Chapter 10: Interacting with the IPC
Introduction
Chapter 2: Government Roles and Responsibilities introduced the IPC and the purpose and responsibilities of that office. This part of the manual will provide detailed information about the important role and powers of this independent Officer of the Legislature.
This chapter outlines expectations for institutional staff when interacting with the IPC and outlines when and how to seek advice or comments from the IPC on new initiatives.
Chapter 11: Appeals Process outlines in detail the IPC appeal process. Chapter 12: Privacy Complaints, Breaches and Investigations provides more information on privacy complaints and investigations.
Guiding Principles
Below are guiding principles that employees of institutions should follow when interacting with the IPC:
Independence: The IPC is independent of the government. This independence enables the IPC to fulfil its role of independently reviewing the decisions and practices of government institutions concerning access to information and the protection of privacy when collecting, using and disclosing personal information under the legislation.
Authority: The IPC has specific powers under the legislation to ensure institutions comply with the provisions of the legislation. Employees dealing with the IPC should recognize the IPC’s legal authority.
Responsibility: Employees involved with an IPC matter should ensure a positive and constructive approach to working with the IPC. In particular, Coordinators, managers and supervisors should ensure that this constructive relationship is maintained throughout the course of an appeal, privacy investigation or any matter related to the IPC’s mandate.
Cooperation: It is the responsibility of employees to provide the IPC with timely access to information and records necessary for the IPC to perform its statutory responsibilities.
Obligations and Best Practices for Staff
When involved with the IPC, employees of institutions subject to the legislation must:
- Comply with the law, with policies and any orders made by the IPC pursuant to the exercise of the IPC’s powers under the legislation
- Provide clear and full disclosure of requested information to the IPC
- Subject to legal advice, permit access to the institution’s employees for the purposes of interviews in the context of a privacy investigation or adjudication where possible
- Respect that the IPC has the authority to decide the pertinence of information requested from institutions subject to the legislation
- Not interfere with the IPC’s exercise of powers under the legislation and
- Act honestly, ethically, and with integrity and remember employee actions and comments always reflect on the institution
In addition, employees of institutions are expected to:
- Provide timely and accurate responses and assistance and not limit or unreasonably delay the time required to provide information
- Treat IPC staff with respect, courtesy and fairness
- Exercise general diligence, care and attention in responding to the issues raised by the IPC and
- Help foster and support a positive working relationship with the IPC
In adopting the above best practices, employees of institutions must understand that access to information is fundamental to the IPC’s role. Coordinators, managers and supervisors have a particular responsibility to ensure a positive working relationship with the IPC.
Seeking Comments or Advice on New Initiatives
In addition to its important role as the oversight body for access and privacy legislation, the IPC is also a key government stakeholder for transparency and accountability. The legislation gives the IPC the authority to offer comment on the privacy protection implications of proposed legislative schemes or government programs.
The IPC provides feedback to government institutions that have consulted with the IPC on matters that have access and privacy implications. The IPC’s Director of Policy is the point of contact for institutions who wish to consult with the IPC on access and privacy matters. It is important to obtain IPCfeedback early and address any concerns in the early stages of an initiative such as a new project, strategy or program.
Examples where consultation with the IPC may be appropriate include:
- When an initiative would involve new collections of personal information;
- On early drafts of legislation that impact access to government records and privacy; or
- When the institution is contemplating use of new technologies where impacts on privacy are not well known.
Providing background policy documents that support an initiative is important in enabling informed and meaningful IPC comment. For example, if a program area has completed a privacy impact assessment on a new initiative, it may be beneficial to provide this documentation to the IPC prior to meeting. Institutions may want to involve the IPC especially when the matter has significant impact on the public. The IPC will manage highly sensitive and confidential matters appropriately by restricting staff involvement and securing information appropriately.
It is best practice for institutions to include their Coordinator and Legal Counsel when contemplating consulting with the IPC.
IPC Initiated Contact with Institutions
There may be situations where the IPC initiates contact with institutions on issues that are of public interest. The IPC may contact an institution directly, or the IPC may first contact MPBSDP, as the Minister is the Responsible Minister for the legislation. In these cases, the IPC may request information through email or through letters to ministers’ offices or senior employees, in order to fully understand the issue. It is important that institutions provide timely responses to these types of IPC inquiries. An institution’s Legal Counsel and Coordinator may be able to assist with these matters.
The IPC may also appear before, or make submissions to, various Standing Committees. The purpose of these submissions is for the IPC to provide its views or recommendations to the Standing Committee on bills that have access and privacy implications. Employees should provide assistance and information to the IPC relating to these proceedings, when requested.