What and how to collect
What and how to collect personal information
What to collect
Once you’ve determined what personal information is needed for your initiative, you can start collecting it. Make sure you’re only collecting:
- personal information that has a direct connection to your initiative
- the least amount required to meet your objectives
Privacy tip: It's important to remember that the more personal information your initiative collects, the greater the impact of a potential privacy breach.
How to collect
Before you collect, make sure an individual has access to read or hear a privacy notice before providing you with their information.
Collecting directly or indirectly
You should aim to collect personal information used for administrative purpose directly from the individual. This ensures that it’s as accurate and up to date as possible.
That said, there may be instances when your initiative needs to collect that information indirectly, meaning, from somewhere other than the original source. This is usually the case when, for example, an individual has authorized someone else to provide information on their behalf.
Privacy tip: When collecting personal information indirectly, make sure that it is coming from a reliable source and verify its accuracy before using it.
Getting consent for indirect collection
If your initiative is collecting personal information indirectly, you’ll most likely need to get consent. Even if you get consent to collect the personal information, you’ll still need legal authority.
When getting consent, make sure it's properly documented, such as in writing. Inform the individual providing you with their consent about:
- the purpose of the consent and the specific personal information involved
- who’ll be asked to provide personal information
- the reason why the information is being collected indirectly
- any consequences that may result from withholding consent
- any alternatives to providing consent
Plan in advance for situations where an individual refuses to provide their consent or when you are un-able to get their consent because it will:
- result in collecting inaccurate information
- defeat the purpose of the collection
- bias the use of the information collected