Commissioner's message
Our mission over the past five years has been to help strengthen a foundation of public trust by enhancing Ontarians' confidence that their privacy and access rights will be respected.
As I reflect on my first term as Ontario's Information and Privacy Commissioner, I am reminded of the challenging start to my mandate. Five years ago, the world was in a highly precarious situation. We were just at the beginning of a global pandemic that brought with it unprecedented challenges. Ontarians turned to us for guidance on how to navigate the heightened privacy risks associated with the new virtual world they were thrust into from one day to the next. We saw increased citizen demand for access to trustworthy information they could rely on in an otherwise dizzying world of misinformation.
The pandemic also forced us, as an organization, to change how we think and work, as we adapted to a new social reality that was shifting beneath our feet. To help build resiliency through times of uncertainty, I set out a vision of a modern and effective regulator with real-world impact. Since then, our work has focused on achieving positive outcomes from the perspective of Ontarians to ensure that privacy protection and access to information are not abstract ideals, but tangible rights that strengthen the public’s trust in their institutions.
Building a foundation of trust
Our mission over the past five years has been to help strengthen a foundation of public trust by enhancing Ontarians’ confidence that their privacy and access rights will be respected. We achieve this through 1) proactive advocacy, by championing privacy and access rights in key strategic areas that affect Ontarians’ daily life; 2) responsiveness, by addressing complaints and appeals in a fair, timely, and meaningful way; and 3) accountability, by demonstrating the IPC’s commitment to organizational excellence and responsible stewardship of public resources.
This foundation of public trust has never been more important as our world faces yet another existential threat. With an economic war looming over us and our very sovereignty at stake, Ontario — and Canada — are bracing for strong crosswinds to come. There will be stresses on the integrity of our public institutions, and our democracy will be put to the test as never before. Ontarians will expect to be kept well informed by a government committed to upholding values of truth, access and transparency in a way that distinguishes us from others. Ontarians will also expect to have their privacy protected in the face of increased border surveillance and the growing influence of a big tech oligopoly beyond our borders whose commercial interests don’t always align with the public good.
Readying for the future
It is in times of crises like these that Ontarians turn to their governments for support and steady leadership. They expect to live in a healthy democracy where their rights and values will be respected, and where they can have confidence in the checks and balances that exist to uphold the integrity of their public institutions and the rule of law.
The IPC is a critical part of those checks and balances, and we are well prepared to embrace that responsibility. Our organization today is stronger and more resilient. The foundation we have built to help us navigate through the last crisis will help us weather the next one as well. We’ve strengthened the framework and reinforced the pillars that support public trust. Ontarians’ rights and values remain the blueprint that guides our work, and public trust is the cornerstone of everything we do.
Taking a collaborative approach
But to be sure, we are not alone on this journey. Throughout this report, we will focus on the impact we have had through our many collaborative relationships working with other regulators, consulting with regulated entities, and reaching out to Ontarians, including children and youth, First Nations groups, and marginalized communities.
Through our collaborative approach, we gain a better understanding of different realities and perspectives on the ground and use these to inform our work. It helps us better gauge risks and respond proportionately so we remain agile, relevant and effective as regulators in a fast-changing digital environment. Our collaborative approach also fosters a culture of compliance where institutions respect privacy and access rights not only because they must, but because they know it’s the right thing to do; they understand the "why" and feel supported in their efforts.
Strengthening relationships for a stronger Canada
A highlight of this year was the opportunity I had to chair the monthly meetings of Canada’s federal, provincial, and territorial (FPT) information and privacy commissioners and ombuds. These meetings culminated in the privilege of hosting the 2024 annual meeting in Toronto. I, along with my FPT counterparts, addressed critical privacy and access to information topics such as: the potential of artificial intelligence (AI) to enhance freedom of information processes; understanding Indigenous concepts of privacy and data sovereignty; and engaging with youth on unique privacy issues they face growing up in the digital age. We also explored emerging technologies, like neurotechnology, and discussed Canada’s evolving access and privacy regime.
Out of our discussions also came several important resolutions, including Identifying and mitigating harms from privacy-related deceptive design patterns, Responsible information-sharing in situations involving intimate partner violence, and Transparency by default – a new standard in government service. These resolutions represent a collective commitment by the FPT community to protect the privacy and access rights of all Canadians proving that, together, we are more effective and impactful than any one of us can possibly be alone.
Moving the needle on key strategic priorities in 2024
Our office’s work is guided by four strategic priorities: Privacy and Transparency in a Modern Government, Children and Youth in a Digital World, Trust in Digital Health, and Next-Generation Law Enforcement. Each priority was carefully selected at the beginning of my term in consultation with interested parties, institutions, and the public to ensure our efforts focus on areas of greatest concern to Ontarians and where we can have most positive impact.
