Canadian Privacy Authorities Address Personal Information Sharing In Situations Involving Intimate Partner Violence

On November 27, 2024, Canada’s federal, provincial, and territorial Privacy Commissioners and Ombuds (the FTP Commissioners) issued a joint resolution (the Resolution) to guide the responsible disclosure of personal information in situations involving intimate partner violence (IPV).

The Resolution provides that IPV is a form of gender-based violence primarily affecting women and gender-diverse individuals, encompassing various forms of harm inflicted by current or former intimate partners. The Resolution also states that in 2023, there were over 120,000 police reported incidents of IPV in Canada with victims or survivors aged 12 years and older.

The Resolution seeks to clarify when and how personal information can be disclosed to respond to IPV situations without putting at-risk individuals at greater risk of harm. While privacy laws generally permit the disclosure of personal information when there is a risk of serious harm to health or safety, the Resolution outlines actions organizations can take to ensure appropriate personal information sharing in the context of IPV situations. These actions include:

1. Establishing policies on permissible disclosures;
2. Requiring staff training around the policies and procedures related to the disclosure of personal information;
3. Adopting culturally sensitive and trauma-informed approaches to support at-risk communities; 
4. Notifying individuals in advance about the possibility that their personal information may be disclosed, to whom, and under what circumstances;
5. Ensuring that privacy and security safeguards are in place to protect personal information under the organization’s custody or control, including response and mitigation plans in the event of a breach;
6. Respecting data minimization principles to limit the disclosure of personal information to only that which is reasonably necessary;
7. Documenting instances where personal information is disclosed and retaining records as required by law; and
8. Collaborating with respective FTP Commissioners to develop policies and procedures around the disclosure of personal information for IPV prevention.

The Resolution also calls on governments to work with their respective privacy authorities to help develop privacy compliant governance frameworks around the disclosure of personal information in IPV situations.

The full text of the Resolution can be found here.

Summary By: Victoria Di Felice