Using personal information

Your initiative can only use the personal information for:

• the reason it was originally collected, or
•  a consistent use: a reason directly connected to the initiative’s original purpose

When thinking about using and sharing personal information for non-administrative purposes, such as for research, statistics, auditing and evaluating the program, consider:

• other alternatives, such as the use of aggregate data or de-identified personal information
• whether the benefits of collecting this personal information outweigh the potential invasion of privacy
• how you will establish a ruleset or protocol to properly handle this information

Although evaluating an initiative’s effectiveness is a reasonable non-administrative use of information, make sure to engage the experts to ensure proper disaggregation and de-identification of information. 

Sharing personal information

If your initiative shares personal information with third parties, including other government institutions, make sure you have an Information Sharing Arrangement (ISA). An ISA will outline the rights, responsibilities and accountability of each party.

There are situations where personal information can be shared outside of its original purpose.

Examples of these instances include:

• complying with an Act of Parliament that allows the information to be shared
• complying with a subpoena or warrant issued by a court
• when it is in the public interest (in cases such as an emergency)

A full list of instances when personal information can be shared be found in the Privacy Act.

Even with these exceptions, there may be circumstances where an ISA is needed. Your privacy expert will be able to help you determine when one is needed.

Scenario: Can I evaluate my initiative in a privacy-friendly way?

Who

James, a program manager, wants to determine if his initiative’s benefit was effective in reaching equity-seeking groups.

Situation

An evaluator on his team suggests using disaggregated data from the initiative and linking it to de-identified survey data that their institution has access to. They do so and perform an analysis of the data.

Outcome

The evaluation reported that younger, visible minority workers were more likely to have received the benefit than older non-visible minority individuals. They were able to determine these findings in a privacy-friendly way by using disaggregated and de-identified data.