释放了个人的信息也是需要法律细节来约束的。
Part 6 — Disclosure of Personal Information
Limitations on disclosure of personal information
17 Subject to this Act, an organization may disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances and that
(a) fulfill the purposes that the organization discloses under section 10 (1),
(b) for information collected before this Act comes into force, fulfill the purposes for which it was collected, or
(c) are otherwise permitted under this Act.
Disclosure of personal information without consent
18 (1) An organization may only disclose personal information about an individual without the consent of the individual, if
(a) the disclosure is clearly in the interests of the individual and consent cannot be obtained in a timely way,
(b) the disclosure is necessary for the medical treatment of the individual and the individual does not have the legal capacity to give consent,
(c) it is reasonable to expect that the disclosure with the consent of the individual would compromise an investigation or proceeding and the disclosure is reasonable for purposes related to an investigation or a proceeding,
(d) the personal information is collected by observation at a performance, a sports meet or a similar event
(i) at which the individual voluntarily appears, and
(ii) that is open to the public,
(e) the personal information is available to the public from a source prescribed for the purposes of this paragraph,
(f) the disclosure is necessary to determine suitability
(i) to receive an honour, award or similar benefit, including an honorary degree, scholarship or bursary, or
(ii) to be selected for an athletic or artistic purpose,
(g) the disclosure is necessary in order to collect a debt owed to the organization or for the organization to repay an individual money owed to them by the organization,
(h) the personal information is disclosed in accordance with a provision of a treaty that
(i) authorizes or requires its disclosure, and
(ii) is made under an enactment of British Columbia or Canada,
(i) the disclosure is for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body with jurisdiction to compel the production of personal information,
(j) the disclosure is to a public body or a law enforcement agency in Canada, concerning an offence under the laws of Canada or a province, to assist in an investigation, or in the making of a decision to undertake an investigation,
(i) to determine whether the offence has taken place, or
(ii) to prepare for the laying of a charge or the prosecution of the offence,
(k) there are reasonable grounds to believe that compelling circumstances exist that affect the health or safety of any individual and if notice of disclosure is mailed to the last known address of the individual to whom the personal information relates,
(l) the disclosure is for the purpose of contacting next of kin or a friend of an injured, ill or deceased individual,
(m) the disclosure is to a lawyer who is representing the organization,
the disclosure is to an archival institution if the collection of the personal information is reasonable for research or archival purposes,
(o) the disclosure is required or authorized by law, or
(p) the disclosure is in accordance with sections 19 to 22.
(2) An organization may disclose personal information to another organization without consent of the individual to whom the information relates, if
(a) the individual consented to the collection of the personal information by the organization, and
(b) the personal information is disclosed to the other organization solely
(i) for the purposes for which the information was previously collected, and
(ii) to assist the other organization to carry out work on behalf of the first organization.
(3) An organization may disclose personal information to another organization without consent of the individual to whom the information relates, if the organization was authorized by section 12 (2) to collect the personal information from or on behalf of the other organization.
(4) An organization may disclose personal information to another organization, or to a public body, without consent of the individual to whom the information relates, if
(a) the personal information was collected by an organization under section 12 (1) (k) or (l),
(b) the disclosure between the organizations, or between the organization and the public body, is for the purposes for which the information was collected,
(c) the disclosure is necessary for those purposes, and
(d) for each disclosure under this subsection, the third party referred to in section 12 (1) (k) or (l), as applicable, consents to the disclosure.
Disclosure of employee personal information
19 (1) Subject to subsection (2), an organization may disclose employee personal information without the consent of the individual.
(2) An organization may not disclose employee personal information without the consent of the individual unless
(a) section 18 allows the disclosure of the employee personal information without consent, or
(b) the disclosure is reasonable for the purposes of establishing, managing or terminating an employment relationship between the organization and the individual.
(3) An organization must notify an individual that it will be disclosing employee personal information about the individual and the purposes for the disclosure before the organization discloses employee personal information about the individual without the consent of the individual.
(4) Subsection (3) does not apply to employee personal information if section 18 allows it to be disclosed without the consent of the individual.
Transfer of personal information in the sale of an organization or its business assets
20 (1) In this section:
"business transaction" means the purchase, sale, lease, merger or amalgamation or any other type of acquisition, disposal or financing of an organization or a portion of an organization or of any of the business or assets of an organization;
"party" means a person or another organization that proceeds with the business transaction.
(2) An organization may disclose personal information about its employees, customers, directors, officers or shareholders without their consent, to a prospective party, if
(a) the personal information is necessary for the prospective party to determine whether to proceed with the business transaction, and
(b) the organization and prospective party have entered into an agreement that requires the prospective party to use or disclose the personal information solely for purposes related to the prospective business transaction.
(3) If an organization proceeds with a business transaction, the organization may disclose, without consent, personal information of employees, customers, directors, officers and shareholders of the organization to a party on condition that
(a) the party must only use or disclose the personal information for the same purposes for which it was collected, used or disclosed by the organization,
(b) the disclosure is only of personal information that relates directly to the part of the organization or its business assets that is covered by the business transaction, and
(c) the employees, customers, directors, officers and shareholders whose personal information is disclosed are notified that
(i) the business transaction has taken place, and
(ii) the personal information about them has been disclosed to the party.
(4) A prospective party may collect and use personal information without the consent of the employees, customers, directors, officers and shareholders of the organization in the circumstances described in subsection (2) if the prospective party complies with the conditions applicable to that prospective party under that subsection.
(5) A party may collect, use and disclose personal information without the consent of the employees, customers, directors, officers and shareholders of the organization in the circumstances described in subsection (3) if the party complies with the conditions applicable to that party under that subsection.
(6) If a business transaction does not proceed or is not completed, a prospective party must destroy or return to the organization any personal information the prospective party collected under subsection (2) about the employees, customers, directors, officers and shareholders of the organization.
(7) This section does not authorize an organization to disclose personal information to a party or prospective party for purposes of a business transaction that does not involve substantial assets of the organization other than this personal information.
(8) A party or prospective party is not authorized by this section to collect, use or disclose personal information that an organization disclosed to it in contravention of subsection (7).
Disclosure for research or statistical purposes
21 (1) An organization may disclose, without the consent of the individual, personal information for a research purpose, including statistical research, only if
(a) the research purpose cannot be accomplished unless the personal information is provided in an individually identifiable form,
(b) the disclosure is on condition that it will not be used to contact persons to ask them to participate in the research,
(c) linkage of the personal information to other information is not harmful to the individuals identified by the personal information and the benefits to be derived from the linkage are clearly in the public interest,
(d) the organization to which the personal information is to be disclosed has signed an agreement to comply with the following:
(i) this Act;
(ii) the policies and procedures relating to the confidentiality of personal information of the organization that collected the personal information;
(iii) security and confidentiality conditions;
(iv) a requirement to remove or destroy individual identifiers at the earliest reasonable opportunity;
(v) prohibition of any subsequent use or disclosure of that personal information in individually identifiable form without the express authorization of the organization that disclosed the personal information, and
(e) it is impracticable for the organization to seek the consent of the individual for the disclosure.
(2) Subsection (1) does not authorize an organization to disclose personal information for market research purposes.
Disclosure for archival or historical purposes
22 An organization may disclose, without the consent of the individual, personal information for archival or historical purposes if
(a) a reasonable person would not consider the personal information to be too sensitive to the individual to be disclosed at the proposed time,
(b) the disclosure is for historical research and is in accordance with section 21,
(c) the information is about someone who has been dead for 20 or more years, or
(d) the information is in a record that has been in existence for 100 or more years.