Protection of Personal Information
Use of personal information 7. Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except
(a) for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose; or
(b) for a purpose for which the information may be disclosed to the institution under subsection 8(2).
1980-81-82-83, c. 111, Sch. II "7".

Disclosure of personal information 8. (1) Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this section.
Where personal information may be disclosed (2) Subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed
(a) for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose;
(b) for any purpose in accordance with any Act of Parliament or any regulation made thereunder that authorizes its disclosure;
(c) for the purpose of complying with a subpoena or warrant issued or order made by a court, person or body with jurisdiction to compel the production of information or for the purpose of complying with rules of court relating to the production of information;
(d) to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada;
(e) to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed;
(f) under an agreement or arrangement between the Government of Canada or an institution thereof and the government of a province, the government of a foreign state, an international organization of states or an international organization established by the governments of states, or any institution of any such government or organization, for the purpose of administering or enforcing any law or carrying out a lawful investigation;
(g) to a member of Parliament for the purpose of assisting the individual to whom the information relates in resolving a problem;
(h) to officers or employees of the institution for internal audit purposes, or to the office of the Comptroller General or any other person or body specified in the regulations for audit purposes;
(i) to the National Archives of Canada for archival purposes; 
(j) to any person or body for research or statistical purposes if the head of the government institution
(i) is satisfied that the purpose for which the information is disclosed cannot reasonably be accomplished unless the information is provided in a form that would identify the individual to whom it relates, and
(ii) obtains from the person or body a written undertaking that no subsequent disclosure of the information will be made in a form that could reasonably be expected to identify the individual to whom it relates;
(k) to any association of aboriginal people, Indian band, government institution or part thereof, or to any person acting on behalf of such association, band, institution or part thereof, for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada;
(l) to any government institution for the purpose of locating an individual in order to collect a debt owing to Her Majesty in right of Canada by that individual or make a payment owing to that individual by Her Majesty in right of Canada; and
(m) for any purpose where, in the opinion of the head of the institution,
(i) the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or
(ii) disclosure would clearly benefit the individual to whom the information relates.
Personal information disclosed by National Archives (3) Subject to any other Act of Parliament, personal information under the custody or control of the National Archivist of Canada that has been transferred to the National Archivist by a government institution for archival or historical purposes may be disclosed in accordance with the regulations to any person or body for research or statistical purposes.
Copies of requests under paragraph (2)(e) to be retained (4) The head of a government institution shall retain a copy of every request received by the government institution under paragraph (2)(e) for such period of time as may be prescribed by regulation, shall keep a record of any information disclosed pursuant to the request for such period of time as may be prescribed by regulation and shall, on the request of the Privacy Commissioner, make those copies and records available to the Privacy Commissioner.
Notice of disclosure under paragraph (2)(m) (5) The head of a government institution shall notify the Privacy Commissioner in writing of any disclosure of personal information under paragraph (2)(m) prior to the disclosure where reasonably practicable or in any other case forthwith on the disclosure, and the Privacy Commissioner may, if the Commissioner deems it appropriate, notify the individual to whom the information relates of the disclosure.
Definition of "Indian band" (6) In paragraph (2)(k), "Indian band" means
(a) a band, as defined in the Indian Act;
(b) a band, as defined in the Cree-Naskapi (of Quebec) Act, chapter 18 of the Statutes of Canada, 1984;
(c) the Band, as defined in the Sechelt Indian Band Self-Government Act, chapter 27 of the Statutes of Canada, 1986; or
(d) a first nation named in Schedule Ii to the Yukon First Nations Self-Government Act.
R.S., 1985, c. P-21, s. 8; R.S., 1985, c. 20 (2nd Supp.), s. 13, c. 1 (3rd Supp.), s. 12; 1994, c. 35, s. 39.
Record of disclosures to be retained 9. (1) The head of a government institution shall retain a record of any use by the institution of personal information contained in a personal information bank or any use or purpose for which that information is disclosed by the institution where the use or purpose is not included in the statements of uses and purposes set forth pursuant to subparagraph 11(1)(a)(iv) and subsection 11(2) in the index referred to in section 11, and shall attach the record to the personal information.
Limitation (2) Subsection (1) does not apply in respect of information disclosed pursuant to paragraph 8(2)(e).
Record forms part of personal information (3) For the purposes of this Act, a record retained under subsection (1) shall be deemed to form part of the personal information to which it is attached.
Consistent uses (4) Where personal information in a personal information bank under the control of a government institution is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled by the institution but the use is not included in the statement of consistent uses set forth pursuant to subparagraph 11(1)(a)(iv) in the index referred to in section 11, the head of the government institution shall
(a) forthwith notify the Privacy Commissioner of the use for which the information was used or disclosed; and
(b) ensure that the use is included in the next statement of consistent uses set forth in the index.
1980-81-82-83, c. 111, Sch. II "9"; 1984, c. 21, s. 89.