Changes to Ontario public sector privacy protection

To increase cyber security and public sector privacy protection in Ontario, Bill 194 that we wrote about last June is now (for the most part) in force. It created a new statute called the Enhancing Digital Security and Trust Act, 2024, and amended FIPPA (Freedom of Information and Protection of Privacy Act).

FIPPA applies to the provincial government and provincial government agencies. It is noteworthy that similar amendments were not made to MFIPPA, which is similar to FIPPA but applies to municipalities and quasi-municipal agencies.

Public sector cyber security

The Enhancing Digital Security and Trust Act, 2024 applies to Ontario public sector entities that are governed by FIPPA and MFIPPA.

It sets out how those institutions must deal with cyber security requirements, use of AI, and use of information relating to people under 18.

While the act is in force, it is a shell with virtually all the requirements to be set out in yet-to-be created regulations. So for now institutions can only get an idea of where this is headed and what they will have to do at a high level.

FIPPA changes 2025

Some FIPPA changes took effect on January 29, 2025, others will not be in effect until July 1, 2025.

Entities subject to FIPPA will have to:

• Keep records of and provide the Privacy Commissioner with an annual report of privacy breaches.
• Do privacy impact assessments (PIAs) for any personal info they collect.
• Report privacy breaches to the Privacy Commissioner and affected individuals if there is a real risk of significant harm.

Public sector privacy protection in Ontario introduces a whistleblowing section saying that if anyone complains to the Commissioner that an institution has or is about to contravene FIPPA, they can request that their identity be kept confidential.

It also grants the Commissioner more investigative and order-making powers.

FIPPA and MFIPPA date back to 1988. These changes are somewhat similar to provisions in the federal Personal Information Protection and Electronic Documents Act (PIPEDA) private sector privacy law, and the Consumer Privacy Protection Act (CPPA) that died when Parliament was prorogued that was supposed to replace PIPEDA.

David Canton is a business lawyer and trademark agent at Harrison Pensa with a practice focusing on technology, privacy law, technology companies and intellectual property. Connect with David on LinkedIn, Bluesky, and Twitter.

Image credit: ©AI_images – stock.adobe.com