21. A person carrying on an enterprise may communicate personal information without the consent of the persons concerned to a person or body wishing to use the information for study or research purposes or for the production of statistics.
The information may be communicated if a privacy impact assessment concludes that
(1) the objective of the study or research or of the production of statistics can be achieved only if the information is communicated in a form allowing the persons concerned to be identified;
(2) it is unreasonable to require the person or body to obtain the consent of the persons concerned;
(3) the objective of the study or research or of the production of statistics outweighs, with regard to the public interest, the impact of communicating and using the information on the privacy of the persons concerned;
(4) the personal information is used in such a manner as to ensure confidentiality; and
(5) only the necessary information is communicated.
1993, c. 17, s. 21; 2021, c. 252021, c. 25, s. 1181.