Disclosure of information to foreign state
(1) Subject to subsection (3), the Commissioner may, in accordance with any procedure established under paragraph (4)(b), disclose information referred to in subsection (2) that has come to the Commissioner’s knowledge as a result of the performance or exercise of any of the Commissioner’s duties or powers under this Part to any person or body who, under the legislation of a foreign state, has
(a) functions and duties similar to those of the Commissioner with respect to the protection of personal information; or
(b) responsibilities that relate to conduct that is substantially similar to conduct that would be in contravention of this Part.
Information that can be shared
(2) The information that the Commissioner is authorized to disclose under subsection (1) is information that the Commissioner believes
(a) would be relevant to an ongoing or potential investigation or proceeding in respect of a contravention of the laws of a foreign state that address conduct that is substantially similar to conduct that would be in contravention of this Part; or
(b) is necessary to disclose in order to obtain from the person or body information that may be useful to an ongoing or potential investigation or audit under this Part.
(3) The Commissioner may only disclose information to the person or body referred to in subsection (1) if the Commissioner has entered into a written arrangement with that person or body that
(a) limits the information to be disclosed to that which is necessary for the purpose set out in paragraph (2)(a) or (b);
(b) restricts the use of the information to the purpose for which it was originally shared; and
(c) stipulates that the information be treated in a confidential manner and not be further disclosed without the express consent of the Commissioner.
(4) The Commissioner may enter into arrangements with one or more persons or bodies referred to in subsection (1) in order to
(a) provide for cooperation with respect to the enforcement of laws protecting personal information, including the sharing of information referred to in subsection (2) and the provision of mechanisms for the handling of any complaint in which they are mutually interested;
(b) establish procedures for sharing information referred to in subsection (2);
(c) develop recommendations, resolutions, rules, standards or other instruments with respect to the protection of personal information;
(d) undertake and publish research related to the protection of personal information;
(e) share knowledge and expertise by different means, including through staff exchanges; or
(f) identify issues of mutual interest and determine priorities pertaining to the protection of personal information 2010, c. 23, s. 87.