The Child, Youth and Family Services Act (CYFSA) came into force on April 30, 2018 and Part X of the CYFSA came into force on January 1, 2020. Part X has sought to establish new rules for the collection, use, disclosure of, and access to, personal information held by ministry-funded and licensed service providers.
The Child Youth Family Services Act (CYFSA) is an Ontario law that governs certain programs and services for children, youth, and families. The CYFSA is divided into parts and part X sets the rules that service providers must follow to protect privacy and enable access to records of personal information. The Office of the Information and Privacy Commissioner is the oversight body for Part X of the CYFSA.
Privacy and use of personal information have come into the spotlight due to the growing concerns caused by the myriad of privacy concerns and data leaks. When it comes to personal information of children and youth, it becomes even more important to protect these information. Prior to Part X coming into effect, the legislation about privacy in the child, youth and family service sector was complex and resulted in inconsistencies and a lack of clarity around information sharing and privacy rights and protections.
Part X seeks to establish new rules for the collection, use, disclosure of, and access to, personal information held by ministry-funded and licensed service providers. Some agencies are governed by legislations like FIPPA and Personal Health Information Protection Act. However, some ministry-funded agencies such as the Children’s Aid Societies, were not governed by legislation that sets rules for the collection and handling of clients’ personal information.
Part X of the CFSA has attempted to fill this ‘legislative gap’ in the child and youth service sector by providing more consistent protections and rights for children, youth, and families related to their personal information, but it does not replace privacy provisions in existing legislation currently governing ministry service providers. It mainly applies to service providers funded or licensed by the ministry and are not already subject to existing privacy legislation, such as the health sector, government institutions, and youth justice.
It sets out rules for service providers regarding privacy and access to personal information. With limited exceptions, service providers must have consent to collect, use or disclose personal information. They must also take steps to safeguard this information and must notify people if there is a breach of their privacy. Service providers must give individuals access to their records of personal information on request, subject to limited exceptions, and must respond to requests for correction of inaccurate or incomplete records.
From the perspective of service providers in particular, Part X establishes clear rules for collecting, using and sharing clients’ personal information. With limited exceptions, service providers must have consent to collect, use or disclose personal information. These exceptions include circumstances where an investigation or potential investigation by a law enforcement agency requires disclosure, or if there is a formal request for information through a summons or similar legal request. (The disclosure of information to a law enforcement agency to aid an investigation, without a court order is guided under sections 42(1)(g) of FIPPA and 32(g) of MFIPPA.) Further, there are requirements to protect clients’ privacy and to improve transparency and accountability. For example, service providers must promptly respond to clients’ requests to access or correct their personal information, and must notify affected individuals if a breach of personal information has occurred.
Under Part X, clients are able to request access and corrections to their records of personal information. They also have more control and access to how their personal information is shared and handled among service providers and have access to a complaints process and an independent review mechanism. Service providers also have clear rules for collecting, using and sharing clients’ personal information, oversight from the Information and Privacy Commissioner, and requirements to protect clients’ privacy and improve transparency and accountability. Part X also clarifies the ministry’s authority to access, use and share data and includes further privacy requirements.
When a service provider is collecting personal information, the provisions of Part X will also apply to information collected verbally as well. It also doesn’t matter whether a record was created before or after Part X came into force. Even if an individual’s personal information was recorded many years before, they have a right to access their record and you must protect it against privacy breaches.
Service providers should also be aware of confidentiality provisions in other parts of the CYFSA which prevail over Part X, including rules against publicly identifying children and families who participate in child protection hearings.
Service providers are also required to take reasonable steps to protect all forms of records of personal information which is in their custody or control. In order to determine how to protect the personal information, it is important to assess the nature of the records, such as the sensitivity and amount of personal information in the record; number and nature of people with access to the information; and any threats and risks associated with the manner in which the information is kept.
In Ontario (Children, Community and Social Services) (Re), 2019 CanLII 95355 (ON IPC), it was recognized that the outcome of that case was not favourable for the appellants and Part X of the Child, Youth and Family Services Act was mentioned. It was stated that the new provision will provide an individual with a right of access to a record of their personal information that is in a service provider’s custody or control if it relates to the provision of a service to the individual. It was also mentioned that this right of access is subject to a list of exceptions. Furthermore, it was mentioned that a person who is refused access to a record of their personal information will have the right to make a complaint to the IPC, which will have various powers, including the authority to make an order directing the service provider about whom the complaint was made to grant the individual access to the requested record.
Even though there are not many cases as of yet that depict the stance or views of the courts with regard to Part X provisions, but it appears from the available literature that the provisions are being taken as a positive change. Taking example of the case mentioned above, the view expressed there shows that the benefits of the new provisions have been considered even before they came into effect.
Part X brings some promising changes, not only to the use and distribution of personal information in the context of Children’s Aid Society Services, but also to the right to access personal information. It is a reflection of the shift from a needs-based to a rights-based approach for protection of children and provides much better oversight for the service providers.
Service providers also need to be more careful about how they obtain, manage and disclose the data they collect in order to ensure that they are not subject to violations. This might mean employing newer methods and technology for storage of data to keep up with the growing threats to cyber security and privacy. Even though these new provisions might seem to be rather onerous in the beginning, they are not only necessary but will surely help both service providers as well as the clients in more ways than one.
Clients and especially children who are subject to these services will get better protection and will be able to enforce their rights through the oversight powers of the Privacy Commissioner.
Overall, by filling the legislative gaps in the child and youth service sector that had existed prior to the enforcement of the provision, Part X provides more consistent protections and rights for children, youth, and families related to their personal information.
Note: if the current Bill 237 is passed, information collected be subject to further restrictions on disclosure and possession after the individual turns 21.
Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.