Saskatchewan

An individual has the right to be informed about the anticipated uses and disclosures of the individual’s personal health information. A trustee must take reasonable steps to ensure that it is able to inform an individual about any disclosures of the individual’s personal health information made without consent after that section came into force. An individual has the right to prevent access to a comprehensive health record of that individual’s personal health information.

Within 30 days after receiving a written request for access, a trustee must respond by making the information available, by informing the applicant that it does not exist or cannot be found, by refusing the request in whole or in part with reasons and notice of the right to a review, or by transferring the request to another trustee.

A trustee may charge a reasonable fee not exceeding the prescribed amount to recover costs incurred in providing access to a record containing personal health information. Within 30 days after a request for amendment is received, the trustee must advise the individual in writing that the amendment has been made or that a notation has been made. The Act is effective September 1, 2003, except for subsections 17(1), 18(2) and 18(4), which are effective August 1, 2023.

A person may apply to the commissioner for a review of a trustee’s decision on an access request, of a refused amendment, or of a believed contravention of the Act. The commissioner may, in a review, require to be produced and examine any personal health information in the custody or control of a trustee, despite any other Act or any privilege available at law.

On completing a review the commissioner prepares a written report with recommendations and reasons and sends a copy to the trustee and the applicant. Within 30 days after receiving the report, the trustee must decide whether to follow the recommendations and give written notice of the decision to the commissioner and the applicant. An applicant may appeal the trustee’s decision to the Court of King’s Bench within 30 days after receiving it.

The commissioner may, after hearing a trustee, recommend that the trustee cease or modify a specified practice of collecting, using or disclosing information that contravenes the Act and destroy collections of personal health information collected in contravention of the Act. The commissioner may from time to time carry out investigations with respect to personal health information in the custody or control of trustees to ensure compliance with the Act.

Every person who contravenes those offence provisions is liable on summary conviction, if an individual, to a fine of not more than $50,000, to imprisonment for not more than one year or to both, and, if a corporation, to a fine of not more than $500,000. The Act is effective September 1, 2003, except for subsections 17(1), 18(2) and 18(4), which are effective August 1, 2023.

It is a tort, actionable without proof of damage, for a person wilfully and without claim of right to violate the privacy of another person.

Proof of auditory or visual surveillance of a person by any means, of listening to or recording a conversation in which the person participates or messages to or from the person passing by means of telecommunications otherwise than as a lawful party, or of use of the person’s name, likeness or voice for advertising or other gain, made without consent, is prima facie evidence of a violation of privacy.

An act is not a violation of privacy where it is consented to, expressly or impliedly, was incidental to the exercise of a lawful right of defence of person or property, or was authorized or required by or under a law in force in the province or by a court. A publication is not a violation of privacy where there were reasonable grounds for belief that the matter published was of public interest or was fair comment on a matter of public interest.

The nature and degree of privacy to which a person is entitled is that which is reasonable in the circumstances, due regard being given to the lawful interests of others. In an action for violation of privacy the court may award damages, grant an injunction, order the defendant to account for profits, order the defendant to deliver up articles or documents, or grant any other relief that appears necessary.

A right of action for violation of privacy under Part 1 is extinguished by the death of the person whose privacy is alleged to have been violated. The Crown is bound by the Act. The consolidation prints the Act as Chapter P-24 of The Revised Statutes of Saskatchewan, 1978, effective February 26, 1979.

No person may operate or act as a credit reporting agency without holding a licence. A credit reporting agency is a person who provides credit reports for gain or profit, or on a regular, co-operative and non-profit basis. A credit report is any written, oral or other communication by a credit reporting agency of credit information, personal information, or both, pertaining to a consumer.

Every credit reporting agency must adopt all reasonable procedures to ensure credit reports are accurate and fair. A credit report may be provided to a person who intends to use the information in connection with a tenancy agreement, for employment purposes or in connection with the underwriting of insurance, among other listed purposes. No person may knowingly obtain any information from the files of a credit reporting agency respecting a consumer except for the purposes the Act lists.

No person may request or obtain a credit report for a purpose listed in clause 17(1)(a) unless the consumer has provided consent or the person provides written notice that a credit report will be obtained and the name and address of the credit reporting agency. A credit report may not include information regarding any debt six years after the last payment was made or, if no payment was made, six years after the debt was incurred.

A user that denies a benefit in whole or in part to a consumer, or increases its cost, as a result of information in a credit report must give the consumer written notice within 30 days after making the decision.

