On June 26th, the Information and Privacy Commissioner of British Columbia held that a school board met the “necessary collection” standard in the British Columbia Freedom of Information and Protection of Privacy Act in its use of an online assessment tool for teacher recruiting. He also held that the Board had complied with the FIPPA security standard and the Act’s requirement for storing and accessing personal information outside of Canada (as the assessment was administered by a third-party with databases located in Nebraska).
The “necessity” ruling is broad in its analysis. The Commissioner held that the meaning of necessity depends on the context:
At the same time, I am not prepared to accept, as the Complainants contend, that in all cases personal information should be found to be “necessary” only where it would be impossible to operate a program or carry on an activity without the personal information. There may be cases where personal information is “necessary” even where it is not indispensable in this sense. The assessment of whether personal information is “necessary” will be conducted in a searching and rigorous way. In assessing whether personal information is “necessary”, one considers the sensitivity of the personal information, the particular purpose for the collection and the amount of personal information collected, assessed in light of the purpose for collection. In addition to FIPPA’s privacy protection objective is also relevant in assessing necessity noting that this statutory objective is consistent with the internationally recognized principle of limited collection.
On this standard, he held the Board’s collection of personal information was necessary. Although the Board had successfully recruited teachers for years before implementing the new assessment process, he accepted evidence that the new process was efficacious in identifying the best teachers and allowed the Board to more rapidly screen a large number of candidates.
The USA Patriot Act part of Commissioner Loukidelis’s award is more fact-specific, but also demonstrates a pragmatic approach. Although he held that the Board was compliant, the Commissioner did recommend that the service provider take steps to replace identifying information with unique numerical identifiers for the purposes of permanently storing data.
Note that the collection standard in the British Columbia Act is essentially the same as is included in Ontario’s public sector privacy legislation. The Ontario standard was recently considered by the Ontario Court of Appeal for the first time the Cash Converters Canada Inc. v. Oshawa (City) decision, released on July 4th. The Court adopted the standard endorsed by the Ontario Commissioner, which arguably more rigid and restrictive than the one described above.