<<SR_PageTitle>>

Regulation number	Title
R-10.6	Right to Information and Protection of Privacy Act

Under section 85 of the Right to Information and Protection of Privacy Act, the Lieutenant-Governor in Council makes the following Regulation:

Citation

1This Regulation may be cited as the General Regulation - Right to Information and Protection of Privacy Act.

Definition of “Act”

2In this Regulation, “Act” means the Right to Information and Protection of Privacy Act.

Request for access

3A request for access to a record referred to in section 8 of the Act shall be signed by the applicant and include the following information:

(a) the applicant’s name and mailing address;

(b) the applicant’s e-mail address, if any;

(c) the applicant’s telephone number where the applicant can be reached;

(d) the date of the request;

(e) that the request is being made as a request for access to a record under the Act;

(f) the name of the business or organization on behalf of which the applicant is making the request, if any;

(g) whether the applicant is asking to examine a record; and

(h) whether the applicant is asking for a copy of a record and, where it is possible to send the record electronically, whether the applicant is able receive the record by electronic means.

2011-46

Giving of consent

4If the Act requires the consent of an individual to be given, the consent is to be in writing unless, in the opinion of the head of the public body, it is not reasonably practicable to obtain the written consent of the individual.

Body prescribed

2019, c.18, s.11

4.01The Maritime Provinces Higher Education Commission is prescribed as a body from which the Minister of Health or a research data centre may collect personal information for the purposes of subsection 37.1(2) and paragraph 47.1(1)(b) of the Act.

2019, c.18, s.11; 2020-25

Agreements for common or integrated services, programs or activities

2018-24

4.1(1)For the purposes of paragraph 46.2(2)(b) of the Act, a written agreement entered into for the provision of a common or integrated service, program or activity shall contain the following information:

(a) a description of the service, program or activity;

(b) a description of the purposes or expected outcomes or benefits of the service, program or activity;

(c) a description of the respective roles and responsibilities of each party to the agreement;

(d) a description of the types of personal information that are to be collected, used or disclosed by each party in the course of providing the service, program or activity;

(e) a summary of the security arrangements with respect to personal information made by each party under subsection 48.1(1) of the Act; and

(f) the date on which the service, program or activity will start and, if applicable, the date on which the service, program or activity will end.

4.1(2)When a party to a written agreement withdraws from the agreement, the party

(a) shall not use or disclose personal information obtained under the agreement, except

(i) with the prior consent of the person to whom the personal information relates, or

(ii) when required or authorized by law, and

(b) shall comply with the information practices in effect immediately before it withdrew from the agreement for as long as the personal information obtained under the agreement is in its custody or under its control.

2018-24

Information practices

2018-24

4.2(1)The following definitions apply in this section.

“privacy breach” means any incident of unauthorized access, use, disclosure or disposal of personal information in the custody of or under the control of a public body.(atteinte à la vie privée)

“significant harm” includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record and damage to or loss of property.(préjudice grave)

4.2(2)A public body shall make the following security arrangements with respect to personal information in its custody or under its control:

(a) identify

(i) the names or categories of its officers, directors, employees or agents who are authorized to access the personal information,

(ii) the categories of personal information to which those persons or any category of those persons have access, and

(iii) the types of access permitted to the personal information by those persons or any category of those persons;

(b) only allow access to the personal information to persons or categories of persons authorized under paragraph (a);

(c) when responding to requests for disclosure of personal information under the Act, ensure that the request contains sufficient detail to uniquely identify the individual to whom the information relates;

(d) provide for the following procedures, appropriate in each case for the level of risk of unauthorized access, use, disclosure or disposal of the personal information and to the degree of harm that might arise from any unauthorized access, use, disclosure or disposal of the personal information:

(i) with respect to a person seeking access to personal information, verifying the identity of the person seeking access, the categories of personal information to which the person has access and the type of access permitted under paragraph (a);

(ii) recording and monitoring access to the personal information; and

(iii) protecting the personal information while the information is stored or being transferred.

4.2(3)With respect to the security arrangements made by a public body under subsection (2) of this Regulation or subsection 48.1(1) of the Act, the public body shall

(a) require that its officers, directors, employees and agents comply with the security arrangements, and

(b) periodically test and evaluate the effectiveness of the security arrangements.