On a consumer’s request a credit reporting agency must disclose without charge the nature and substance of all information in its files respecting the consumer, its sources, the names of persons to whom a credit report was provided in the preceding six months and the contents of any credit report made to another person.

A credit reporting agency that receives written notice of a dispute must investigate within a reasonable time and, if information is incomplete, inaccurate or can no longer be verified, update it and notify the consumer and each person who received a credit report in the preceding six months.

An individual who commits a first offence is liable on summary conviction to a fine of not more than $10,000, imprisonment for not more than one year or both, and a corporation to a fine of not more than $25,000, and a second or subsequent offence carries a fine of not more than $25,000 for an individual and $100,000 for a corporation. The Act came into force on March 1, 2005.

A health services number is a unique number assigned to an individual who is or was registered as a beneficiary to receive insured services within the meaning of The Saskatchewan Medical Care Insurance Act. An individual has the right to refuse to produce his or her health services number or any other prescribed identifying number to any person, other than a trustee who is providing a health service, as a condition of receiving a service.

Except as the Act provides, no person may require an individual to produce a health services number as a condition of receiving any product or service. A person may require the production of another person’s health services number for purposes related to the provision of publicly funded health services or of a health service or program by a trustee, or where an Act or regulation authorizes it.

The Act is effective September 1, 2003, except for subsections 17(1), 18(2) and 18(4), which are effective August 1, 2023.

An information management service provider is a person or body that processes, stores, archives or destroys records of a trustee containing personal health information, or that provides information management or information technology services to a trustee with respect to those records.

A trustee may provide personal health information to an information management service provider to have it process, store, archive or destroy the information for the trustee or to provide the trustee with information management or information technology services, among other purposes.

Before providing personal health information to an information management service provider, a trustee must enter into a written agreement that governs access to and use, disclosure, storage, archiving, modification and destruction of the information, provides for its protection and meets the requirements of the regulations.

The written agreement must describe the specific service the provider will deliver, set out the provider’s obligations respecting the security and safeguarding of the information, and provide for destruction of the information if applicable. The agreement must also require the provider to notify the trustee at the first reasonable opportunity of any breach of the agreement.

An information management service provider shall not use, disclose, obtain access to, process, store, archive, modify or destroy personal health information received from a trustee except for the purposes the Act lists. An information management service provider must comply with the terms of the agreement.

No trustee or information management service provider, or former trustee or information management service provider, may fail to keep secure the personal health information in its custody or control as the Act requires. No person is found to have contravened that requirement if the person can establish that he or she took all reasonable steps to prevent the contravention. Subsections 18(2) and 18(4) are effective August 1, 2023, and the rest of the Act is effective September 1, 2003.

A trustee is, among others, a government institution, or the provincial health authority or a health care organization, that has custody or control of personal health information. A trustee also includes a proprietor as defined in The Pharmacy and Pharmacy Disciplines Act. A trustee also includes a person, other than an employee of a trustee, who is a health professional licensed or registered under an Act for which the minister is responsible.

The regulations prescribe as trustees the health quality council, every person who owns or operates a privately-owned facility in or from which health services are provided by a health professional, and hearing aid dealers.

For the purposes of the definition of personal health information, information with respect to the physical or mental health of the individual includes genetic information, meaning genetic test results, the genetic test results of family members and the individual’s family medical history.

The Act does not apply to statistical information or de-identified personal health information that cannot reasonably be expected, either by itself or when combined with other information available to the person who receives it, to enable the subject individuals to be identified. A trustee may use or disclose personal health information about an individual only with the consent of the subject individual or in accordance with a provision of the Act that authorizes the use or disclosure.

Consent must relate to the purpose for which the information is required, must be informed, must be given voluntarily and must not be obtained through misrepresentation, fraud or coercion. Consent may be express or implied unless otherwise provided, and an express consent need not be in writing. An individual may revoke consent at any time, but no revocation has retroactive effect.

A trustee that has custody or control of personal health information must establish policies and procedures that maintain administrative, technical and physical safeguards protecting the integrity, accuracy and confidentiality of the information and guarding against reasonably anticipated threats, loss and unauthorized access, use, disclosure or modification.

A trustee must provide its employees with orientation and ongoing training about its policies and procedures for protecting personal health information and must ensure that each employee signs a pledge of confidentiality. A trustee must have a written policy concerning the retention and destruction of personal health information that meets the requirements set out in the regulations.

