GENERAL

1. A record capable of being produced from machine readable records is not included in the definition of “record” for the purposes of the Act if the process of producing it would unreasonably interfere with the operations of an institution. R.R.O. 1990, Reg. 823, s. 1. 2. (1) A head who provides access to an original record must ensure the security of the record. R.R.O. 1990, Reg. 823, s. 2 (1). (2) A head may require that a person who is granted access to an original record examine it at premises operated by the institution. R.R.O. 1990, Reg. 823, s. 2 (2). (3) A head shall verify the identity of a person seeking access to his or her own personal information before giving the person access to it. R.R.O. 1990, Reg. 823, s. 2 (3). 3. (1) Every head shall ensure that reasonable measures to prevent unauthorized access to the records in his or her institution are defined, documented and put in place, taking into account the nature of the records to be protected. R.R.O. 1990, Reg. 823, s. 3 (1). (2) Every head shall ensure that only those individuals who need a record for the performance of their duties shall have access to it. R.R.O. 1990, Reg. 823, s. 3 (2). (3) Every head shall ensure that reasonable measures to protect the records in his or her institution from inadvertent destruction or damage are defined, documented and put in place, taking into account the nature of the records to be protected. R.R.O. 1990, Reg. 823, s. 3 (3). 4. (1) An institution is not required to give notice of the collection of personal information to an individual to whom it relates if the head complies with subsection (2) and if, (a) providing notice would frustrate the purpose of the collection; (b) providing notice might result in an unjustifiable invasion of another individual’s privacy; or (c) the collection is for the purpose of determining suitability or eligibility for an award or honour. R.R.O. 1990, Reg. 823, s. 4 (1). (2) For the purpose of subsection (1), the head shall make available for public inspection a statement describing the purpose of the collection of personal information and the reason that notice has not been given. R.R.O. 1990, Reg. 823, s. 4 (2). 5. An institution that uses personal information shall retain it for the shorter of one year after use or the period set out in a by-law or resolution made by the institution or made by another institution affecting the institution, except if, (a) the individual to whom the information relates consents to its earlier disposal; or (b) the information is credit or debit card payment data. O. Reg. 124/15, s. 1. 5.1 A head of an institution that receives a request for access to a record or personal information shall conclude that the request is frivolous or vexatious if, (a) the head is of the opinion on reasonable grounds that the request is part of a pattern of conduct that amounts to an abuse of the right of access or would interfere with the operations of the institution; or (b) the head is of the opinion on reasonable grounds that the request is made in bad faith or for a purpose other than to obtain access. O. Reg. 22/96, s. 1. 5.2 The fee that shall be charged for the purposes of clause 17 (1) (c) or 37 (1) (c) of the Act shall be $5. O. Reg. 22/96, s. 1. 5.3 (1) For the purposes of subsection 39 (1.1) of the Act, the fee payable for appealing a decision of a head to the Commissioner shall be, (a) $25, if the person appealing has made a request for access to a record under subsection 17 (1); (b) $10, if the person appealing has made a request for access to personal information under subsection 37 (1); and (c) $10, if the person appealing has made a request for correction of personal information under subsection 36 (2). O. Reg. 22/96, s. 1. (2) For the purposes of subsection 39 (1.1) of the Act, no fee is payable for appealing a decision of a head to the Commissioner if the person appealing is given notice of a request under subsection 21 (1) of the Act. O. Reg. 22/96, s. 1. 6. The following are the fees that shall be charged for the purposes of subsection 45 (1) of the Act for access to a record: 1. For photocopies and computer printouts, 20 cents per page. 2. For records provided on digital storage devices, $10 for each digital storage device. 3. For manually searching a record, $7.50 for each 15 minutes spent by any person. 4. For preparing a record for disclosure, including severing a part of the record, $7.50 for each 15 minutes spent by any person. 5. For developing a computer program or other method of producing a record from machine readable record, $15 for each 15 minutes spent by any person. 6. The costs, including computer costs, that the institution incurs in locating, retrieving, processing and copying the record if those costs are specified in an invoice that the institution has received. O. Reg. 22/96, s. 2; O. Reg. 93/07, s. 1; O. Reg. 40/26, s. 1. 6.1 The following are the fees that shall be charged for the purposes of subsection 45 (1) of the Act for access to personal information about the individual making the request for access: 1. For photocopies and computer printouts, 20 cents per page. 2. For records provided on digital storage devices, $10 for each digital storage device. 3. For developing a computer program or other method of producing the personal information requested from machine readable record, $15 for each 15 minutes spent by any person. 4. The costs, including computer costs, that the institution incurs in locating, retrieving, processing and copying the personal information requested if those costs are specified in an invoice that the institution has received. O. Reg. 22/96, s. 2; O. Reg. 93/07, s. 2; O. Reg. 40/26, s. 2. 7. (1) If a head gives a person an estimate of an amount payable under the Act and the estimate is $100 or more, the head may require the person to pay a deposit equal to 50 per cent of the estimate before the head takes any further steps to respond to the request. O. Reg. 22/96, s. 3. (2) A head shall refund any amount paid under subsection (1) that is subsequently waived. R.R.O. 1990, Reg. 823, s. 7 (2). 8. The following are prescribed as matters for a head to consider in deciding whether to waive all or part of a payment required to be made under the Act: 1. Whether the person requesting access to the record is given access to it. 2. If the amount of a payment would be $5 or less, whether the amount of the payment is too small to justify requiring payment. R.R.O. 1990, Reg. 823, s. 8. 9. If a person is required to pay a fee for access to a record, the head may require the person to do so before giving the person access to the record. R.R.O. 1990, Reg. 823, s. 9. 10. (1) The following are the terms and conditions relating to security and confidentiality that a person is required to agree to before a head may disclose personal information to that person for a research purpose: 1. The person shall use the information only for a research purpose set out in the agreement or for which the person has written authorization from the institution. 2. The person shall name in the agreement any other persons who will be given access to personal information in a form in which the individual to whom it relates can be identified. 3. Before disclosing personal information to other persons under paragraph 2, the person shall enter into an agreement with those persons to ensure that they will not disclose it to any other person. 4. The person shall keep the information in a physically secure location to which access is given only to the person and to the persons given access under paragraph 2. 5. The person shall destroy all individual identifiers in the information by the date specified in the agreement. 6. The person shall not contact any individual to whom personal information relates directly or indirectly without the prior written authority of the institution. 7. The person shall ensure that no personal information will be used or disclosed in a form in which the individual to whom it relates can be identified without the written authority of the institution. 8. The person shall notify the institution in writing immediately if the person becomes aware that any of the conditions set out in this section have been breached. R.R.O. 1990, Reg. 823, s. 10 (1). (2) An agreement relating to the security and confidentiality of personal information to be disclosed for a research purpose shall be in the form titled “Security and Confidentiality Agreement of Personal Information for Research Purposes”, dated May 1, 2016 and available on the Government of Ontario’s Central Forms Repository website. O. Reg. 172/16, s. 1. 11. A request for access to a record under Part I of the Act or for access to or correction of personal information under Part II of the Act shall be in a written form that specifies that it is a request made under the Act. O. Reg. 47/12, s. 1. Form 1 Revoked: O. Reg. 172/16, s. 2. Form 2 Revoked: O. Reg. 35/11, s. 4.