If personal data is required by federal law, the institute has no discretion – it must share. Note: Keep in mind, however, that the collection of this type of information by public institutions subject to the law must always meet the requirements of Section 4 of the Data Protection Act with regard to collection. In the absence of the registration of the disclosed personal data, the parties to the agreement cannot notify third parties to whom the information has been disclosed that the information has been corrected or that the person to whom the information relates has submitted a request for correction. Paragraph 8, paragraph 2, point (f) – Provinces, foreign states and international bodies: this paragraph authorizes the exchange of personal data with provincial and foreign governments and international bodies for the management or enforcement of legislation or for the conduct of legal investigations, where the transfer is made as part of an agreement or agreement. An ISA may be a formal written agreement, protocol, protocol or memorandum of understanding, an exchange of letters or an international treaty ratified by Canada, or a convention ratified by Canada. From a legal point of view, an ISA can be legally binding under international law (perhaps called a treaty or agreement) or be a non-binding instrument under international law (perhaps called an agreement or declaration of intent). Since the title of the instrument does not determine whether it is legally binding or not, early and ongoing consultation with legal experts at the Ministry of Foreign Affairs is important. By consulting with internal legal advisors and legal experts within the Ministry of Foreign Affairs and International Trade, institutions should be able to determine what type of ISA should be prepared in a given situation and whether the ISA should be a legally binding agreement. Institutions should only consider discretionary disclosures when they are authorized by federal law and have a clear and justified purpose. The need for the recipient to obtain the information should not be confused with administrative comfort; It should be clear that personal data is directly related to a program or activity that the recipient is responsible for managing. The underlying principle is that personal information should not be disclosed solely because it would be useful or “nice to know”. When institutes first consider a data-sharing initiative, they should ensure that it is legal.