When an applicant makes a request for information, they will provide personal information such as their name, address, email address, and phone number. This information is provided for a specific purpose, which is to process the request. Processing a request may involve the following activities:
- Communicating with the applicant and sending an acknowledgement, clarification, and response letter, and
- Entering the applicant’s information into an internal RTI tracking system or database.
In accordance with ss.43(2) of RTIPPA, the use and disclosure of someone’s personal information must be limited to the minimum amount of information to accomplish its purpose. RTIPPA also says in ss.43(3) that if a public body has someone’s personal information, the use and disclosure of the information must be limited to employees and officers who need that information to fulfil its purpose.
This means that only employees or officers within a public body who are processing a request should have access to an applicant’s information. The amount of information disclosed and used should be limited to the minimum amount necessary.
For example, it makes sense that the person communicating with the applicant and sending a response letter is aware of the applicant’s contact information. However, it would not be appropriate for someone conducting a records search to know this information as they do not need an applicant’s contact information to carry out a records search.