Outsourcing agreements often require the service provider to store and process information under the control of the public body off-site. These contracts usually require a significant level of detail, especially with regard to records management and, if personal information is involved, the protection of privacy.
Any outsourcing agreement that involves the transfer of personal information outside Alberta requires consideration of the interaction between the FOIP Act and other legislation that may be applicable to the contractor, as well as government policy on transborder data processing and storage.
2.7
Privatization
A public body may choose to stop delivering certain services and offer non-government organizations the opportunity to move into the service field. These organizations may be private-sector organizations, non-profit organizations, or a combination of the two.
In these instances, the public body may continue to carry on an inspection or auditing role, or undertake licensing and set standards of operations. However, the public body’s control over records transferred to, or created in, a privatized service environment would normally end. The records and personal information would no longer be subject to the FOIP Act. This would include personal information that was originally collected by the public body under conditions that imposed statutory requirements on the public body to protect the privacy of the individuals involved with the service.
It is imperative that a public body obtain legal advice at the concept stage of a proposal for privatization.
Access and privacy considerations
The best way to effect the transfer of records and eliminate control by the public body is through legislation supported by an agreement. It is important to define clearly which records or functions will remain within
the control of the public body, and which records or functions will be transferred to the control of the private service operator. The agreement should clearly identify the authority under which the transfer takes place and the records that are no longer in the custody or under control of the public body and therefore no longer subject to the FOIP Act.
The implementation strategy to effect the privatization should include a record retention and disposition schedule for the alienation of records transferred to the contractor. The schedule should be authorized by the Alberta Records Management Committee before the agreement is signed. The Provincial Archives of Alberta should also be consulted during the contract negotiations, since the Archives may wish to establish procedures for preserving any archival records.
If the transferred records include personal information, the public body should satisfy itself that the private service operator has the ability to protect the personal information in compliance with Alberta’s Personal Information Protection Act (PIPA) and, where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Special consideration is required where the service provider is a non-profit organization as defined in PIPA. The personal information in the custody or under the control of these organizations is subject to PIPA only when the information is collected, used or disclosed by the organization in connection with a commercial activity. Wherever possible, the public body should negotiate a clause in the agreement under which the private service operator agrees to establish a privacy policy designed to ensure protection of personal information equivalent to the protection provided under either Part 2 of the FOIP Act or PIPA.
Related sections of this Guide
|
Chapter
|
-
Other Alberta legislation: PIPA
| |
-
Business case
-
Privacy Impact Assessment (PIA)
| |
-
Organization of records for alternative service delivery
| |