Freedom of Information and Protection of Privacy Act

(as it applies to Contractor's Records) 

 

What are the purposes of the Freedom of Information and Protection of Privacy Act?

The Freedom of Information and Protection of Privacy Act has two purposes:

  1. to make public bodies, such as TransLink, more accountable to the public; and 
  2. to enhance the protection of individual privacy in relation to personal records held by public bodies.

The first purpose is achieved by providing for a general right of access to government records, in response to written requests - often referred to as "Freedom of Information" of "FOI" requests.  (This  Statutory right of access is subject to certain limited and specific 'exceptions' established by the Act.)  the Act's second purpose is to impose clear limitations on how public bodies - such as TransLink - collect, use and disclose personal information.

 

What are "records" within the meaning of the Act?

Within the meaning of the ACT, the terms "records" includes documents, maps, drawings, photographs, letters, vouchers, papers and any other thing on which information is recorded or stored by any means - whether graphic, electronic, mechanical or otherwise - that are in the custody or under the control of a public body.

 

Records "in the custody or under control" of TransLink

The only records which are subject to the Freedom in Information and Protection of Privacy Act are those that are "in the custody or under the control" of a public body.  Records not in the custody or under the control of the public body are not subject to the Act.

"Custody" generally refers to having physical possession of the records, which normally, includes responsibility for their access, management, maintenance, preservation, security and disposal.

A record is in TransLink's "control" if either it, or any of its subsidiaries, has the power to restrict, regulator or administer the content, use, or disposal of that record.  Control can exist even if its records are held off-site by a contractor.

Control is indicated in circumstances where:

  • a contract would permit TransLink, or one of its subsidiaries, to possess or copy specific records produced, received or acquired by the contractor as a result of the contract;
  • a contract includes a requirement for the contractor to maintain the records or submit them to TransLink, or one of its subsidiaries.

If TransLink genuinely has custody or control of requested records, those records must be provided to our information and Privacy Office for the purpose of making a release decision.  Recorded information not covered by one of the Act's 'exceptions' will be released.

 

How does the Act affect bidders and contractors?

As a bidder for a contract procurement, you will be required to provide TransLink, or one of its subsidiaries, with certain information that will potentially be the subject of an FOI request.  Furthermore, you should be aware that you will have access to, or produce, records that may be legally be in custody or under the control of TransLink and thus subject to the Act's access requirements.

Information that you create or submit to TransLink,or one of its subsidiaries, will be disclosed if requested under the Act, unless the supplied information meets one of the Act's exceptions to disclosure.

 

When is a bidder/contractor information NOT released?

In order for information supplied by bidders and contractors to be withheld from disclosure under the Act, the bidder or contractor must be able to demonstrate that significant harm to the business interests of the bidder or contractor would occur if disclosure took place.  In order for such information to be withheld from disclosure, the relevant information must meet all three parts of a cumulative test established by Section 21 of the Act:

  • the information would reveal a contractor's trade secret of its commercial, financial, labour relations, scientific or technical information;
  • the information was supplied in confidence, either implicitly or explicity (preferred explicitly); and
  • the disclosure could reasonably be expected to have one of the following consequences:
    • harm a contractor's competitive position or interfere significantly with its negotiatiing position;
    • result in similar information no longer being supplied;
    • result in undue financial loss or gain to any person or organization; or
    • reveal information related to a labour relations dispute.

 

Confidentiality Agreements

Because TransLink and its subsidiaries are legally bound by the Freedom in Information and Protection of Privacy Act, the confidentiality of any document that comes into our custody or under our control cannot be guaranteed with absolute certainty.  TransLink will however, to the auhtorized by Section 21 of the Act, attempt to protest sensitive third party business information from inappropriate release.

As a bidder or contractor with TransLink or one of its subsidiaries, you should keep in mind that one component of the Act's Section 21 test relates to the information having been supplied to TransLink in confidence.  Proof that  the information was indeed supplied in confidence is necessary for reliance on this Section.  Contractors therefore, should identify sensitive business information in their procurement submission as being supplied in confidence.   Such information, however, must be of the type normally kept confidential both currently and by way of past practice.  The statement should be explicit and in writing, clearly identifying the expectations of the person submitting the documents.

In addition, tender and contract documents may contain the following statement:

"CONFIDENTIALITY AND FREEDOM OF INFORMATION:  All proposal information supplied to by potential suppliers is understrood to be supplied, explicitly in confidence.  However, suppliers should be aware that the Freedom of Information and Protection of Privacy Act applies to all proposal submissions and other records, and that TransLink and its subsidiaries will comply fully with all provisions of the Act."

Notification of Contractors

TransLink will not normally notify a contractor if it determines that an access request would be denied outright.

In the event that a determination is made that the information being sought clearly fails to come under one of the exceptions and is unquestionably releasable - TransLink may make a release decision without consulting third parties.  As a matter of courtesy, however, in such circumstances TransLink will usually advise the third party that such a request has been received - an how it will be handled.

On the other hand, when a request has been received for information submitted by the contractors, TransLink will normally notify the contractor if the relevant records contain information that TransLink believes may be subject to a disclosure exception and TransLink is considering releasing the requested records, either in whole or in part.  This allows the contractor an opportunity to either consent to disclosure or, alternatively, demonstrate why specific information should not be disclosed.  To be withheld, the third party business information must meet all three parts of Section 21 test; sufficient evidence as to harm must be provided for a successful application of this exception to disclosure.

 

Personal Privacy

There may be instances where a company, as part of its contractual arrangements with TransLink or one of its subsidiaries will submit personal information about their employees; in such circumstances, the Act's privacy requirements may apply to that information.

Individuals retained under contract to perform services from public bodies are considered "employees" for the purpose of the Act.  Financial and other details of a personal services contract may be released to a requester.

If a contract exists between TransLink, or one of its subsidiaries, and a company or organization (as opposed to an "individual"), the employees of that company or organization are not considered to be TransLink "employees" for the purpose of the Act.

A contractor having access to personal information held by TransLink or one of its subsidiaries-or collecting it on our behalf-is obliged to comply with the Act's privacy provisions.

The following are some instances where the disclosure of another person's personal information, without consent, would be considered an invasion of privacy:

  • when the disclosure details an individual's employment, occupational or educational history (e.g. resumes attached to a proposal);
  • when the disclosure relates to an individual's medical or psychological history, diagnosis, condition, treatment or evaluation;
  • when the disclosure indicates an individual's racial or ethnic origin, sexual origin, sexual orientation, religious or political beliefs;
  • when the disclosure provides information that was obtained on a tax return or gathered for the purpose of collecting tax;
  • when the disclosure consists of personal recommendations or evaluations, character references or personal evaluations;
  • when the disclosure describes the finance, income, assets, liabilities, net worth, bank balances, financial history or activities, or credit worthiness of an individual;
  • when the disclosure consists of their names, address or telephone numbers and is to be used for mailing lists or solicitations by telephone or other means.

 

Advice for Bidders and Contractors

  • Identify, in the contract, those records over which TransLink or one of its subsidiaries will have "control".
  • Identify which records you will be expected to keep-and for how long.
  • Include, within your contract, a confidentiality agreement that identifies information, the disclosure of which would seriously harm your business interests.
  • Understand that information, not subject to an exception, will be released in response to a request.
  • Be aware that if you are collecting personal information for TransLink or one of its subsidiaries, the Act imposes obligiations for the protection of this type of personal information in your custody.
  • Remember that if you have collected personal information on behalf of TransLink, or one of its subsidiaries, you will need to comply with our security standards for storing is so as to protect it from  unauthorized access, use, disclosure or disposal.