Secondary use of your personal information

How many times a day are you asked for your email, telephone number, postal code, or birthdate? Probably more than you might realize. Think about when you go to the grocery store, the pharmacy, or to a clothing or electronics store. Many retailers ask for your email to connect purchase history with future promotional offers to better tailor potential discounts with your spending habits. But is this legal? Well, it all comes down to the purpose for which the information was collected.

At the centre of the issue is “secondary use,” a term you may have heard when reading about privacy issues. Privacy advocates look closely at this when analyzing projects and systems. This is because of a central principle in privacy: An individual has a right to know when and how their personal information is used.

Secondary use is when a public body or organization takes personal information it has collected for one purpose and uses it for a different purpose. A basic privacy rule is that personal information should only be used for the purpose for which it was originally collected—the “primary purpose.” Secondary uses of personal information are not normally permitted unless they are consistent with, or reasonably connected to, the purpose for which the personal information was originally collected.[1] For example, when you see your doctor, they collect your personal information to provide you with health care, which is the primary purpose. A secondary use of your personal information could be the subsequent billing to your provincial health care account.

If the purpose for secondary use is not obvious or authorized by law, the public body or organization may need consent to use your information. For example, when you start a new job your photo might be taken for an employee ID card. If the marketing department also wants to use your image for a brochure, they would need your consent.

Sometimes a law may authorize a secondary use without requiring notification or consent. While notification may not be required, it is good policy for organizations and public bodies to tell individuals when they are using their personal information for a secondary purpose, even if consent isn’t required.

What can I do if I have questions?

You have the right to know what organizations and public bodies are doing with your information. After all, it is your information. If you want to know how it is being used, ask the organization who has your personal information, and inform them if you think it has improperly collected, used or disclosed.

If you still have concerns, you can file a complaint with our office.

For more information, please check out our guidance documents. A broad list of your privacy rights can also be found at: https://www.oipc.bc.ca/for-the-public/what-are-my-rights/.

More information about this office can be found at www.oipc.bc.ca.

[1] Paragraph 75, Order F10-31, https://www.oipc.bc.ca/orders/1019.