Are You Doing Enough To Protect Your Confidential Information In The Hands Of Public Bodies?

The confidential information of private entities is increasingly becoming the subject of access requests when it comes to access to information and freedom of information laws. Private entities need to understand that any records they provide to public bodies can become public under these laws, and they need to take appropriate steps to protect their information to the extent possible.

The following are some of the key items to keep in mind:

1. Public bodies are subject to access to information or freedom of information laws. Across Canada, federal and provincial freedom of information laws apply to public bodies such as federal and provincial government institutions, Crown corporations, boards, bodies, agencies, and education, health care and local government.
2. Any records can become public. When dealing with public bodies, it is critical for private entities to recognize that any records they provide to a public body can be the subject of an access request. This means it may become public with access to information or freedom of information laws.
3. There is limited protection for third party information. Access to information or freedom of information legislation contains limited protections for third party information. Further, these protections are often narrowly interpreted.
4. Public bodies are required to give access to as much of a record as possible. Where public bodies receive an access request relating to records, the public body must give access to as much of the records as possible. This means that entire documents can become public, unless they are specifically exempt, in whole or part.
5. Contracts between private businesses and public bodies often become public. Access to information and freedom of information laws are designed to promote transparency in government spending. Confidential information in competitive bidding proposals is more likely to meet the requirements for third party protections, if appropriate steps are taken. However, there is a tendency to release contracts in full in response to access requests.
6. There is no definitive way for private entities to protect their records – but they can take proactive steps. Although there is no guaranteed way to protect documents, private entities can take proactive steps to protect confidential documents to the extent possible when it comes to access to information and freedom of information laws. The following are some of the key steps for private entities to take:
   1. Understand that everything you provide to a public body may become public, and limit what you provide to a public body accordingly.
   2. Take steps to understand third party protections under access to information and freedom of information laws and how they apply to your records and interactions.
   3. Provide clear training to your board, management, and staff who interact with public bodies.
   4. Protect what you provide to a public body by developing and implementing a systematic plan to clearly identify confidential portions of records. A blanket approach is likely to be ineffective and may be counterproductive.
   5. Be prepared to fully and completely justify your position relating to the confidential portions of your records. If you are the subject of a review, engage experienced counsel to guide you through the process.

It is important for both public bodies and private entities to seek legal advice when confidential information is being exchanged between them.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.