Personal Information Protection Act - Office of the Information and ...

A G u i d e f o r B u s i n e s s e s a n d O r g a n i z a t i o n s o n t h e P e r s o n a l I n f o r m a t i o n P r o t e c t i o n A c t
9 Follow the rules for accuracy, protection and
retention of personal information
Bottom line: Take care of records that you create or receive and keep. Ensure they are
accurate, appropriately protected and retained for reasonable purposes.
Accuracy
You must take reasonable steps to make sure that personal information collected, used or
disclosed by your organization is accurate and complete.
This doesn’t mean that you must routinely update all information. Just update it to the extent
reasonable for its use. This rule helps to prevent using inaccurate or wrong information to
make a decision about an individual.
What is reasonable depends on the
circumstances. For example, be careful when
you get personal information from someone
other than the individual. The information may
not be correct, or you may not have “the whole
story.” Also, what is reasonable will depend on
what the information is going to be used for and
how that will affect the individual.
Protection
You must use reasonable safeguards (physical, administrative and technical) to protect personal
information from such actions as:
▲ someone getting access to, or collecting, using, copying or disclosing, personal information
when he or she is not supposed to;
▲ someone misusing, stealing or losing personal information; or
▲ someone collecting, using, disclosing, copying, changing, destroying or not properly
getting rid of, personal information.
Safeguards should be appropriate to the sensitivity of the information.
Examples of physical safeguards include:
▲ locking file cabinets and areas where files are stored when no one is there
▲ allowing only employees who need access to the storage areas or filing cabinets to have
access to them
▲ clearing files and records containing personal information off your desk at the end of the day
▲ shredding papers containing personal information rather than placing them in a garbage
can or recycling bin (see IPC Investigation Report P2005-IR-001)
44
Service Alberta and the Office of the Information and Privacy Commissioner