64. No person may, on behalf of a public body, collect personal information if it is not necessary for the exercise of the rights and powers of the body or the implementation of a program under its management.
A public body may, however, collect personal information if it is necessary for the exercise of the rights and powers or for the implementation of a program of a public body with which it cooperates to provide services or to pursue a common mission.
The collection of information referred to in the second paragraph must be preceded by a privacy impact assessment and carried out under a written agreement that is sent to the Commission. The agreement comes into force 30 days after it is received by the Commission.
The agreement must indicate
(1) the identity of the public body collecting the information and of the public body on whose behalf it is collected;
(2) the purposes for which the information is collected;
(3) the nature or type of information collected;
(4) the means by which the information is collected;
(5) the measures for ensuring the protection of the information;
(6) the intervals at which the information is collected; and
(7) the duration of the agreement.
1982, c. 30, s. 64; 2006, c. 22, s. 35; 2021, c. 252021, c. 25, s. 161.