5 (1)  An organization is responsible for personal information that is in its custody or under its control.

(2)  For the purposes of this Act, where an organization engages the services of a person, whether as    an agent, by contract or otherwise, the organization is, with respect to those services, responsible for that person’s compliance with this Act.

(3)  An organization must designate one or more individuals to be responsible for ensuring that the organization complies with this Act.

Part 2 Protection of Personal Information of the Province of Alberta Personal Information Protection Act, Division 2 Consent

7(1)  Except where this Act provides otherwise, an organization shall not, with respect to personal     information about an individual,

a.) collect that information unless the individual consents to the collection of that information,

b.) collect that information from a source other than the individual unless the individual consents to the collection of that information from the other source,

c.) use that information unless the individual consents to the use of that information, or

d.) disclose that information unless the individual consents to the disclosure of that information.

(2)  An organization shall not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information about an individual beyond what is necessary to provide the product or service.

(3)  An individual may give a consent subject to any reasonable terms, conditions or qualifications established, set, approved by or otherwise acceptable to the individual.

8(1)  An individual may give his or her consent in writing or orally to the collection, use or disclosure of personal information about the individual.

(2)  An individual is deemed to consent to the collection, use or disclosure of personal information about the individual by an organization for a particular purpose if

a.) the individual, without actually giving a consent referred to in subsection (1), voluntarily provides the information to the organization for that purpose, and

b.) it is reasonable that a person would voluntarily provide that information.

(2.1)  If an individual consent to the disclosure of personal information about the individual by one organization to another organization for a particular purpose, the individual is deemed to consent to the collection, use or disclosure of the personal information for the particular purpose by that other organization.

(2.2)  An individual is deemed to consent to the collection, use or disclosure of personal information about the individual by an organization for the purpose of the individual’s enrolment in or coverage under an insurance policy, pension plan or benefit plan or a policy, plan or contract that provides for a similar type of coverage or benefit if the individual

a.) has an interest in or derives a benefit from that policy, plan or contract, and

b.) is not the applicant for the policy, plan or contract.

(3)  Notwithstanding section 7(1), an organization may collect, use or disclose personal information about an individual for particular purpose if

a.) the organization

i.) provides the individual with a notice, in a form that the individual can reasonably be expected to understand, that the organization intends to collect, use or disclose personal information about the individual for those purposes, and

ii.) with respect to that notice, gives the individual a reasonable opportunity to decline or object to having his or her personal information collected, used or disclosed for those purposes,

b.) the individual does not, within a reasonable time, give to the organization a response to that notice declining or objecting to the proposed collection, use or disclosure, and

having regard to the level of the sensitivity, if any, of the information in the circumstances, it is reasonable to collect, use or disclose the information as permitted under clauses (a) and (b).

(4)  Subsections (2), (2.1), (2.2) and (3) are not to be construed so as to authorize an organization to collect, use r disclose personal information for any purpose other than the particular purposes for which the information was collected.

(5)  Consent in writing may be given or otherwise transmitted by electronic means to an organization if the organization receiving that transmittal produces or is able at any time to produce a printed copy or image or a reproduction of the consent in paper form.                                                                                                                                                                                       2003 cP-6.5 s8;2009 c50 s5

9(1)  Subject to subsequent (5), on giving reasonable notice to an organization, an individual may at any time withdraw or vary consent to the collection, use or disclosure by an organization of personal information about the individual.

(2)  On receipt of notice referred to in subsection (1), an organization must, subject to subsection (3), inform the individual of the likely consequences to the individual of withdrawing or varying the consent.

(3)  An organization is not required to inform an individual under subsection (2) if the likely consequences of withdrawing or varying the consent would be reasonably obvious to the individual.

(4)  Except where the collection, use or disclosure of personal information without consent of the individual is permitted under this Act, if an individual withdraws or varies a consent to the collection, use or disclosure of personal information about the individual by an organization, the organization must,

a.) in the case of the withdrawal of a consent, stop collecting, using or disclosing the information, and

b.) in the case of a variation of a consent, abide by the consent as varied.

(5)  If withdrawing or varying a consent would frustrate the performance of a legal obligation, any withdrawal or variation of the consent does not, unless otherwise agreed to by the parties who are subject to the legal obligation, operate to the extent that the withdrawal or variation would frustrate the performance of the legal obligation owed between those parties…

(6)  A withdrawal or variation of a consent by an individual may be given to an organization in the same manner as a consent may be given.

