(1) In this section:
"law enforcement" has the same meaning as in the Freedom of Information and Protection of Privacy Act;
"personal information" has the same meaning as in the Freedom of Information and Protection of Privacy Act.
(2) A concessionaire or the billing organization must not, through the exercise of any rights or powers provided to the concessionaire or billing organization under this Act, the concession agreement or any agreement between the concessionaire and the billing organization respecting the concession highway or through any activity conducted, or any device used, in conjunction with the operation of the concession highway or the assessment or collection of tolls, collect personal information in relation to individuals who are or are to be users of the concession highway unless the personal information
(a) subject to subsection (2.1), is collected directly from, and with the express consent of, the individuals to whom the information relates,
(b) is collected for the purpose of ensuring safety in relation to the operation of the concession highway,
(c) is collected for the purpose of assessing or collecting tolls relating to the concession highway or any related interest or charges, or
(d) is provided under subsection (4) or (5).
(2.1) The requirement for express consent under subsection (2) (a) applies only with respect to individuals who have an account or other payment mechanism established with a concessionaire or the billing organization that is in good standing.
(2.2) The requirements of section 27 (2) of the Freedom of Information and Protection of Privacy Act are conclusively deemed to be satisfied by publication by the concessionaire on its website referred to in section 25.1 of the information required under that section.
(3) A concessionaire or the billing organization must not use or disclose personal information unless,
(a) in the case of personal information collected under subsection (2) (a), the use or disclosure is that for which the consent was given, or
(b) in the case of personal information collected under subsection (2) (a), (b), (c) or (d), the use or disclosure is
(i) for the purpose of ensuring safety in relation to the operation of the concession highway,
(ii) for the purpose of assessing, charging or collecting tolls relating to the concession highway or any related interest or charges, or assessing or collecting toll debts,
(iii) for the purpose of court proceedings relating to this Act,
(iv) for the purpose of assisting a public body or a law enforcement agency in Canada in an investigation
(A) undertaken with a view to a law enforcement proceeding, or
(B) from which a law enforcement proceeding is likely to result,
(v) related to the operation of a concession highway and authorized by the applicable concession agreement, or
(vi) in accordance with an enactment of British Columbia or Canada that authorizes or requires its disclosure.
(4) Without limiting any other power the Insurance Corporation of British Columbia may have to collect, use or disclose personal information, the Insurance Corporation of British Columbia may enter into information-sharing agreements with any or all of the minister, the corporation, concessionaires, the South Coast British Columbia Transportation Authority and the billing organization, and persons engaged by the minister, the corporation, concessionaires, the South Coast British Columbia Transportation Authority and the billing organization, for the purposes set out in subsection (4.1).
(4.1) An information-sharing agreement under subsection (4) may be entered into for the purpose of
(a) ensuring safety in relation to the operation of the concession highway,
(b) the assessment, charging or collection of tolls or related fees, interest or other charges or the assessment or collection of toll debts, or
(c) the charging or collection of fares, fees or other charges on a tolled highway in the Province or in another jurisdiction.
(5) Without limiting any other power the government or the corporation may have to collect, use or disclose personal information, the government or the corporation may enter into an information-sharing agreement with
(a) the government of Canada or an agency of that government,
(b) the government of a province or other jurisdiction in Canada or an agency of that government,
(c) the government of a state of the United States or an agency of that government,
(d) the Insurance Corporation of British Columbia,
(e) a concessionaire or the billing organization,
(f) the corporation,
(g) the South Coast British Columbia Transportation Authority, or
(h) any other person prescribed by regulation,
for any one or more of the following purposes:
(i) the operation of a concession highway or the operation of a tolled highway in the Province or in another jurisdiction;
(j) assisting a public body or a law enforcement agency in Canada in an investigation
(i) undertaken with a view to a law enforcement proceeding, or
(ii) from which a law enforcement proceeding is likely to result;
(k) ensuring safety in relation to the operation of a concession highway or the operation of a tolled highway in the Province or in another jurisdiction;
(l) the assessing, charging or collection of tolls or toll debts on a concession highway;
(m) the charging or collection of fares, fees or other charges on a tolled highway in the Province or in another jurisdiction.
(6) Without limiting any other power the government or the corporation may have to collect, use or disclose personal information, the government or the corporation may obtain, collect, use and disclose personal information for the purposes set out in subsection (5) (i) to (m).
(7) If a concessionaire or the billing organization has obtained personal information about an individual,
(a) the concessionaire or billing organization must, promptly after receiving a request from that individual and without charge, provide that individual with access to that personal information, and
(b) section 29 of the Freedom of Information and Protection of Privacy Act applies and, for that purpose, a reference in that section to the head of the public body is deemed to be a reference to the concessionaire or billing organization, as the case may be.
(8) Without limiting any other provision of this section, a concessionaire or the billing organization must protect personal information by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure or disposal.