The Consent Exception for Research Purposes
Many graphs and magnifying glass on gray background.
A few days ago, I published a short piece on Big Data Analytics: Is Consent Required? While I discuss different data flow scenarios and whether consent should be a requirement under each scenario, I don’t address the consent exception for research purposes. This exception which can be found under each Canadian private sector data protection law is useful when an organization intends to conduct research using personal information.
In Canada, the federal Personal Information Protection and Electronic Documents Act (PIPEDA) sets out ground rules for how private sector federal works, undertakings and businesses collect, use and disclose personal information about individuals, unless such activities are regulated by provincial legislation that has been declared substantially similar to PIPEDA. The B.C. PIPA, the Alberta PIPA and Quebec Act respecting the Protection of Personal Information in the Private Sector (ARPPIPS) have been recognized as substantially similar to PIPEDA, and therefore, this legislation operates in place of PIPEDA in those provinces for intra-provincial matters.
As a general principle, an organization may not use personal information without the knowledge or consent of the individual. However, these laws provide for exceptions to this general principle. One of these exceptions is the exception for research purposes, although each law has different restrictions. For instance, under PIPEDA, the organization must inform the Office of the Privacy Commissioner (OPC) before using the personal information for such research purposes. Under the Quebec ARPPIPS, an organization must file a written request to the Quebec privacy commissioner (the CAI) if it intends to receive communication of personal information for study, research or statistical purposes without the consent of the persons concerned.
I have summarized the relevant legal framework under each private sector jurisdiction:
- PIPEDA
PIPEDA at s. 7 (2) c) provides that an organization may use personal information, even without the knowledge or consent of the individual concerned, if the information is used for statistical or scholarly study or research. However, four conditions are attached to this exception. First, it is imperative that the research purposes cannot be achieved without using the personal information. In other words, if the research purposes can be achieved through other means than through the use of personal information, the exception will not apply. Second, the information must be used in a manner that will ensure its confidentiality. Third, it must be impracticable to obtain consent. Finally, the organization must inform the OPC before the information is used for statistical or scholarly study or research.
- Quebec ARPPIPS
The Quebec legislation provides for a similar exception. The ARPPIPS provides at s. 18(8) that a person carrying on an enterprise may, without the consent of the individual concerned, communicate personal information to a person who is authorized to use the information for study, research or statistical purposes. It is the Commission d’Accès à l’Information (CAI) that has the power to grant a person, upon written request, authorization to receive communication of personal information for study, research or statistical purposes without the consent of the persons concerned. The CAI may grant such an authorization upon two conditions. First, the CAI must be of the opinion that the intended use is not frivolous and the ends contemplated cannot be achieved unless the information is communicated in a form allowing the persons to be identified. Second, the CAI must be of the view that the information will be used in a manner that will ensure its confidentiality. The CAI makes available on its website the form that has to be completed and submitted. This form indicates the information pertaining to the project which must be provided to the CAI.
It is important to mention that such an authorization will be granted for the period and on the conditions fixed by the CAI (s. 21). Moreover, the authorization may be revoked before the expiry of the period for which it is granted if the CAI has reasons to believe that the person authorized does not respect the conditions, including the confidentiality of the information communicated to him. The Court of Quebec has held in the past that the CAI’s authorization granted in that respect is of a discretionary nature, akin to a purely administrative decision (as opposed to a quasi-judiciary act) – (See I.M.S. du Canada ltée c. Commission d’accès à l’information (C.Q., 2001-11-28); see also Bangia c. Commission des droits de la personne et des droits de la jeunesse (C.A.I., 2006-08-11), SOQUIJ AZ-50391848, A.I.E. 2006AC-66, [2006] C.A.I. 360 at para 71). As a result, the CAI has full discretionary powers to revoke or change the fundamental conditions of an authorization, at any time, and there is no administrative appeal process available to challenge the CAI’s authorization (or lack thereof) in that respect. The authorization process takes in average 4 months, but that it can take up to one year.
Finally, s.18.2 of the Quebec ARPPIPS provides that a person carrying an enterprise may communicate personal information to any person for research purposes, even without the consent of the person concerned, “if the documents containing the information are not structured so as to allow retrieval by reference to a person’s name or identifying code or symbol and the information cannot be retrieved by means of such a reference.” The person who receives such confidential information must preserve its confidentiality throughout the period during which the information may not be communicated without the consent of the person concerned (that is, until 100 years have elapsed since the date of the document, or until more than 30 years have elapsed since the death of the person concerned). Moreover, given that the CAI has yet to render a decision on the interpretation of this provision, it is currently slightly difficult to properly evaluate the scope of this provision and its effects.
- B. C. PIPA
The B.C. PIPA provides an extensive section on the disclosure of private information for research or statistical purposes. Section 21 (1) provides that an organization may disclose personal information regarding an individual, without the consent of the individual concerned, for a research purpose, including statistical research. However, like PIPEDA, several conditions are attached to this provision. First, it must be impossible to accomplish the research purpose unless the personal information is provided in an individually identifiable form. Second, the disclosure must not be used to contact individuals to ask them to participate in the research. Third, linkage of the personal information to other information must not be harmful to the individuals identified by the disclosure of the personal information. Moreover, the benefits to be derived from the linkage must clearly be in the public interest. Fourth, under s. 21.1d), the organization to which the personal information is to be disclosed must have signed an agreement to comply with certain conditions:
(i) this Act [the BC PIPA]; ii) the policies and procedures relating to the confidentiality of personal information of the organization that collected the personal information; (iii) security and confidentiality conditions; (iv) a requirement to remove or destroy individual identifiers at the earliest reasonable opportunity; (v) prohibition of any subsequent use or disclosure of that personal information in individually identifiable form without the express authorization of the organization that disclosed the personal information.
Fifth, any subsequent use or disclosure in individually identifiable form of the personal information must be prohibited without the express authorization of the organization that disclosed the personal information.
- Alberta PIPA
S. 20 of the Alberta PIPA provides that an organization may disclose personal information about an individual without the consent of the latter if one or more of certain conditions are applicable. These conditions include the following: if the disclosure of the personal information is authorized or required by law, and if the disclosure of the personal information meets certain requirements set out in the regulations and it is unreasonable to obtain the consent of the individual whom the information is about. Similar provisions exist with respect to the collection and the use of personal information. S. 14 (3) of Alberta PIPA Regulation provides that an organization may disclose, under a research agreement, personal information about an individual without the consent of the latter. However, three conditions are attached to this provision. First, the person to whom the information is to be disclosed must agree to comply with certain confidentiality and security requirements under s. 14(3) of the Alberta PIPA Regulation, which refers to s. 12(3) Alberta PIPA Regulation:
If personal information is to be disclosed under a research agreement, the person to whom the information is to be disclosed must agree to do all of the following: (a) to use the information only for the research purpose; (b) to make reasonable security arrangements to protect the information; (c) to maintain the confidentiality of the information; (d) to not contact any individual to whom the information relates; (e) to remove or destroy, at the earliest reasonable time, individual identifiers; (f) to not disclose the information in individually identifiable form; (g) to notify the archival institution immediately of a breach of the agreement.
Second, the research must have been approved by a recognized research ethics review committee. A “recognized” research ethics review committee would be a university or an educational institution in Alberta. Third, the researcher must have agreed to any additional conditions imposed by the ethics review committee.
This content has been updated on June 3, 2016 at 15 h 06 min.