(7)  An individual may, subject to this section, withdraw or vary a consent subject to any reasonable terms, conditions or qualifications established, set, approved by or otherwise acceptable to the individual.

(8)  Nothing is this section is to be construed so as to empower

a.) an individual, as part of the withdrawal or variation of a consent, to impose an obligation or a liability on an organization unless the organization agrees otherwise, or

b.) an organization, as part of the withdrawal or variation of a consent, to impose an obligation or liability on an individual unless the individual agrees otherwise.

10  If an organization obtains or attempts to obtain consent to the collection, use or disclosure of personal information by

a.) providing false or misleading information respecting the collection, use or disclosure of the information, or

b.) using deceptive or misleading practices,

any consent provided or obtained under those circumstances is negated.

Part 2 Protection of Personal Information of the Province of Alberta Personal Information Protection Act, Division 5 Disclosure of Personal Information

19(1) An organization may disclose personal information only for purposes that are reasonable.

(2) Where an organization discloses personal information, it may do so only to the extent that is reasonable for meeting the purposes for which the information is disclosed.

20 An organization may disclose personal information about an individual without the consent of the individual but only if one or more of the following are applicable:

a.) a reasonable person would consider that the disclosure of the information is clearly in the interests of the individual and consent of the individual cannot be obtained in a timely way or the individual would not reasonably be expected to withhold consent;

b.) the disclosure of the information is authorized or required by

i.) a statute of Alberta or of Canada,
ii.) a regulation of Alberta or a regulation of Canada,
iii.) a bylaw of a local government body, or
iv.) a legislative instrument of a professional regulatory    organization;

(b.1) the disclosure of the information is for a purpose for which the information was collected pursuant to a form that is approved or otherwise provided for under a statute of Alberta or a regulation of Alberta;

(c) the disclosure of the information is to a public body and that public body is authorized or required by an enactment of Alberta or Canada to collect the information from the organization;

(c.1) the disclosure of the information is necessary to comply with a collective agreement that is binding on the organization under section 128 of the Labour Relations Code;

(c.2) the disclosure of the information is necessary to comply with an audit or inspection of or by the organization where the audit or inspection is authorized or required by

i.) a statute of Alberta or of Canada, or
ii.) a regulation of Alberta or a regulation of Canada;

(c.3) the disclosure of the information is

i.) to an organization conducting an audit, other than an audit
referred to in clause (c.2), by the organization being audited, or

ii.) by an organization conducting an audit, other than an audit
referred to in clause (c.2), to the organization being audited

for a purpose relating to the audit and it is not practicable to disclose non-identifying information for the purposes of the audit;

(d) the disclosure of the information is in accordance with a provision of a treaty that

i.) authorizes or requires its disclosure, and
ii.) is made under an enactment of Alberta or Canada;

(e) the disclosure of the information is for the purpose of complying with a subpoena, warrant or order issued or made by a court, person or body having jurisdiction to compel the production of information or with a rule of court that relates to the production of information.

(f) the disclosure of the information is to a public body or a law enforcement agency in Canada to assist in an investigation

i.) undertaken with a view to a law enforcement proceeding, or
ii.) from which a law enforcement proceeding is likely to result;

(g) the disclosure of the information necessary to respond to an emergency that threatens the life, health or security of an individual or the public;

(h) the disclosure of the information is for the purposes of contacting the next of kin or a friend of an injured, ill or deceased individual;

(i) the disclosure of the information is necessary in order to collect a debt owed to the organization or for the organization to repay to the individual money owed by the organization;

(j) the information is publicly available as prescribed or otherwise determined by the regulations;

(k) the disclosure of the information is to the surviving spouse or adult interdependent partner or to a relative of a deceased individual if, in the opinion of the organization, the disclosure is reasonable;

(l) the disclosure of the information is necessary to determine the individual’s suitability to receive an honour, award or similar benefit, including an honorary degree, scholarship or bursary;

(m) the disclosure of the information is reasonable for the purposes of an investigation or a legal proceeding;

(n) the disclosure of the information is for the purposes of protecting against, or for the prevention, detection or suppression of, fraud, and the information is disclosed to or by

i.) an organization that is permitted or otherwise empowered or recognized to carry out any of those purposed under

(A) a statute of Alberta or of Canada or of another province                   of Canada,

