Newfoundland and Labrador

Except as the Act otherwise provides, a custodian must notify the individual who is the subject of personal health information at the first reasonable opportunity where the information is stolen, lost, disposed of except as the Act or the regulations permit, or disclosed to or accessed by an unauthorized person.

Where a custodian reasonably believes that there has been a material breach, as defined in the regulations, involving the unauthorized collection, use or disclosure of personal health information, it must inform the commissioner of the breach.

The regulations list as relevant factors the sensitivity of the information, the number of people whose information was involved, whether the custodian reasonably believes the information has been or will be misused, and whether the cause of the breach or the pattern of breaches indicates a systemic problem.

The duty to notify the individual does not apply where the custodian reasonably believes that the theft, loss, unauthorized disposition, or improper disclosure or access will not have an adverse impact upon the provision of health care or other benefits to the individual or upon the individual's mental, physical, economic or social well-being.

The commissioner may recommend that the custodian notify the individual at the first reasonable opportunity even where notification is not required under that exception.

Where a custodian uses or discloses personal health information without the individual's consent in a manner inconsistent with its information policies and procedures, it must inform the individual of the use or disclosure at the first reasonable opportunity, unless it would be required or permitted to refuse access to the record under section 58, make a note of the use or disclosure and retain the note as part of the record.

A custodian may disclose personal health information collected in the province to a person outside the province only where the individual consents, the disclosure is permitted by the Act or the regulations, the recipient performs functions similar to those of a person to whom the Act would permit disclosure in the province, the disclosure is for health planning or health administration about care given in the province to a resident of another province or territory and is made to that government, the disclosure is reasonably necessary for the provision of health care and the individual has not expressly instructed otherwise, or the disclosure is reasonably necessary for the administration of payments or for contractual or legal requirements.

A custodian's information policies and procedures must protect the confidentiality of personal health information that will be stored or used in a jurisdiction outside the province or disclosed to a person in another jurisdiction. Where an express request of the individual prevents a custodian from disclosing all the information it considers reasonably necessary for the provision of health care, the custodian must notify the person to whom it makes the disclosure of that fact.

An individual has a right of access to a record containing his or her personal health information that is in the custody or under the control of a custodian. A custodian must respond to a request for access without delay and in any event not more than 60 days after receiving the request.

A custodian may extend that limit for an additional 30 days where meeting it would unreasonably interfere with its operations or the information consists of numerous records, and it must give the individual written notice of the extension with reasons. Where a custodian fails to respond to a request for access within the time allowed, it is considered to have refused the request.

Where a custodian decides to grant access, it must make the record available to the individual for examination and, on request, provide a copy and an explanation where necessary. Where a custodian has granted access and the individual believes the record is inaccurate or incomplete, the individual may request correction, orally or in writing.

A custodian must respond to a request for correction without delay and in any event not more than 30 days after receiving the request, and it may extend that limit for an additional 30 days. The custodian must grant the request for correction where the individual demonstrates to the custodian's satisfaction that the record is incomplete or inaccurate for the purposes for which the custodian uses the information and gives the custodian the information necessary to correct the record.

Where a custodian has refused a request for access or correction, the affected individual may file a complaint with the commissioner within 60 days of notice of the refusal or of the deemed refusal.

An individual who believes on reasonable grounds that a custodian has contravened or is about to contravene the Act or the regulations in respect of personal health information may file a complaint with the commissioner within one year after the subject-matter first came to the individual's attention.

In conducting a review the commissioner may demand from the custodian a copy of a record relevant to the review and inquire into all information, records and information practices of the custodian that are relevant to it. Within 15 days after receiving a report of the commissioner that contains a recommendation, the custodian must decide whether to comply and give written notice of its decision to the commissioner and the complainant.

A person who wilfully obtains or attempts to obtain another individual's personal health information by falsely representing that the person is entitled to it, makes a false statement to or obstructs the commissioner, or destroys or erases personal health information with the intent to evade a request for access is guilty of an offence and liable on summary conviction to a fine of not more than $10,000 or to imprisonment for a term not exceeding 6 months, or to both.

