Memorandum of Understanding Between the Information and Privacy Commissioner of Ontario and the Privacy Commissioner of Canada on Mutual Assistance and Information Sharing in the Administration and Enforcement of Laws Protecting Personal Information

Between

The Information and Privacy Commissioner of Ontario (“ON IPC”) and the Privacy Commissioner of Canada (“PCC”) (collectively, the “Participants” or “Commissioners”):

RECOGNIZING that the Participants have oversight responsibilities with respect to the protection of personal information and personal health information (collectively, “personal information”) in their respective jurisdictions;

RECOGNIZING that the ON IPC has oversight with respect to the protection of personal information pursuant to the following statutes: the Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F. 31 (“FIPPA”), the Personal Health Information Protection Act, 2004, S.O. 2004, c. 3, Sched. A (“PHIPA”), and Part X of the Child, Youth and Family Services Act, 2017, S.O. 2017, c. 14, Sched. 1 (“CYFSA”) (collectively, the “Ontario Statutes”);

RECOGNIZING that the PCC has oversight with respect to the protection of personal information pursuant to the following statutes: the Privacy Act, R.S.C. 1985, c. P-21, and the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 (“PIPEDA”);

RECOGNIZING that information under the control of the Office of the Privacy Commissioner of Canada is or may become subject to the Privacy Act, PIPEDA, the Access to Information Act, R.S.C. 1985, c. A-1 (“ATIA”), as well as other applicable laws of Canada, including the Federal Courts Rules, SOR/98-106, and to the Treasury Board of Canada Secretariat’s policies and directives as established under sections 5 and 7 of the Financial Administration Act, R.S.C. 1985, c. F-11;

RECOGNIZING that there are circumstances where the ON IPC and PCC may have a mutual interest in a matter pursuant to their respective mandates;

RECOGNIZING that the ON IPC and PCC have similar powers, duties and functions in their respective jurisdictions with respect to the protection of personal information;

RECOGNIZING that section 23 of PIPEDA authorizes the PCC to consult, coordinate its activities, and share information with any person who, under provincial law, has similar functions and duties to those of the PCC with respect to the protection of personal information;

RECOGNIZING that subsection 23(3) of PIPEDA authorizes the PCC to disclose information that comes to their knowledge in the course of exercising their functions under PIPEDA where disclosure could be relevant to an ongoing or potential investigation of a complaint or audit under Part 1 of PIPEDA or under provincial legislation that has objectives similar to Part 1 of PIPEDA or that could assist either of the Participants in the exercise of their functions and duties with respect to the protection of personal information;

RECOGNIZING that subsections 59(2)-(5) of FIPPA authorize the ON IPC to consult, coordinate their activities and share information with a person who, under an Act of Canada or of another province or territory in Canada, has similar powers, duties and functions to those of the ON IPC with respect to the protection of personal information;

RECOGNIZING that subsection 66(e) and paragraphs 68(3)(a) and (b) of PHIPA and subsection 326(e) and paragraphs 328(3)(a) and (b) of the CYFSA authorize the ON IPC to assist in investigations and similar procedures conducted by a person who, under an Act of Canada or of another province or territory in Canada, performs similar functions to those of the ON IPC; and to disclose information that comes to the ON IPC’s knowledge in the course of exercising their functions under these statutes where disclosure is either necessary to exercising those functions or is made to a body that is legally entitled to regulate or review the activities of the health information custodian or service provider and the ON IPC is of the opinion that disclosure is justified;

RECOGNIZING the benefits of mutual assistance, consultation, coordination, and information sharing where not prohibited by law with respect to the Participants’ mandates under their respective legislation;

Have reached the following understanding:

I. Objective

The objective of this Memorandum of Understanding (“Memorandum”) is to establish a framework to allow the Participants to assist, consult, cooperate, and share relevant information with one another with respect to matters arising under the Ontario Statutes and PIPEDA.

II. Procedures Relating to Mutual Assistance

1. Each Participant will designate a primary contact for the purposes of requests for assistance and other communications under this Memorandum.
2. The Participants may communicate and cooperate with each other, as appropriate, about matters arising under one or more of the Ontario Statutes or under PIPEDA.
3. Subject to Section III, the Participants may jointly investigate a matter arising under one or more of the Ontario Statutes and under PIPEDA. As part of a joint investigation, the Participants may jointly investigate or deliberate matters and may jointly issue decisions, recommendations, or reports.
4. Subject to Section III, the Participants may share information that could be relevant to an ongoing or potential investigation of a complaint, inquiry, audit, or review under one or more of the Ontario Statutes or under PIPEDA or could assist the Participants in the exercise of their respective powers or performance of duties or functions under the Ontario Statutes or PIPEDA.
5. The Participants will make this Memorandum available to the public by posting it on their respective websites.
6. The Participants will promptly notify each other if they become aware that information shared under this Memorandum is not accurate, complete, or up to date.
7. Subject to Section III, the Participants may, as appropriate and subject to relevant legal restrictions, refer complaints, inquiries, audits or reviews to each other, or provide each other notice of possible contraventions.
8. The Participants will use their best efforts to resolve any disagreements that may arise under this Memorandum through the primary contacts designated under Section II(a) and, failing resolution in a reasonably timely manner, by discussion between the Commissioners.

