Agreement To Share Personal Information

Where a request for disclosure of personal data has been made to the federal investigating authorities in accordance with Paragraph 8 (2) (e) of the Data Protection Act, Subsection 8 (4) of the Act and Section 7 of the Act require that all information disclosed in response to the request be disclosed at least two years after the date on which the request was received by the institution public, 1998. For all these disclosure records, a separate GDP must be kept in Info Source and the records must be made available to the Data Protection Officer upon request. A foreign government organization is not subject to Canadian data protection laws regarding personal data it receives from a Canadian government institution (called cross-border data flows). The law also requires that, when a request for access to personal data has been received, the institution retains the information until the person has the opportunity to exercise all legal rights (e.g.B. The right of recourse, the application for judicial review, etc.). The obligation to retain personal records would apply even if the records are relevant to an Access to Information Act application. It is recommended that the exchange of information be duly recorded by the publishing institution or recorded in the subject`s file, so that recipients of false information can be informed and accurate revised information can be provided. Personal data that have been modified in such a way that the identity of the data subject can no longer be established is called de-identified information. This can be achieved by removing identifiers such as a person`s name, date of birth, and other personal data that may be linked to the person. Regardless of the means used to de-identify the data, it is appropriate to make it impossible to re-identify, i.e. the remaining data, even if combined with other sources, should not allow people to be connected. The Data Protection Act does not provide that agreements or arrangements relating to the transfer of personal data must be concluded in writing.

Close Menu