a) What is personal information?

Part X applies to personal information, which means “recorded information about an identifiable individual.”¹⁰ It does not apply to records that contain no personal information. For example, this might include things like capital funding records, organizational policies, or building contracts.

Information is about an identifiable individual if:

• it is about the individual in a personal capacity
• the individual can be identified from the information (either alone or by combining it with other information)

Examples include a person’s name when combined with other information about them, such as their address, sex, age, education, or medical history. This is not a complete list; many other kinds of information may still qualify as personal information. Even without a name, a record may contain personal information, if the individual can be identified.

Personal information can be recorded in any format, including:

• paper records, such as written case notes
• electronic records, such as in a client information system
• photographs and video footage, including from security cameras

When a service provider is collecting information, the definition of “personal information” also includes information that is not recorded. This means that when a service provider collects personal information, they must follow the rules of Part X even if the information is collected verbally, for example through a phone call or intake interview.¹¹

It doesn’t matter whether a record was created before or after Part X came into force. Even if an individual’s personal information was recorded many years before, they have a right to access their record and you must protect it against privacy breaches.¹²