Proposed Changes to Alberta Public-Sector Privacy and Access to Information Laws

November 14, 2024

Written By Stephen Burns, Sebastien Gittens, David Wainer and Jessica May

On November 6, 2024, the Alberta government introduced Bill C-33 and Bill C-34 which aim to replace the Freedom of Information and Protection of Privacy Act¹ with: (1) the Protection of Privacy Act;² and (2) the Access to Information Act.³ The government has put forward this proposed legislation as: (1) a response to the significant increase in the use of technology in modern society;⁴ and (2) a means to create the strongest privacy protections in Canada.

Key Changes under the Protection of Privacy Act

The following are some key changes that Bill C-33 proposes to enact with respect to current public-sector privacy legislation in Alberta:

• requiring privacy to be a key consideration in information management and program and services design (a "privacy by design" approach);⁵
• if a public body intends to use personal information in an automated system in order to "generate content or make decisions, recommendations or predictions," that intention must be disclosed;⁶
• outlining circumstances in which a public body may link information between two or more sets of data ("data matching") and rules surrounding same;⁷
• allowing public bodies to create and use non-personal data for certain purposes, including research and analysis or planning, administering, delivering, managing, monitoring, or evaluating a program or service;⁸
• requiring all public bodies to adopt a privacy management program that must be made available to the any person upon request;⁹
• explicitly prohibiting public bodies from selling personal information;¹⁰ and
• creating a new privacy impact assessment regime.¹¹

In addition, the Protection of Privacy Act also increases the fees and penalties which may be imposed upon those who breach the Act. Some exemptions apply to records held by the courts, as well as a select group of other types of records held by public bodies.¹²

Key Changes under the Access to Information Act

The Access to Information Act will change how individuals may access records and information held by public bodies. Some of these key changes include:

• allowing a public body to disregard a request for information if the request: (1) would unreasonably interfere with the operations of the public body; (2) is abusive, threatening, frivolous, or vexatious; (3) the information the request relates to has already been disclosed to the applicant or made publicly available; or (4) is overly broad or incomprehensible;¹³
• changing the time limit for responding from 30 days after receiving the request to 30 business days,¹⁴ and in some circumstances, permitting the public body to extend the time to respond to a request for "additional reasonable periods";¹⁵
• expanding the scope of the “cabinet and treasury board confidences” exemption;¹⁶ and
• preventing a public body from making a request to access a record in the custody or control of another public body.¹⁷

As with the Protection of Privacy Act, the Access to Information Act aims to increase the fees and penalties that may be imposed upon those who breach the Act.

In addition to the foregoing changes, Alberta's Minister of Technology and Innovation has indicated that the Government of Alberta plans to launch an online privacy portal as part of modernizing privacy protections. The portal will enable Albertans to see how their information has been accessed and allow them to lodge privacy complaints online.

Takeaways

We expect that the Access to Information Act, should it come into force, will have a significant impact with respect to how public bodies may: (1) respond to access requests, including requiring a greater level of detail from applicants; (2) take a longer time to respond to access requests; and (3) use discretionary exemptions to withhold more information and/or records in their response to access requests. Further, we expect that the Protection of Privacy Act will impose stricter requirements as to how public bodies must protect the personal information in their custody or control and how they may use the same. These changes apply to the public sector in Alberta, but may foreshadow changes to come in the private-sector privacy laws, including Alberta’s Personal Information Protection Act.¹⁸

If you would like to discuss how the Protection of Privacy Act and the Access to Information Act may affect your organization, we invite you to contact the members of the Bennett Jones Privacy and Data Protection group.

Authors