I will just leave this here:
https://www.qp.alberta.ca/1266.cfm?page=P06P5.cfm&leg_type=Acts&isbncln=9780779814381
I also request that you produce the below as required by Alberta law.
https://www.qp.alberta.ca/1266.cfm?page=P06P5.cfm&leg_type=Acts&isbncln=9780779814381
You also might want to read the law in, Alberta you are liable for an offence of $10,000, for every instance of requiring people to provide information you are not entitled to collect.
Shawn
Thank you Shawn for bringing this act up. It was a good read and a good reference point to further the discussion of this topic.
With no disrespect to you, I believe your post is missing a few key points and is misleading.
Your reference to:
"(2) An organization shall not, as a condition of supplying a product
or service, require an individual to consent to the collection, use or
disclosure of personal information about an individual beyond what
is necessary to provide the product or service."
I am assuming you pulled this form Section 6, division 2, or page 12 on the PDF (as you have not referenced the section). This section talks about the businesses asking for consent of their customers. When the act references beyond what is necessary, it means in terms of consent, rather it being a condition for selling you their product or service. In general, a business cannot collect private information with the consumer’s consent. Consumers typically agree to this online when consumers hit the “I accept the terms and conditions” while making a purchase. An example in this context would be, BBC cannot ask for your consent in disclosing information by race or income level (since it is not necessary information to provide their product) in their terms and conditions. While BBC doesn't specifically ask for said information, you’ve given your permission for BBC to legally collect it from you if you hit I accept, in this example that would breach the act.
Furthermore, the key area your post does not address, which is the most relevant fact to the topic of discussion, the key word: “Reasonable.”
Your reference to (found in section 6 or page 12 of the PDF to your link):
“ Policies and practices
6(1) An organization must develop and follow policies and
practices that are reasonable for the organization to meet its
obligations under this Act.”
The word “Reasonable” is defined for us in the Alberta Personal Information Protection Act under Section 2 (or page 7 on your PDF link) it is quoted as below:
“Standard as to what is reasonable
2 Where in this Act anything or any matter
(a) is described, characterized or referred to as reasonable or unreasonable, or
(b) is required or directed to be carried out or otherwise dealt with reasonably or in a reasonable manner,
the standard to be applied under this Act in determining whether the thing or matter is reasonable or unreasonable, or has been carried out or otherwise dealt with reasonably or in a reasonable manner, is what a reasonable person would consider appropriate in the circumstances. “
In BBC’s circumstances, the lawful answer seems to be an open ended one or a gray area. This is done on purpose with many acts which allow flexibility for situations such as this one. Clearly within the post itself there is more than 1 side of what is reasonable therefore we cannot agree to what is reasonable. Typically gray areas of the law are done by court decision based on precedent of a previous case. If anyone has any legal precedent about this act, I would love to hear about it.
Moreover, your statement on (Section 59 or page 55 of the PDF)
“You also might want to read the law in, Alberta you are liable for an offence of $10,000, for every instance of requiring people to provide information you are not entitled to collect.”
If BBC does not breach this act for the reason I’ve mentioned in the above paragraph, then the fines should not apply.
Lastly, you do bring up a great point on point in your other post on the creation of a private registry that is a non government requirement. The government has historically used overarching means to obtain these registries. If BBC does delete this information, then this point is mute, whether you trust BBC doing that, that’s another debate.
In closing, as I am no lawyer (and you should not take my words for legal advice) BBC should consult their lawyer if they are worried about this. Without taking any sides, to me it seems that the law does allow the collection of this information as it needs to pass the reasonable test. Just like the “reasonably direct route” in our ATT’s, this will have to be a business decision.
If anyone has more (non-inflammatory, please) to add and better our community, I love to hear their thoughts and If I’ve written anything wrong please correct me.