Processes personal data, in Ontario

S.O. 2004, c. 3, Sched. A, ss. 65, 72 · Read the law's page

• These offences reach any person, including a custodian, an agent, a supplier to a custodian and a person who holds a health number or de-identified information.
• Do not wilfully collect, use or disclose personal health information in contravention of the Act or its regulations, and do not wilfully dispose of a record in contravention of the secure disposal duty.
• Do not contravene the health number rules in section 34 (2), (3) or (4), and do not wilfully use de-identified information to identify an individual.
• Do not make a request for access to or correction of a record of personal health information under false pretences, and do not wilfully obstruct or mislead the Commissioner or fail to comply with the Commissioner's order.

S.O. 2004, c. 3, Sched. A, s. 11.2 · Read the law's page

• This duty binds any person, not only a health information custodian, who holds information that has been de-identified from personal health information.
• Do not use, or attempt to use, de-identified information to identify an individual, alone or combined with other information, unless the Act or another Act permits it. Custodians, prescribed entities, prescribed registry holders and other prescribed persons may re-identify information they de-identified themselves.

S.O. 2004, c. 3, Sched. A, ss. 51 (5)-(8), 55 (1.1)-(1.2); O. Reg. 329/04, ss. 18.1.1 and 18.1.2.3 · Read the law's page

• If you are the prescribed organization, handle a request for access to a record accessible through the electronic health record, to an electronic record kept under paragraphs 4, 5 and 6 of section 55.3, or to digital health identifier records, as a health information custodian would under Part V, subject to the prescribed exceptions and additional requirements (s. 51 (5), (6) and (7)).
• If you are a health information custodian, give access under Part V to the record of all instances in which an individual's personal health information accessible through the electronic health record was viewed, handled or otherwise dealt with by you (s. 51 (8)).
• Do not expect a correction request to be accepted by the prescribed organization for the records described in subsection 51 (5), (6) or (7), or by a health information custodian for the records described in subsection 51 (8) (s. 55 (1.1) and (1.2)).
• If you are the Agency, make available an electronic system to act as a digital means of access that permits individuals who have a digital health identifier and are specified on your website to access the records described in section 18.1.1 of the regulation, and from 1 January 2028 also make available an alternative process for individuals who cannot or do not wish to use it (O. Reg. 329/04, s. 18.1.1).
• Provide the Commissioner with an annual report on the previous calendar year on or before March 1 in each year starting in 2027 (O. Reg. 329/04, s. 18.1.2.3).

R.S.O. 1990, c. C.33 · Read the law's page

• Register with the Registrar before you conduct or act as a consumer reporting agency or act as a personal information investigator.
• As a consumer reporting agency, furnish information from your files only as section 8 allows: on a court order, on the consumer's written instructions, under an order or direction under the Act, or in a consumer report to a person you have reason to believe intends to use it for credit, a tenancy, employment, insurance underwriting, eligibility under a statute or regulation, a direct business need in a business or credit transaction, or updating a report.
• If you obtain information from a consumer reporting agency's files, do so only for a purpose section 8 allows.
• As a consumer reporting agency, adopt all procedures reasonable for ensuring accuracy and fairness in your consumer reports, report only information extracted from files stored or collected in a repository located in Canada, and leave out the items section 9 forbids, including race, creed, colour, sex, ancestry, ethnic origin and political affiliation and most adverse items more than seven years old.
• Before you request or obtain a consumer report containing personal information about a consumer, give the consumer written notice, and give the consumer the agency's name and address on request.
• If you deny a benefit or increase a charge wholly or partly because of information from a consumer reporting agency or another person, give the consumer notice when you communicate the action and, if the consumer asks within sixty days, say what the information was and where it came from or give the agency's name and address.
• As a consumer reporting agency, on a consumer's written request disclose the consumer's file, sources, recipients and, if asked, current consumer score; correct, supplement or delete disputed information in accordance with good practice and notify the persons the corrected report went to.
• These duties bind a consumer reporting agency (a person who for gain or profit or on a regular co-operative non-profit basis furnishes consumer reports) and anyone who requests, obtains or acts on a consumer report, such as a lender, landlord, insurer or employer.