A written retention and destruction policy must include either a requirement that personal health information be retained for at least 10 years after the date of the last episode of care, or until age 20 if the subject individual is a minor, whichever period is longer, or a retention schedule that sets out the legitimate purposes for retaining the information and the retention period and destruction schedule for each purpose.

A trustee must collect, use or disclose only the personal health information that is reasonably necessary for the purpose for which it is being collected, used or disclosed. A trustee must, where practicable, use or disclose only de-identified personal health information if it will serve the purpose. A trustee must collect personal health information directly from the subject individual, except in the circumstances the Act lists.

The Act is effective September 1, 2003, except for subsections 17(1), 18(2) and 18(4), which are effective August 1, 2023.

An intimate image is a visual recording of a person, whether or not the person is identifiable or the image has been altered in any way, in which the person is or is depicted as nude or exposing his or her genital organs, anal region or breasts, or engaging in explicit sexual activity, if it was recorded in circumstances that gave rise to a reasonable expectation of privacy with respect to the image.

A person distributes an intimate image if he or she publishes, transmits, sells, advertises or otherwise distributes the image, or makes it available, to a person other than the person who is or is depicted in the image. It is a tort for a person to distribute or threaten to distribute an intimate image of another person without that other person’s consent.

The tort is committed if the person knows that the person who is or is depicted in the image does not consent to the distribution or is reckless as to whether that person consents. An action under section 7.3 may be commenced without proof of damage. Once an action has been commenced, the distribution is presumed not to have been made with consent, and the defendant must establish that he or she had reasonable grounds to believe that he or she had ongoing consent for distribution of the image.

It is a defence if the distribution is in the public interest and does not extend beyond what is in the public interest. The court may award the plaintiff general, special, aggravated and punitive damages. The court may order any internet intermediary or other person or organization to make every reasonable effort to remove or de-index all intimate images of the plaintiff. The Privacy Amendment Act, 2018 added this Part and received assent on May 9, 2018.

Saskatchewan fixed September 15, 2018 as the day on which The Privacy Amendment Act, 2018 came into force. The Privacy (Intimate Images – Additional Remedies) Amendment Act, 2022 received assent on May 18, 2022. The 2022 amendments extended the tort to a threat to distribute an intimate image.

Unless the parties agree otherwise, an offer or the acceptance of an offer, or any other matter that is material to the formation or operation of a contract, may be expressed by means of information or a document in an electronic form, or by an action in an electronic form, including touching or clicking on an appropriately designated icon or place on a computer screen.

A contract is not denied legal effect or enforceability solely because information or a document in an electronic form was used in its formation. A contract may be formed by the interaction of an electronic agent and an individual or by the interaction of electronic agents.

An electronic agent is a computer program, or any electronic means, used to initiate an action or to respond to electronic information, documents or actions in whole or in part without review by an individual at the time of the response or action.

An electronic document made by an individual with the electronic agent of another person has no legal effect and is not enforceable if the individual made a material error in the document and the electronic agent did not provide the individual with an opportunity to prevent or correct the error, among other conditions.

Nothing in Part II requires a person to provide, receive or retain any information or document in an electronic form, and a person’s consent to do so may be inferred from the person’s conduct. A public body is not presumed to consent to accept information or a document in an electronic form unless it expresses its consent by communication accessible to the public or to those likely to communicate with the public body for particular purposes. The Act came into force on November 1, 2000.

The Act defines an adult film as a film that has, as its main object, the depiction of explicit sexual activity, or a film that contains prescribed scenes. A film is a moving image, other than a video game, and includes videotapes, video discs, film or electronic files. To exhibit a film is to show, project or otherwise display it for viewing by the public. No person may exhibit an adult film to a person who is under 18 years of age.

No person may permit a person who is under 18 years of age to handle, have access to or view an adult film. No person may exhibit an adult film, or sell, rent or otherwise make available a physical copy of one, unless an entity authorized to approve adult films under the laws of a province or territory of Canada, or another prescribed entity, has reviewed and approved the film.

A person who sells, rents or otherwise makes available physical copies of adult films and of no other films must display a sign reading "No admittance to persons under 18 years of age" at all entrances to the business premises and must not allow a person under 18 years of age to enter the premises.

Where such a person also sells, rents or makes available physical copies of other films, the adult films and their advertising material must be segregated from the area in which persons under 18 years of age are allowed. Section 3 of the Act, which requires a person exhibiting a film to display information about the film and its content, does not apply to adult films. The Act came into force on April 1, 2026.