Commissioner’s Recommendations
Modernize Ontario’s access and privacy laws
Modernization of the province’s access and privacy laws is long overdue. Ontario’s Freedom of Information and Protection of Privacy Act and its municipal counterpart were enacted three decades ago and have not kept pace with the current societal and technological reality.
Today people have very different expectations for how public institutions will use, share, and protect their personal information than they did 30 years ago. The digital technology available for use by institutions and individuals is also dramatically different. The recent focus on smart city projects has further emphasized just how ill-equipped the province’s current regulatory framework is to tackle issues of data governance and the protection of privacy rights.
Our province has fallen behind other Canadian jurisdictions in taking action on this issue and we need to catch up. Ontario needs to strengthen its access and privacy laws to meet the demands of modern society and ensure the access and privacy rights of Ontarians align with other provinces.
As part of this work, I urge the government to develop made-in-Ontario private sector privacy legislation. A private sector privacy law tailored to our regulatory environment would help to ensure consistency between public and private sector laws. In addition to reducing regulatory uncertainty, a simplified oversight regime has the potential to support increased efficiency, particularly in the context of smart city projects or other public-private sector partnerships.
Expand open government
Throughout my time as commissioner, the IPC has made it a priority to support open government initiatives, encouraging all levels of government to disclose information in their control. We see freedom of information as part of a much larger push for transparency and accountability for government activities.
While the provincial government and many municipalities currently have open data programs in place, the time has come to push the boundaries on what is currently available to the public. We support open data and efforts to release facts and statistics to the public free of charge. This raw data is invaluable for providing an overview of various activities, but provides little, if any, context around decision-making processes.
We need to move beyond the data to the proactive release of more complete information about government programs, services and operations. This is the level of detail found in memos, policy papers, and other planning documents. Sharing these will require that organizations review their current policy and legal requirements for proactive disclosure and support the release of certain broad classes of information on a routine basis.
Government organizations can also take steps to proactively disclose records released through access requests or general records that do not include personal information. There is no reason why these records should not be available to all Ontarians. By publishing summaries of completed requests or copies of redacted decision letters, public organizations can reduce the time, cost, and effort associated with access requests for both themselves and requesters.
A similar approach can be applied to government procurement records. Rather than waiting for requests to come in, institutions can proactively make these records publicly available. In some cases, there may be legitimate reasons not to publish some information contained in these records. This should not put the brakes on pursuing a more open procurement process. With proper planning, these obstacles can be overcome in ways that do not come at the cost of transparency.
Report OPP statistics
The need for separate statistical reporting for the Ontario Provincial Police came to our attention following a request by Amnesty International to investigate the response of the Ministry of the Solicitor General (formerly the Ministry of Community Safety and Correctional Services) to a series of access requests and appeals.
Amnesty’s focus was specifically on compliance rates for access requests related to OPP records. These numbers were included as part of the compliance statistics for the entire ministry, making them difficult to track.
Following our investigation of Amnesty’s concerns, we came to a similar conclusion. Every year, police services from across the province report their compliance statistics to the IPC. By publishing these in our annual report, the public can gauge the responsiveness of different police services to requests for information under Ontario’s access laws. These statistics are also a useful way to observe trends from year to year.
The absence of distinct compliance statistics related specifically to requests for OPP records creates a significant gap in the public’s understanding of how well police respond to requests for information. To remedy this situation, OPP statistics should be reported separately from the rest of the ministry.
Enact privacy rules for political parties
Once again, I am calling on the government to amend Ontario’s privacy laws to include oversight of political parties. I am not alone in my concerns and I’ve joined with my fellow commissioners to sound the alarm on this issue at the national level.
The safety of sensitive personal information held by political parties is a very real threat to individual privacy rights. As recent history has taught us, political parties are able to collect, share, and analyze voter data like never before, without us even knowing it.
The current lack of oversight means that voters in Ontario do not have the legal right to know if their information has been collected or who it has been shared with. Aside from the obvious ethical problems, there are other dangers as well. This unchecked pool of personal information is ripe for the picking by hackers and cyberattackers, with few options for anyone whose sensitive personal information is exposed in a privacy breach.
The privacy, ethical, and security risks associated with how political parties collect and use personal information are too great. They can’t continue to operate outside the law. Political parties must be held accountable for how they collect, use, and disclose our personal information. It’s time for the government to stand up for privacy rights and amend Ontario’s access and privacy laws.
This post is also available in: French
