Personal information

Personal information is information about an identifiable individual. Under Canada's Privacy Act, the definition is "information about an identifiable individual that is recorded in any form." The Act governs personal information held by federal government institutions, so it shapes how departments handle data in their own operations and in their contracts.

The term appears in Canadian privacy law, in federal information-management and contracting policy, and in NATO data-protection rules. Related terms include personal data, identifiable individual, privacy safeguards, collection, use and disclosure, retention and disposal, and privacy impact assessment. Suppliers meet the term most often when a contract involves collecting, accessing, using, storing, processing, disclosing or disposing of information about people.

What the Privacy Act definition covers

The Privacy Act applies the definition to personal information held by federal government institutions. The definition reaches identifiers, addresses, employment and medical history, financial information and opinions about an individual. The Office of the Privacy Commissioner gives examples that include a name, address, employment history, fingerprints, medical diagnoses and personal opinions.

The Act also expressly includes information about an individual who performs services under contract for a government institution. This applies when the information relates to the services performed, and it names the contract terms, the individual's name and opinions given while performing those services. A supplier's own staff and subcontractors can therefore appear in the definition.

How PIPEDA words the same idea

The Personal Information Protection and Electronic Documents Act (PIPEDA) uses a shorter formulation. Under PIPEDA, personal information means "information about an identifiable individual." Both statutes turn on the same test: whether the information can be tied to an identifiable person.

NATO's term: personal data

NATO does not use "personal information" as its defined term. Its framework speaks of personal data, meaning any information that relates to an identified or identifiable living individual. The NATO personal data protection policy adds that information which can identify a person when combined with other information is also covered. The framework applies to personal data held by NATO.

NATO contract terms carry this into procurement. The NCIA contract general terms and conditions can define purchaser data to include personal data. They require that data to be processed exclusively within the agreed territory and, in any event, within NATO member nations.

Treasury Board safeguards for contracts and arrangements

The Treasury Board of Canada Secretariat sets the contracting rules for federal departments. Its Directive on Privacy Practices requires a department to put appropriate safeguards in place before it discloses personal information to another federal program or to a public or private-sector entity. Those safeguards are set out in a contract, an information-sharing agreement or another arrangement.

• the specific personal information being disclosed
• the purposes of the disclosure
• limits on collection, use and further disclosure
• retention and disposal, including confirmation of destruction where required

What it means for a supplier bidding on Canadian public contracts

If your work will touch information about identifiable people, expect the contract to say how you may handle it. Read the solicitation to see which personal information is involved, why it is shared with you, and what limits apply to your use and further disclosure. Plan for retention and disposal, including proof of destruction when the contract calls for it.

Requirements differ from one solicitation to the next, so no single clause can be assumed. Treat your own employees and subcontractors as people whose information may also fall under the Privacy Act definition when it relates to services under contract. On NATO work, check where the data will be processed, because the NCIA terms limit processing to the agreed territory and NATO member nations.