4.2(4)With respect to a privacy breach, a public body shall take the following measures:

(a) investigate every reported privacy breach, actual or suspected;

(b) maintain a registry of every actual privacy breach reported and any corrective measure taken in relation to the privacy breach to diminish the likelihood of a similar occurrence;

(c) notify a person as soon as possible of any privacy breach involving the person’s personal information if it is reasonable in the circumstances to believe that the privacy breach creates a risk of significant harm to that person; and

(d) notify the Commissioner as soon as possible of any privacy breach under paragraph (c).

4.2(5)The factors that are relevant to determining whether a privacy breach creates a risk of significant harm to the person include

(a) the sensitivity of the personal information involved in the breach, and

(b) the probability that the personal information has been, is being, or will be misused.

4.2(6)For greater certainty, a public body shall retain and dispose of personal information in its custody in accordance with the record schedules established by the Provincial Archivist under the Archives Act, except the following educational bodies:

(a) The University of New Brunswick;

(b) Université de Moncton;

(c) St. Thomas University; and

(d) Mount Allison University.

2018-24

Referral to the Court of King’s Bench

2023, c.17, s.248

5(1)A referral to the Court of King’s Bench of New Brunswick under section 65 of the Act shall be

(a) in Form 1 for an applicant, and

(b) in Form 4 for a third party.

5(2)The applicant or the third party shall complete Part A of Form 1 or Part A of Form 4, as the case may be, and may deliver it to a judge of The Court of King’s Bench of New Brunswick or to a clerk of The Court of King’s Bench of New Brunswick.

5(3)When a judge has completed Part B of Form 1 or Part B of Form 4, the applicant or third party shall within 14 days serve a copy of the completed Form 1 or Form 4, as the case may be, on the head of the public body referred to on the form.

5(4)To the extent they are not inconsistent with this Regulation or the Act, the Rules of Court apply to a referral with the necessary modifications.

2023, c.17, s.248

Complaint to the Commissioner

6(1)A complaint under section 67 of the Act shall be

(a) in Form 2 for an applicant, and

(b) in Form 5 for a third party.

6(2)The applicant or third party shall complete Form 2 or Form 5, as the case may be, and may file it with the Commissioner.

Appeal to the Court of King’s Bench

2023, c.17, s.248

7(1)An appeal under section 75 of the Act shall be

(a) in Form 3 for an applicant, and

(b) in Form 6 for a third party.

7(2)The applicant or third party shall complete Part A of Form 3 or Part A of Form 6, as the case may be, and may deliver it to a judge of The Court of King’s Bench of New Brunswick or to a clerk of The Court of King’s Bench of New Brunswick.

7(3)When a judge has completed Part B of Form 3 or Part B of Form 6, the applicant or third party shall within 14 days serve a copy of the completed Form 3 or Form 6, as the case may be, on the head of the public body referred to on the form.

7(4)To the extent they are not inconsistent with this Regulation or the Act, the Rules of Court apply to an appeal with the necessary modifications.

2023, c.17, s.248

Privacy Assessment Review Committee

8(1) The review committee established under section 77 of the Act shall include a minimum of 5 members appointed by the Minister.

8(2)The Minister shall designate a chair of the review committee from among the members of the review committee.

Estimate of fees

Repealed: 2011-46

2011-46

9Repealed: 2011-46

2011-46

Application fee

Repealed: 2011-46

2011-46

10Repealed: 2011-46

2011-46

Search and preparation fees

Repealed: 2011-46

2011-46

11Repealed: 2011-46

2011-46

Copying fees

Repealed: 2011-46

2011-46

12Repealed: 2011-46

2011-46

Computer programming and data processing fees

Repealed: 2011-46

2011-46

13Repealed: 2011-46

2011-46

Mail and courier delivery

Repealed: 2011-46

2011-46

14Repealed: 2011-46

2011-46

Waiver of fees

Repealed: 2011-46

2011-46

15Repealed: 2011-46

2011-46

Information submitted to the Minister by a public body

16(1)The Minister may request from a public body statistical or any other kind of information that, in the opinion of the Minister, is relevant to the proper administration of the Act.

16(2)Information submitted to the Minister by a public body shall be submitted

(a) in a form and manner acceptable to the Minister, and

(b) by the end of June of each year.

Commencement

17This Regulation comes into force on September 1, 2010.

N.B. This Regulation is consolidated to June 16, 2023.