed to be in custody or control of the record, must provide sufficient detail to enable the record to be identified and must submit the prescribed fee.
Generally speaking, every person has a right to access a record in the custody or control of an institution unless the record falls within one of the several exemptions listed in the Act, such as:
- records that may interfere with a law enforcement matter
- records that may disclose trade secrets or other financial or technical information
- a record that is subject to solicitor-client privilege
- a record or information that has been or is about to be published
- or a record containing personal information about an individual other than the person requesting the record unless prior written consent has been obtained.
Collection of personal information on behalf of an institution can only occur if that collection is expressly authorized by law, is used for the purposes of law enforcement or is necessary for the proper administration of a lawfully authorized activity. In most circumstances, personal information can only be collected directly from the person with whom the institution has a relationship. The institution shall not use personal information except where the individual to whom the information relates has identified the information and consented to its disclosure.
The Act addresses the use of “personal information banks” which are collections of personal information – such as information relating to race, religion, ethnic origin, marital status, education, criminal or employment history, blood type, financial information – that are organized and capable of being retrieved using the person’s name or identifying number or some other means. An index of personal information banks must be maintained and must be published annually.