On November 6th, 2024, Bills 33 (Protection of Privacy Act[1]) and 34 (Access to Information Act[2]) received a first reading in the Alberta Legislature. These Bills, if enacted, would split Alberta’s existing Freedom of Information and Protection of Privacy Act (the “FOIPP Act”) into two separate Acts.[3] The Bills were introduced, in part, due to a joint resolution by Canada’s Information and Privacy Ombudspersons and Commissioners in 2019, which called for the modernization of privacy and access laws throughout Canada.[4]  

As detailed below, Bills 33 and 34 propose significant changes to the personal information protection obligations of Alberta’s public bodies, as well as the access to information rights of Albertans.  

Bill 33: Protection of Privacy Act

Nate Glubish, Alberta’s Minister of Technology and Innovation, introduced the Protection of Privacy Act (the “PPA”) as part of his intention to “deliver for Albertans the strongest privacy protections in the country and the strictest penalties for privacy violations in the country.”[5]

As with the FOIPP Act, the PPA would only apply to public bodies, such as departments of the Government of Alberta, local government bodies (e.g. municipalities, libraries and police services), education bodies, and health care bodies.[6]  It would not apply to private organizations, any of Alberta’s Courts, or the offices of a Member or the Speaker of the Legislative Assembly.[7]

Some of the most significant proposed legislative changes within the PPA include:

  • A public body would be prohibited from selling personal information in any circumstance and for any purpose, including marketing or advertising purposes.[8]
  • If a privacy breach (i.e., the loss of, unauthorized access to, or unauthorized disclosure of personal information in the custody or control of the public body) occurred, such that there was a real risk of significant harm to an individual, the public body would have to give notice to the individual, the Commissioner, and the Minister.[9]
  • A public body would have to give notice to an individual, at the time of collecting information, if they had any intention of inputting the information into an automated system to generate content or make decisions, recommendations, or predictions.[10]

Additionally, fines for violations of the PPA would increase drastically, as compared to the current FOIPP Act penalties. Under the FOIPP Act, the maximum penalty for contravention of the rules regarding personal information is generally $10,000, with the exception of disclosing personal information pursuant to a warrant, subpoena or court order without jurisdiction in Alberta, for which the fine is up to $10,000 for an individual and up to $500,000 for an organization (which remains the same under the PPA).[11] Under the PPA, contravention of the rules related to collecting, using or disclosing personal information or obstructing or failing to comply with orders from the Privacy Commissioner could lead to a fine of up to $125,000 for an individual, and up to $750,000 for an organization[12] and contravention of the rules relating to data matching and re-identifying non-personal data could lead to a fine of up to $200,000 for an individual, and up to $1,000,000 for an organization.[13] These maximum fines, if enacted, would be the highest within Canada among analogous provincial legislation.

Bill 34: Access to Information Act

The Access to Information Act (the “AIA”) was introduced by Dale Nally, Alberta’s Minister of Service Alberta and Red Tape Reduction, as part of the modernization of the FOIPP Act. The Minister stated that the overhaul of the FOIPP Act “will allow Alberta to fall in line with policy from every other province in the country as well as the federal government.”[14]

The AIA proposes to:

  • Extend the deadline for a public body to respond to an access to information request, from 30 calendar days under the FOIPP Act to 30 business days under the AIA.[15]
  • Provide longer, but finite, time limits for the Commissioner to complete a review of an access to information request:
    • The FOIPP Act currently mandates completion of an inquiry by the Commissioner within 90 days; however, this time can be extended indefinitely.[16]
    • The AIA proposes a 180-day time limit, with the possibility of a 180-day extension, after which the inquiry must be completed (barring an emergency, disaster, or other unforeseen event that necessitates a further extension).[17]
  • Empower public bodies to proactively disclose information outside of the access to information process.[18] However, at this time, it is unclear what kind of information could, or would, be proactively disclosed.

The AIA would also expand the protections afforded to the internal communications of politicians and their staff, by modifying the disclosure obligations regarding “Cabinet confidences.”[19] This could significantly affect the ability of Albertans to access information relating to the communications among Members of the Legislative Assembly and/or their staff.

Under both the PPA and AIA, a special committee of the Legislative Assembly would be required to review the legislation every 6 years, to ensure that they remain current.[20]

Takeaways

Bills 33 and 34 aim to modernize Alberta’s existing FOIPP Act, which has not received a major update in over two decades. The proposed changes could provide Albertans with greater protections and transparency regarding the personal information held by public bodies, impose harsher penalties for the improper use and disclosure of personal information, and better align Alberta’s legislation with that of the federal government and other provinces. However, some changes contained within the AIA have, and will likely continue to, draw strong criticism, given the potential impacts on political transparency.

It remains to be seen whether the PPA and the AIA will undergo any significant changes following additional readings in the Legislature, or if the Bills will be passed at all. We will continue to monitor their progress and will keep you up-to-date as developments occur.

If you have any questions about privacy protection or access to information laws, and how you or your organization may be impacted by these legislative changes, please contact our Privacy, Data Governance and Cybersecurity team.

[1] “Bill 33, Protection of Privacy Act,” 1st reading, Alberta Hansard, 31-1, Day 66 (6 November 2024) at 1931 (Hon Nate Glubish).

[2] “Bill 34, Access to Information Act,” 1st reading, Alberta Hansard, 31-1, Day 66 (6 November 2024) at 1931 (Hon Dale Nally).

[3] Freedom of Information and Protection of Privacy Act, RSA 2000, c F-25 [“FOIPP Act”].

[4] See Office of the Information and Privacy Commissioner of Alberta, “Canada’s Access to Information and Privacy Guardians Urge Governments to Modernize Legislation to Better Protect Canadians” (6 November 2019), online: OIPC <oipc.ab.ca/joint-resolution-2019>.

[5] Hon Nate Glubish, supra note 1.

[6] Bill 33, Protection of Privacy Act, 1st Sess, 31st Leg, Alberta, 2024, s 1 (first reading 6 November 2024) [“PPA”].

[7] Ibid.

[8] Ibid, s 11.

[9] Ibid, s 10(2).

[10] Ibid, s 5(2)(d).

[11] FOIPP Act, supra note 3, s 92(4); PPA, ibid, s 60(4).

[12] PPA, supra note 6, s 60(2).

[13] Ibid, s 60(3).

[14] Hon Dale Nally, supra note 2.

[15] Bill 34, Access to Information Act, 1st Sess, 31st Leg, Alberta, 2024, s 13 (first reading 6 November 2024) [“AIA”]. See also FOIPP Act, supra note 3, s 11.

[16] FOIPP Act, supra note 3, s 69(6).

[17] AIA, supra note 15, s 62(9)-(10).

[18] Government of Alberta, “Modernizing access to information in the digital age” (6 November 2024), online: Alberta <www.alberta.ca/release.cfm?xID=9130821731087-F9EE-AB22-51665D0B911B23DC>.

[19] AIA, supra note 15, s 27. See also FOIPP Act, supra note 3, s 22.

[20] PPA, supra note 6, s 63; AIA, supra note 15, s 100.