III. Limitations on Assistance and Use

1. For greater certainty, nothing in this Memorandum requires Participants to provide assistance or share information where it is outside the scope of this Memorandum or, more generally, where it would be inconsistent with applicable laws, or important interests or priorities of a Participant.
2. The ON IPC will not disclose information to the PCC where it is prohibited to do so by law, including information received from an institution that qualifies for an exemption under the following sections of FIPPA:
   1. Section 12 – Cabinet records;
   2. Section 14 – Law enforcement records;
   3. Section 19 – Solicitor-client privilege.
3. The PCC will not disclose information to the ON IPC where it is prohibited to do so by law, including under one or more provisions of either PIPEDA, the Privacy Act and the ATIA, including any regulations made thereunder or associated orders in council. Furthermore, it will not disclose information described in those aforementioned federal statutes pertaining to:
   1. Confidences of the King’s Privy Council for Canada;
   2. Law enforcement records;
   3. Records received or obtained from third parties that are protected by solicitor-client privilege or professional secrecy of advocates and notaries.
4. The Participants will only share personal information pursuant to this Memorandum to the extent that is necessary for fulfilling the purposes of this Memorandum.
5. The Participants acknowledge that nothing in this Memorandum is to be construed as authorizing or requiring either of the Participants to share information. Information will be shared only in accordance with applicable laws.
6. The Participants will not use any information obtained pursuant to this Memorandum for purposes other than those for which the information was originally shared unless permitted or required by law.
7. For greater certainty, should the Participants undertake a joint investigation, audit or deliberation, or decide to issue a joint decision, recommendation, or report under Section II(c) of this Memorandum, neither of the Participants exercises authority over the other or otherwise affects the other’s independence.

IV. Confidentiality

1. Information shared under this Memorandum is to be treated as confidential and may only be further disclosed in accordance with applicable laws and will not be further disclosed without the express written consent of the Participant who provided it.
2. Each Participant will take steps that are reasonable in the circumstances to ensure that information shared under this Memorandum is transferred, retained, and disposed of in a secure manner. In the event that any information is stolen, lost, or subject to unauthorized access, use or disclosure, the affected Participant will take reasonable steps to contain and retrieve the information, prevent a recurrence, and promptly notify the other Participant.
3. The Participants will oppose, to the fullest extent possible, consistent with applicable laws, any application by a third party for disclosure of information shared under this Memorandum, unless the Participant who provided the information gives express written consent to its release. The Participant who receives such an application will promptly notify the Participant who provided the information.
4. Should the Participants undertake a joint investigation or deliberation, or decide to issue a joint decision, recommendation, or report under Section II(c) of this Memorandum, communications between the Participants regarding these joint activities will be treated as confidential by the Participants and will be protected by deliberative secrecy. In addition, any shared communications or documents protected by solicitor-client privilege, professional secrecy of advocates and notaries, or litigation privilege will be subject to common interest privilege.

V. Length of Retention of Information

Information shared under this Memorandum will not be retained for longer than is required to fulfill the purpose for which it was shared or than is required by applicable laws or policies. The Participants will use best efforts to return any information that is no longer required if the Participant who provided the information made a written request at the time the information was shared that it be returned when no longer required. If no request for return is made, the Participants will securely dispose of the information in accordance with applicable laws and policies. This section applies to information in any format, including paper and electronic formats.

VI. Coming into Effect, Amendment and Duration of Cooperation

1. The Memorandum takes effect on the date it is signed by the Participants and supersedes any previous Memoranda between the Participants.
2. Assistance and information sharing in accordance with this Memorandum will be available concerning matters occurring before as well as after this Memorandum is signed.
3. The terms and conditions of this Memorandum may be amended by mutual agreement in writing.
4. Either of the Participants may withdraw from this Memorandum by giving at least 30 days’ written notice to the other Participant. The Participants may also terminate this Memorandum by mutual consent in writing.
5. On termination of this Memorandum, each Participant will maintain the confidentiality of any information shared by the other Participant in accordance with Section IV of this Memorandum and securely return or destroy information obtained from the other Participant in accordance with Section V of this Memorandum.

VII. Legal Effect

Nothing in this Memorandum is intended to:

1. Create binding legal obligations.
2. Create obligations or expectations of cooperation that would exceed a Participant’s jurisdiction or legal authorization.

VIII. Signature

Signed in French and English, each version being equally authoritative, with same form and content. Neither version takes precedence over the other. In the event of a conflict in interpretation, the Participants will determine a meaning that is shared or common to both versions.