4.5
Contracting with a Member of a Professional Regulatory Association Members of professional regulatory organizations are subject to professional standards and have obligations to their governing bodies. Some standards, such as the Generally Accepted Auditing Standards for chartered accountants, require members to document certain matters in their working papers during an audit. Working papers generally describe the records prepared by a professional, such as an accountant or lawyer, as tools to perform a work assignment. Courts have traditionally held that these working papers remain solely in the custody and under the control of the professional. The Information and Privacy Commissioner has also indicated that a public body may not have control of records held by a contracted professional if the records were created for the professional’s own purposes (for example, fulfilling professional obligations), or where the public body would not have the authority to collect the personal information in the records (for example, medical information collected by a counselling services to employees of a public body, under contract) (Order F2006-028).
When contracting with a member of a regulated profession, public bodies should make clear in the contract which records relevant to the contract will remain within the custody and the control of the regulated professional, and which records will come within the custody or control of the public body.
There may be situations in which a public body does not want to maintain control of a contractor’s records, for example, when a public body contracts with a psychologist to provide counselling under an employee assistance program. In the event that the public body receives an access request for the working papers of a professional with whom the public body has contracted, a clear provision in the contract stating that such papers do not fall within the public body’s custody or under its control would support a claim that the FOIP Act does not apply to the records. (An individual could request access to his or her own personal information under PIPA.)
In other situations, where a public body wants to maintain control of records such as working papers in order to maintain accountability to the public, the contract should stipulate that the professional must turn over all working papers to the public body at the end of the contract. Alternatively, the contract could state that the public body retains control over all documentation for the purposes of the FOIP Act.
When negotiating and drafting an agreement with a member of a professional regulatory organization, the public body should bear in mind the requirements of the profession’s legislation and code of conduct. The public body should ensure that the agreement allows the member to comply with his or her professional requirements, and to meet the public body’s obligations with respect to access to information and the protection of privacy.
In addition to providing services to a client on behalf of a public body, a contractor (another public body or a private-sector organization) may provide services to the client on its own behalf. This may occur either at the same time as performing services under contract to the public body, or immediately following expiry of the contract with the public body. This situation raises issues of control of the personal information about clients in the records held by the contractor, and the disposition of the information at the end of the contract.
For example, a public body may contract with a post-secondary educational institution to provide skills training to an individual. That institution may also provide that individual with other training at the same time as, or after, the program that was funded by the public body. Some or all of the information collected by the institution under the contract with the public body will be required by the institution to provide services on its own behalf to the individual.
Similarly, a public body may contract with an employer to provide on-the-job training to an individual, and the employer may decide to employ the individual after the end of that contract. As a prospective employer, the contractor will need much of the information that was provided by the public body at the commencement of the individual’s training, or was created in the course of the training.
The public body may wish to consider the following measures to ensure that the contractor uses personal information provided for the purposes of the contract only as permitted under the FOIP Act.
-
State in the contract that personal information necessary to provide the contracted services to the public body remains under the control of the public body.
-
Specify in the contract what personal information may be disclosed to the contractor acting for the public body and what personal information, if any, may be disclosed to the contractor in its capacity as an independent entity acting on its own behalf. Specify the purpose for which the public body may disclose the information, the circumstances under which the information may be disclosed and any conditions that may apply.
-
Specify in the contract that the contractor may collect personal information of a client from the public body for the contractor’s own purposes only if the public body is authorized to disclose the information and decides to do so. The contract should state that the public body has no obligation to disclose personal information to the contractor, even if it may be reasonable to do so.
If the public body determines that it has the authority to disclose personal information to the contractor for the purpose specified, the public body may require the contractor to confirm that it has the legal authority to collect the information and to do so indirectly (if the contractor is a public body) or without consent (if the contractor is an organization). Details relating to the process of disclosure by the public body and collection by the contractor acting on its own behalf (including any process of obtaining an individual’s consent, if applicable) may be set out as a personal information-sharing agreement in a separate schedule to the contract.
-
Ensure that notification provided to an individual by the contractor acting on behalf of the public body meets the requirements of the FOIP Act, by providing
-
the purpose for which the information is being collected by the public body (including the contractor acting on behalf of the public body),
-
the specific legal authority for the collection by the public body,
-
contact information for a person who can answer the individual’s questions about the collection, use and disclosure of the personal information by the public body.
The contractor should also notify the individual that the public body (including the contractor acting on behalf of the public body) is required to protect personal information in accordance with the FOIP Act.
Consider requiring the provision of additional information, including
-
the specific personal information that may be disclosed to the contractor for the purposes of the contractor acting on its own behalf, and the purpose for which that information will be disclosed, and
-
the specific legal authority for disclosure to the contractor acting on its own behalf and, if consent for disclosure is required, who is responsible for obtaining consent and how valid consent will be obtained.
It is the responsibility of the contractor to provide any required notification to the individual of
-
the purposes of the collection of personal information by the contractor on its own behalf,
-
contact information for a person who can answer the individual’s questions about the collection, use and disclosure of the personal information by the contractor,
-
the contractor’s obligation to protect personal information disclosed by the public body to the contractor for the contractor’s own purposes in accordance with the privacy statute that is applicable to the contractor acting on its own behalf.
Related sections of this Guide
|
Chapter
| -
Key concepts: Custody and control
-
Information-sharing agreements
|
1.2
2.9
| | |
2.10
3
| -
Drafting the contract: Protection of privacy
|
6.3
|
|