A person may not dismiss, suspend, discipline, demote, harass or otherwise disadvantage or penalize an individual who, in good faith and on reasonable belief, has disclosed to the commissioner that another person has contravened or is about to contravene the Act or the regulations.

It is a tort, actionable without proof of damage, for a person, wilfully and without a claim of right, to violate the privacy of an individual. The nature and degree of privacy to which an individual is entitled in a situation or in relation to a matter is that which is reasonable in the circumstances, regard being given to the lawful interests of others.

Proof of surveillance of an individual by any means, of listening to or recording a conversation in which the individual participates or messages to or from the individual passing by telecommunications otherwise than as a lawful party, of the use of the individual's name, likeness or voice for advertising or other advantage where the individual is identified or identifiable and the user intended to exploit it, or of the use of the individual's letters, diaries or other personal documents, without the consent of the individual or of a person with lawful authority to give it, is in the absence of evidence to the contrary proof of a violation of privacy.

An act or conduct is not a violation of privacy where it is consented to by a person entitled to consent, where it was incidental to the exercise of a lawful right of defence of person or property, or where it was authorized or required under a law in force in the province or by a court.

A publication of a matter is not a violation of privacy where the matter published was of public interest or was fair comment on a matter of public interest, or where the publication was privileged under the rules of law relating to defamation. In an action for violation of privacy the court may award damages, grant an injunction, order the defendant to account for profits, order the delivery of articles or documents and grant other relief that appears necessary.

An action for violation of privacy shall be heard and determined by the Trial Division. A right of action for violation of privacy is extinguished by the death of the individual whose privacy is alleged to have been violated. Where there is a conflict between the Privacy Act and another Act, whether general or special, the Privacy Act prevails. The Act binds the Crown.

A credit reporting agency is a person engaged in providing credit reports to another person, whether for remuneration or otherwise. A credit reporting agency may not provide a credit report except in the cases the Act lists, which include a court order, the written instructions of the consumer, and the consumer's prior consent to a person it has reason to believe is involved in a business or credit transaction with the consumer or intends to use the report for employment purposes.

A person may not seek to obtain a credit report from a credit reporting agency except for those purposes. A credit report may not contain information as to race, religion, sex, political opinion, colour, or ethnic, national or social origin. A credit reporting agency may not collect, store, retain or report credit information unless it is capable of corroboration from another source.

Where the credit risk of a consumer is being assessed by a person, that person must, on the request of the consumer, inform the consumer if a credit report has been obtained and the name of the credit reporting agency. A person may not procure or prepare a credit report containing personal information from a credit reporting agency unless the person notifies the consumer in writing of the intention to do so, together with the name and address of the credit reporting agency.

A credit reporting agency must, on the request of a consumer and without charge, disclose whether it holds credit information about the consumer, produce the contents for examination and disclose the names of the recipients of reports made within the preceding year. The director may direct the alteration, amendment, restriction or prohibition of the use of credit information that in the director's opinion is inaccurate or does not comply with the Part.

A person who is or has been a credit reporting agency may not sell or lease its files except to a credit reporting agency registered under the Part.

A person who contravenes the Act or a regulation, or fails to comply with an order of the director, is guilty of an offence and liable on summary conviction, in the case of a natural person, to a fine of not more than $10,000 nor less than $500 or to imprisonment for not more than one year, and in the case of a corporation to a fine of not more than $100,000 nor less than $5,000. The Act comes into force on December 1, 2009.

An intimate image is a visual recording of a person made by any means, including a photograph, film or video recording, in which the person is nude or is exposing his or her genital organs or anal region or her breasts, or is engaged in explicit sexual activity, that was recorded in circumstances that gave rise to a reasonable expectation of privacy with respect to the image and, where the image has been distributed, in which the person depicted retained a reasonable expectation of privacy at the time it was distributed.

