Canadian Data Privacy Law Part 2: The Public Sector

If you’re part of a government department or agency, the way you handle information that you collect from citizens and foreigners is largely determined by the the Privacy Act. However, every province and territory also has its own public-sector legislation that applies to its own government institutions. The protections they offer are broadly similar to those of the Privacy Act, but the regional legislation defines a commissioner or ombudsman responsible for overseeing privacy legislation only in that province.

Regardless of their names, all of these provincial acts are generally designed to grant the public:

• access to records in the custody and control of provincial government departments and designated public bodies with certain exceptions
• access to individuals’ own personal information and the right to request correction of any errors
• privacy of personal information in the custody or under the control of public bodies
• protection against unauthorized collection, use, disclosure, or disposition of personal information
• independent review of decisions made by public bodies about access and privacy

Freedom of Information and Protection of Privacy Act (FOIPPA)

What it is: FOIPPA sets basic objectives to ensure that public bodies are open and accountable to the public by providing a right of access to records, and to protect the privacy of individuals by controlling the manner in which public bodies collect, use and disclose personal information. In British Columbia, it also requires that a public-sector organization ensures that personal information in its custody or control is stored and accessed only in Canada. Additionally, if there is a demand for personal information that originates from a foreign country, that demand must be reported to the government.

Who it’s for: Public-sector bodies in Alberta and British Columbia. In Alberta, it applies to all provincial government departments, agencies, boards and commissions. It also applies to local municipalities, universities, and school boards. In British Columbia, it also covers commissions and Crown corporations, hospitals and health boards as well as designated self-governing bodies of professional organizations such as the College of Physicians and Surgeons, and the Law Society of British Columbia.

Freedom of Information and Protection of Privacy Act (FIPPA)

What it is: Manitoba’s Freedom of Information and Protection of Privacy Act (FIPPA) provides a right of access to information in records held by public bodies in Manitoba. FIPPA also protects your personal information. It establishes rules for the collection, use and disclosure of personal information by public bodies. It gives you the right to access your own personal information and to correct any information that public bodies hold about you.

Who it’s for: FIPPA provides a right of access to records held by public bodies and regulates how public bodies manage personal information. With certain exceptions, you may see and obtain copies of records from Manitoba government departments, government agencies, local governments, school divisions, universities and colleges, regional health authorities, and other local public bodies. FIPPA also provides an independent review process for people who disagree with access and privacy decisions made by public bodies under the Act.

Personal Health Information Privacy and Access Act (PHIPAA)

What is is: In New Brunswick, provincial privacy legislation exists in the context of health and medical information, but applies equally to non-health-related personal information (like an address or date of birth). The Personal Health Information Privacy and Access Act (PHIPAA) provides a set of rules that protects the right to privacy and the confidentiality of personal health information. At the same time, the Act ensures that information is available, as needed, to provide health services to those in need and to monitor, evaluate and improve the health system in New Brunswick.

Who it’s for: The act applies to “custodians” of personal information. The act defines a custodian as an individual or organization that collects, maintains or uses personal health information for providing or assisting in the provision of health care or treatment or the planning and management of the health-care system or delivering a government program or service. Examples include the Department of Health; regional health authorities; hospitals; health-care providers (for example, physicians, dentists, nurses, pharmacists); public bodies (including but not limited to government departments and Crown corporations); ambulance operators; and individuals or organizations known as information managers that manage personal health information on behalf of another custodian.

Access to Information and Protection of Privacy Act (ATIPPA)

What it is: Like New Brunswick, Newfoundland has also enacted privacy legislation in the context of health records. However, Yukon’s version, though it shares the same name, isn’t specifically designed with health information in mind, but can apply broadly to any personal information held by the Yukon provincial government. The purpose of ATIPPA is twofold; it promotes accountability and transparency in the public sector by allowing individuals access to records and information maintained or controlled by a public body, and it prevents the unauthorized collection, use or disclosure of personal information by public bodies.

Who it’s for: The Newfoundland and Labrador Department of Health and Community Services is defined as a public body under its version of ATIPPA, and is therefore subject to the Act and its regulations. There, ATIPPA applies to provincial public sector organizations such as government departments, agencies, boards, commissions, municipalities, schools and school boards, and public post-secondary institutions. The Yukon version applies to all records held by Yukon government departments, secretariats and other similar executive agencies of the Yukon government, and additional public bodies explicitly designated in the Designation of Public Bodies Regulation pursuant to its act.

Freedom of Information and Protection of Privacy Act (FOIPOP)

What it is: The purpose of the Freedom of Information and Protection of Privacy (FOIPOP) Act is to provide the general public with access to records in the custody or control of government institutions, subject to certain specific exemptions, and provide for an independent review by the Information and Privacy Commissioner of decisions made by governmental institutions respecting access to records and privacy issues. The Information and Privacy Commissioner has the power to order the release of records.

Who it’s for: FOIPOP applies to provincial public bodies and local public bodies, including departments of the provincial government in Saskatchewan, Ontario and Nova Scotia. In Saskatchewan, it also covers boards, commissions, and Crown corporations.

An Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information (Access Act)

What it is: Enacted by the National Assembly on June 22, 1982, and amended by Bill 86 on June 14, 2006, the Act Respecting Access to Documents Held by Public Bodies and the Protection of Personal Information, commonly called the Access Act, enshrines two fundamental rights set out in the Québec Charter of Human Rights and Freedoms: the right to information, and the right to privacy.

Who it’s for: The Access Act governs nearly 2,600 public-sector organizations such as provincial and municipal government bodies, utilities, educational institutions, and healthcare and social services establishments.

Working with Sync makes it easy to comply with this overlapping legislation, because our datacenter is here in Canada, subject to Canadian law.