What if I do not agree with my service provider’s decision about my capacity to make decisions about my own personal information? … If your service provider decides that you are not capable of making decisions about your personal information, and you disagree with them, you can challenge the …
How does my service provider decide whether I can make decisions about my personal information? … The law generally presumes that you are capable of making decisions about your personal information, unless your service provider has reasonable grounds to believe that you are not. Your service …
What if I do not agree with my substitute decision-maker? … Sometimes you might not agree with a decision made by your substitute decision-maker. If you are capable of making decisions about the collection, use or disclosure of your personal information, even under the age of 16, your decision to …
Who can make decisions about my personal information? … Where the CYFSA requires consent to collect, use, or disclose your personal information, you can generally make those decisions about your own personal information. The law presumes that you are capable of making such decisions at any age, …
Commissioner Kosseim on "Leadership in the Digital Enterprise" … Commissioner Patricia Kosseim appeared on “Leadership in the Digital Enterprise” on April 6, 2023. The title of this episode was “A conversation with Ontario's Information and Privacy Commissioner, Patricia Kosseim.” … Commissioner …
What if a person requesting access to personal information intends to publish it? … The CYFSA prohibits people from publishing or making public information that identifies a child participant or witness in a child protection hearing, including information that would identify the child’s …
Can service providers put conditions on access to information? … When someone requests access to personal information, the service provider must determine if that individual has a right to access the information under Part X of Ontario’s child and family services law, the CYFSA . If they have the …
Do I have to be 18 before I can ask to see my personal information? … No, you can ask to see or receive a copy of your personal information or make corrections to your personal information at any age. You can make these requests yourself, unless your service provider decides you are not capable of …
What service providers are covered under Part X of the Child, Youth and Family Services Act? … Part X of the CYFSA sets out the access and privacy rules for personal information held by service providers in the child, youth, and family services sector. Children’s aid societies, Indigenous child and …
What information must we provide to people when we refuse their access request? … Service providers are required to give written notice when refusing all or part of an access request. How you do so will depend on your reasons for refusing access. For example, when you are denying access because a …
The timeline for providing access is 30 days. When exactly does this timeline start? … The 30 day timeline begins after you receive an access request. For example, if the request is mailed, the timeline would begin the day you receive the letter, not the day it was sent. The day you receive the …
Do we have to inform third parties that we’re releasing records that mention them? … Part X does not require you to inform third parties before releasing their information to someone who has a right of access to the record. For non-sensitive information, there would generally not be a need to …
What if someone requests access to a record that also includes information about a third party? Must we always remove the other person’s information before releasing the record? … It depends on whether the record is dedicated primarily to providing services to the person requesting access: If so, …
How should we confirm someone’s identity before providing them access to their personal information? … You must take reasonable steps to verify a requester’s identity before releasing personal information to them. In some cases, you may already be satisfied that the requester is who they claim to …
What if someone requests access to a record that was originally created by another organization? … As long as the record is in your custody or under your control, then you are responsible for determining whether to provide access to the record, even if it was created by someone else. It is possible …
Can parents consent on behalf of their children, and make access requests for their information? Does it matter if they have custody of the child? … A parent with custody of a child under age 16 can be the child’s substitute decision-make under Part X. This means they can consent to a collection, …
Does Part X affect the duty to report suspected child abuse or neglect to a children’s aid society? … Nothing in Part X — or in Ontario’s other privacy laws — stands in the way of the duty to report suspected child abuse or neglect to a children’s aid society. Individuals and service providers can …
What can we do to prevent “snooping”? … When an employee purposefully views personal information for reasons unrelated to their job duties — such as out of curiosity about a client they know personally — this is sometimes referred to as snooping. Service providers are required to take reasonable …
Does Part X apply to records created many years ago? … Yes. Even if an individual’s personal information was recorded many years before Part X came into force in January 2020, they have a right to access their record and you must protect it against privacy breaches. However, Part X does not apply …
My organization is covered by Ontario’s health privacy law, PHIPA. Does Part X apply to us? … If a service provider is covered by Ontario’s health privacy law, the core requirements of Part X do not apply to their handling of personal health information — PHIPA applies instead. However, Part X may …