The Office of the Information and Privacy Commissioner (OIPC) of Alberta has published comments and a call for changes to two new access to information and privacy bills tabled in the legislative assembly earlier this month by the Alberta government. The bills are designed to create two new pieces of legislation to replace the existing public sector access and privacy law, the Freedom of Information and Protection of Privacy Act (FOIP Act).
Information and Privacy Commissioner Diane McLeod is strongly recommending improvements to both bills before they are passed.
“The modernization of the FOIP Act is crucial, as it has not been amended in any substantial way since its proclamation in 1995, despite rapidly-evolving technology and extensive changes to the access and privacy landscape,” said McLeod. “However, after a careful review since their tabling, we have identified a number of concerns with the bills as they are currently drafted. Bill 33, the Protection of Privacy Act, could be strengthened in several key ways in order to better protect the privacy rights of Albertans. Bill 34, the Access to Information Act, should be re-considered and amended in order to ensure a well-functioning access to information system continues to operate in the province.”
The OIPC was consulted by the Government of Alberta Department of Technology and Innovation on two separate occasions earlier this year on the changes being considered for legislation to replace the FOIP Act. The OIPC was provided with policy documents and attended meetings, and then compiled two separate documents containing potential amendments to the FOIP Act that were submitted to the department. However, the OIPC did not see the bills themselves until they were tabled in the legislature on November 6th.
The Commissioner’s response to the bills was provided to the government on November 20, 2024 in the form of letters and comments to the Minister of Technology and Innovation, Nate Glubish, and the Minister of Service Alberta and Red Tape Reduction, Dale Nally.
In regard to the Protection of Privacy Act (PPA), the OIPC has noted several positive aspects, including the requirement for public bodies to implement privacy management programs, conduct privacy impact assessments and report breaches; a prohibition on the sale of personal information; and substantial fines for offences under PPA.
However, the OIPC has also noted a number of significant concerns with the proposed law, which may negatively impact the privacy of Albertans and which include, amongst others:
- the lack of a paramountcy provision;
- the lack of guardrails regarding the authority of public bodies to collect, use and disclose personal information for a common or integrated program or service;
- the lack of transparency for data matching, which is the creation of new data from the combining of personal information in two or more databases or information systems;
- carve-outs which exempt communications between political staff and ministers from PPA;
- a lack of sufficient security provisions; and
- new authority to disclose personal information of a minor without consent, when in the minor’s “best interests”.
In regard to Bill 34, the Access to Information Act (AIA), the Commissioner has noted that amendments should be made to ensure that the access rights of Albertans are at the least maintained under the new law and, ideally, improved. The concerns of the OIPC regarding AIA include, amongst others:
- expanded exceptions and carve-outs to the right of access, including for Cabinet and Treasury Board confidences, advice from officials, court and prosecution records, and workplace investigations;
- new definitions that may negatively affect access rights;
- new authority for public body heads to disregard access requests;
- new authority for public bodies to extend timelines to respond to access requests; and
- erosion of certain powers of the Commissioner.
The OIPC has outlined these concerns in detail and has made a number of recommendations for changes to Bills 33 and 34 before they are passed, which are included in letters submitted earlier today to the two ministers.
Read the full text of the letters to the ministers and the OIPC comments here.
Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in the Personal Information Protection Act, the Health Information Act and the Freedom of Information and Protection of Privacy Act. The Commissioner operates independently of government.
Source: Office of the Information and Privacy Commissioner of Alberta