Privacy Question

[undercoverbrother]

I have one.

Is the onus soley on the entity holding an indiviual's private information to ensure it is used/released in accordance with the law, or is there also an onus on entities asking for private information to know if they should ask for the information.


example:

Company A has information on individual Z, collected through the normal course of their business. Company B askes Company A for information on individual Z.

I know Company A must ensure they are compliant with PIPEDA, but is there also an onus on Company B to know what the can request?

I hope that is complicated enough....

[Super Nintendo Chalmers]

Err on the side of caution and put the onus on Company A. I've had a situation where the VPD asked me for information on an individual they had no right in requesting.

[timun]

Both, but mostly on A. Company A cannot disclose any information about Individual Z to Company B without Z's consent, and B shouldn't even be asking for the information unless they have a clear purpose for it and it's absolutely necessary.