(B) a regulation of Alberta, a regulation of Canada or similar                   subordinate legislation of another province of Canada                         that, if enacted in Alberta, would constitute a regulation                     of Alberta, or

(C) an order made by a Minister under a statute or
regulation referred to in paragraph (A) or (B),

ii.) Investigative Services, a division of the Insurance Bureau of
Canada, or

iii.) the Canadian Bankers Association, Bank Crime Prevention and Investigation Office;

(o) the organization is a credit reporting organization and is permitted to disclose the information under Part 5 of the Consumer Protection Act;

(p) the organization disclosing the information is an archival institution and the disclosure of the information is reasonable for archival purposes or research;

(q) the disclosure of the information meets the requirements respecting archival purposes or research set out in the regulations and it is not reasonable to obtain the consent of the individual whom the information is about;

(r) the disclosure is in accordance with section 20.1, 21 or 22.

           2003 cP-6.5 s20;2009 c50 s12;2014 c14 s7;2017 c18 s1(24)

25(1)  An individual may, in accordance with section 26, request an organization to correct an error or omission in

the personal information about the individual that is under the control of the organization.

(2)  If there is an error or omission in personal information in respect of which a request for a correction is received

by an organization under subsection (1), the organization must, subject to subsection (3),

a.) correct the information as soon as reasonably possible, and

b.) where the organization has disclosed the incorrect
information to other organizations, send a notification
containing the corrected information to each organization to
which the incorrect information has been disclosed, if it is
reasonable to do so.

(3)  If an organization makes a determination not to make the correction under subsection (2)(a), the organization

must annotate the personal information under its control with the correction that was requested but not made.

(4)  On receiving a notification under subsection (2)(b) containing corrected personal information, an organization

must correct the personal information, an organization must correct the personal information in its custody or under its control.

(5)   Notwithstanding anything in this section, an organization shall not correct or otherwise alter an opinion, including a professional or expert opinion.
2003 cP-6.5 s25;2009 c50 s16

26(1)  A request under section 24(1) or 25(1) must

a.) be in writing, and

b.) include sufficient detail to enable the organization, with a
reasonable effort, to identify any record in the custody or
under the control of the organization containing the personal
information in respect of which the request is made.’

(2)  An applicant who is requesting access to personal information under section 24(1)(a) may ask for a copy of the record containing the personal information or to examine the record.

2003 cP-6.5 s26;2009 c50 s17

32(1)  Subject to subsection (1.1), an organization may charge an applicant who makes a request under section 24(1)(a) or (b) a reasonable fee for access to the applicant’s personal information or for information about

the use or disclosure of the applicant’s personal information.

(1.1) An organization may not charge a fee in respect of a request for personal employee information.

(2) An organization may not charge a fee in respect of a request made under section 25(1).

(3) If an organization is intending to charge an applicant a fee for a service, the organization

a.) must give the applicant a written estimate of the total fee
before providing the service, and

b.) may require the applicant to pay a deposit in the amount
determined by the organization.

                                                    2003 cP-6.5 s32;2009 c50 s23

Part 3 Access to and Correction and Care of Personal Information of the Province of Alberta Personal Information Protection Act, Division 2 Care of Personal Information

33     An organization must make a reasonable effort to ensure that any personal information collected, used or

disclosed by or on behalf of an organization is accurate and complete to the extent that is reasonable for the

organization’s purposes in collecting, using or disclosing the information.

2003 cP-6.5 s33;2009 c50 s24

34     An organization must protect personal information that is in its custody or under its control by making

reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.

34.1(1)  An organization having personal information under its control must, without unreasonable delay, provide

notice to the Commissioner of any incident involving the loss of or unauthorized access to or disclosure of the

personal information where a reasonable person would consider that there exists a real risk of significant

harm to an individual as a result of the loss or unauthorized access or disclosure.

(2)  A notice to the Commissioner under subsection (1) must include the information prescribed by the regulations.

2009 c50 s25

35(1)  An organization may retain personal information only for as long as the organization reasonably requires the personal information for legal or business purposes.

(2)  Within a reasonable period of time after an organization no longer reasonably requires personal information for legal or business purposes, the organization must

a.) destroy the records containing the personal information, or
b.) render the personal information non-identifying so that it can no longer be used to identify an individual.

(3)  Subsection (1) applies not withstanding any withdrawal or variation of the consent of the individual that the personal information is about under section 9.

2003 cP-6.5 s35;2009 c50 s26