Consent for Use and Disclosure under POPA

What is Consent?

The Protection of Privacy Act (POPA) is authority-based legislation, meaning a public body may only collect, use or disclose personal information if authorized. There are many legal authorities for the use and disclosure of personal information under POPA and consent is simply one of many. It’s recommended that consent be used as authority only when you have reviewed and determined that no other legal authority under POPA applies. 

Consent for Use or Disclosure of Personal Information

Section 12(1)(b) of POPA authorizes public bodies to use personal information if the individual the information is about has identified the specific information and provided consent to the use for a particular purpose.

Similarly, section 13(1)(c) of POPA provides authority to disclose personal information if the individual the information is about has identified the specific information and provided consent to the disclosure for a particular purpose. 

Note: Consent must be obtained “in the prescribed manner.” Meaning, consent is only valid if all applicable requirements for obtaining consent are met as set out in the Protection of Privacy Regulation (Regulation).

Rules for Consent for Use or Disclosure of Personal Information under POPA

Public bodies can obtain consent in writing, electronically, or orally. The University of Alberta has established the following rules - approved by the Head - to accept written, electronic and oral consent. Oral consent is allowed only when the University is satisfied that written or electronic consent is not possible for the individual providing consent.

  • Written consent means consent given on paper. The individual must sign the physical document by hand (i.e. with a wet signature).
  • Electronic consent means a consent is provided by electronic means. The electronic consent includes the electronic signature of the individual giving consent.
  • Oral consent means consent is obtained verbally from the individual giving consent in person, over the phone, video call or recording. The program area must document the date and time oral consent was provided including the additional requirements below. The program shall send a copy of the documented oral consent back to the individual to confirm that consent. The program shall retain a copy of that documentation and any response from the individual in accordance with applicable records management policies.

Regardless of the method of consent, to make it valid, the following requirements apply:

  • the consent must clearly specify the exact personal information it covers;
  • must clearly identify who will receive the personal information and how the personal information will be used; and 
  • must include the date the consent becomes effective and the expiration date (if applicable).

Electronic consent must:

  • remain accessible by the University to ensure usability for subsequent reference and is capable of being retained by the University (it’s recommended the University program keep a copy of the electronic consent for its files); 
  • be authenticated in a manner that allows the individual giving the consent to be identified;
  • meet the University’s information technology standards; and
  • is consistent with the Electronic Transactions Act and the University’s policies and procedures on electronic transactions.

Oral consent must:

  • be accessible by the University to ensure usability for subsequent reference and is capable of being retained by the University (the program obtaining oral consent is responsible for documenting the consent - creating a record);
  • be authenticated in a manner that allows the individual giving the consent to be identified; and
  • the method of authentication is reliable for verifying the identity of the individual and for associating the consent with the individual.

IMPORTANT INFORMATION

The University program obtaining consent has discretion over which type of consent the program will accept. The University program area must be satisfied that the individual ​providing consent is the individual the information is about. Program areas will require proof of identification ​such as valid Government issued photo identification with current address and​/or any other applicable required documentation. 

In addition, if a program cannot verify the identification and/or validate the consent, they may decline the consent, and request a new consent form or additional documentation from the individual.

The form available below is in the "prescribed manner" as required by POPA, and is the IPRMO's recommended form to use in order to obtain an individual's consent to use and disclose their personal information.

Consent for Use or Disclosure of Personal Information

CASL (Canadian Anti-Spam Legislation)

When you set up a new process for collecting personal information, consider whether you will be using it to send commercial electronic messages (CEMs). If so, you must obtain a CASL compliant consent from the individual before you send the CEM (subject to some limited exceptions).

For further information about CASL requirements, please see the Office of General Counsel CASL information at the Canadian Anti-Spam Legislation (CASL) Guidance.