A person distributes an intimate image where that person publishes, transmits, sells, advertises or otherwise makes the intimate image available to a person other than the person depicted in it. It is a tort for a person to distribute an intimate image of another person without the other person's consent. The tort is committed where the person knows that the person depicted did not consent to the distribution or is reckless as to whether the person depicted consented.

An action for the non-consensual distribution of an intimate image may be commenced without proof of damage. Where an action is commenced, it is presumed that the image was distributed without the consent of the person depicted, and the defendant must establish that he or she had reasonable grounds to believe that he or she had ongoing consent for distribution. It is a defence to show that the distribution is in the public interest and does not extend beyond what is in the public interest.

The court may award general, special, aggravated and punitive damages, order an account of profits, issue an injunction and make any other order that it considers just and reasonable. Where an action is commenced, a person shall not publish or make public the names of the parties or any information that may identify them until the court determines whether to issue a publication ban. A person who contravenes the publication rules in subsection 10(1) or (3) commits an offence. The Act was assented to on November 15, 2018.

A custodian must establish and implement information policies and procedures on the collection, storage, transfer, copying, modification, use and disposition of personal health information, whether within or outside the province. A custodian must ensure that its employees, agents, contractors and volunteers take an oath or affirmation of confidentiality.

A custodian must take steps that are reasonable in the circumstances to protect personal health information in its custody or control against theft, loss and unauthorized access, use or disclosure. Where a custodian collects personal health information directly from the individual, it must take reasonable steps to inform the individual of the purpose for the collection, use and disclosure of the information.

A custodian may not collect personal health information about an individual unless the individual has consented to its collection and the collection is necessary for a lawful purpose, or the collection is permitted or required by the Act. A consent to the collection, use or disclosure of personal health information may be express or implied.

Where the Act requires consent to the disclosure of personal health information, the consent must be express where a custodian discloses the information to a person that is not a custodian. A custodian must limit the use of personal health information to those of its employees and agents who need to know the information to carry out the purpose for which it was collected or a purpose authorized under the Act.

A custodian may not disclose personal health information unless it has the individual's consent and the disclosure is necessary for a lawful purpose, or the disclosure is permitted or required by the Act. A custodian or information manager is not found to have contravened the collection, use, disclosure and protection offences if it can establish that all reasonable steps were taken to prevent the contravention.

A person who provides goods or services for the purpose of enabling a custodian to use electronic means to collect, use, modify, disclose, retain or dispose of personal health information must comply with the Act and the regulations.

An information manager is a person or body, other than an employee of a custodian acting in the course of employment, that processes, retrieves, stores or disposes of personal health information for a custodian or provides information management or information technology services to a custodian.

A custodian that retains the services of an information manager must enter into a written agreement that provides for the protection of the personal health information against unauthorized access, use, disclosure, disposition, loss or modification. An information manager may use or disclose the information only for the purpose the agreement authorizes. An information manager must comply with the Act, the regulations and the terms of its agreement with the custodian.

An information manager may not permit an employee or a person acting on its behalf to access the information unless that person agrees in writing to comply with the Act and the restrictions imposed on the information manager. The custodian remains responsible under the Act for information disclosed to an information manager, which is considered to continue in the custody and control of the custodian.

Unless the parties agree otherwise, an offer or the acceptance of an offer, or any other matter that is material to the formation or operation of a contract, may be expressed by means of electronic information or by an action in electronic form, including touching or clicking on an appropriately designated icon or place on a computer screen or otherwise communicating electronically in a manner that is intended to express the offer, acceptance or other matter.

A contract shall not be denied legal effect or enforceability by reason only that electronic means or information were used in its formation. A contract may be formed by the interaction of an electronic agent and a natural person or by the interaction of electronic agents. An electronic agent is a computer program or other electronic means used to initiate an action or to respond to electronic documents or actions without review by a natural person at the time of the response or action.

A transaction entered into by a natural person interacting with the electronic agent of another person has no legal effect and is not enforceable if the natural person made a material error in the electronic information provided and the other conditions of section 22 are met. Nothing in the Act limits the operation of a law that expressly authorizes, prohibits or regulates the use of electronic information. The Act was assented to on December 13, 2001.