Province plans to update FOIP

By Al Beeber - Lethbridge Herald on November 7, 2024.

LETHBRIDGE HERALDabeeber@lethbridgeherald.com

With proposed new legislation, the Alberta government is moving along the digital highway.

The government is introducing legislation that will divide the Freedom of Information and Privacy Act into two acts, one which is focused on information and the other on privacy.

The government says its new Access to Information Act would bring Alberta more into line with other jurisdictions across Canada which have updated their own legislation.

“Changes to access to information laws would modernize the language used to refer to access to information and streamline processes to provide Albertans with faster, concrete response times for access to information requests,” says the province.

FOIP hasn’t been updated since it was first enacted in Alberta 20 years ago and while the world has evolved, provincial legislation hasn’t, according to Minister of Service Alberta and Red Tape Reduction Dale McNally.

According to the government, the new legislation would “allow public bodies to proactively disclose information, making it easier for Albertans to receive more information from government and other public bodies. It would also better define Cabinet confidentiality, in the same way other Canadian jurisdictions have, and streamline processes in a way that allows government officials to focus on good governance.”

A joint resolution in 2019 from information and privacy commissions in Canada urged all provinces and the territories to update privacy and access legislation. The approved legislation would be the first major update to the provincial privacy and access laws since the early 2000s.

Among the key changes if the legislation is approved are:

• Prohibiting the sale of personal information.

• Requirements for privacy management programs, privacy impact assessments, and privacy breach notifications.

• Updated collection notices and requirement to notify if information is used in an automated system.

• Ability to create and use non-personal data.

• Increased fines and fines for data misuse.

• Updated Information and Privacy Commissioner powers.

• Establish clear rules for when and how public bodies share information.

• Regular reviews of the Act.

Public bodies will be required to implement privacy management programs which will be scaled to reflect the volume and sensitivity of personal information in their custody or control. Anybody would be allowed to request a copy of a public body’s privacy management overview.

Public bodies will be required to notify people of any breach of their personal information where there could be a real risk of significant harm.

The legislation also:

• Allows public bodies to provide alternate methods of contact if an individual has questions on the collection of personal information (e.g., email).

• Requires Albertans to be notified when collecting information if it will be processed through an automated system.

• Allows public bodies to carry out data matching to create data derived from personal information only for specific purposes, as outlined in the Act.

• Sets specific authorities and limits on when public bodies can use personal information to create non-personal data.

• Requires the head of a public body to protect all personal information, data derived from personal information, or non- personal information by making reasonable security arrangements.

If legislation is passed, people will be able to be prosecuted if they knowingly contravene the act and new penalties will be implemented for the misuse of personal information such as unauthorized use or disclosure for data matching purposes, creating non-personal data without authority, attempting or getting access to data in contravention of the Act or re-identifying or attempting to re-identify non-personal data.

Increased fines could include up to $200,000 for an individual or $1 million for an organization.