Throughout the past five years, including 2024, we have used these strategic priorities as a way of guiding our proactive initiatives and allocating our resources where it counts the most. From our advocacy and advisory work to our public education and outreach efforts, we have remained laser-focused on these four strategic priorities. And we are seeing the results. As this annual report will show, our office has developed extensive knowledge and capacity in these areas and is increasingly regarded as a thought leader — locally, nationally, and even internationally — solicited for our views and having influence in these spaces. We have contributed extensively to policy development, helped shape best practices, and raised public awareness, particularly on key issues of artificial intelligence, children’s privacy, digital health, and police surveillance technologies.
Advocating for a modern privacy regime
One of the defining features of my term has been championing a modernized access and privacy regime to keep pace with rapid technological change across multiple sectors.
This past year saw the adoption of Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act. Schedule 1 created a new law, now in force, called the Enhancing Digital Security and Trust Act, 2024 (EDSTA), which gives the government broad discretion to create rules concerning cybersecurity, artificial intelligence (AI), and digital technologies affecting children and youth. While we fully agree with the need to legislate in these high-risk areas, we remain concerned with the lack of substantive rules in the statute itself. We have consistently recommended and called for a more principled approach, stronger transparency and accountability measures, and more effective and independent oversight.
For example, we recommended that the statute codify binding guardrails requiring AI systems to be safe and reliable, privacy protective, accountable, transparent, and human rights affirming. This is consistent with our joint statement with the Ontario Human Rights Commission and the ethical AI principles we developed with our FPT partners. We also emphasized the need to clearly delineate no-go zones in statute and provide for independent oversight over the use of AI by public institutions, rather than leave such societally important matters entirely for government to decide on its own and to oversee itself. While we were disappointed not to see our recommended principles codified in statute, we were pleased to see them at least partly taken up in Ontario’s Responsible Use of AI Directive.
On the issue of minors’ digital information, we recommended that Bill 194 deem children’s personal information as being sensitive to ensure it receives a higher level of protection. We also recommended that EDSTA explicitly recognize children’s rights to personal autonomy, dignity, and self-determination. We expressed serious concern with the minister’s new authority to introduce regulations governing the collection, use and disclosure of children’s digital information which overlaps squarely with my office’s similar jurisdiction over these same matters. The potential for duplication, or worse, divergence between the IPC and the ministry risks creating inconsistency and confusion among public institutions at a time when the rules for protecting children’s privacy should be certain, predictable and crystal clear.
Schedule 2 of Bill 194 amends the Freedom of Information and Protection of Privacy Act (FIPPA). It introduces new privacy obligations for provincial institutions, such as mandatory breach reporting and an express requirement to conduct privacy impact assessments (PIAs). It also expands the IPC’s oversight powers, including its authority to issue orders and share information with our federal, provincial, and territorial counterparts. We supported the bill’s overall objectives, although here too we identified important gaps and made several recommendations for improvement.
One significant recommendation we continue to advocate for strongly is the urgent need to bring equivalent amendments to the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA). For decades, FIPPA and MFIPPA have operated as twin statutes, with similar jurisprudence, interpretations and guidance. Amending one and not the other risks unravelling years of education and compliance efforts, resulting in confusion and lack of clarity among provincial and municipal institutions. Worse yet, this divergence risks frustrating Ontarians who have rightly come to expect a similar level of rights protection no matter which level of government they interact with.
Although the government did not adopt our recommendations, we see Bill 194 as the beginning — not the end — of a conversation about regulating cybersecurity, AI, children’s digital information, and privacy protections more broadly. My office will continue to engage constructively with government and other interested parties in shaping the regulations and guidance that will follow. We will continue advocating for a coherent regulatory framework, with robust protections and accountability measures, coupled with strong and independent oversight, to ensure that innovative technologies are used responsibly to serve the public interest without sacrificing Ontarians’ privacy.
Privacy protection and access to information are not abstract ideals, but tangible rights that strengthen the public's trust in their institutions.
Ensuring transparency in government decision-making: The Greenbelt
Access to government records is a fundamental pillar of a healthy democracy. Trustworthy and transparent information allows Ontarians to actively engage as citizens and hold governments to account for their decisions and actions. A prime example of this has been the significant public interest and scrutiny surrounding decisions about Ontario’s Greenbelt.
Over the past year, the IPC resolved several appeals of access to information requests for records relating to the government’s decisions about the removal of land from the Greenbelt. These appeals revealed several systemic themes, including the use of personal devices and email accounts for government business, the use of code words that have the effect of frustrating FOI searches, the lack of proper documentation of key government decisions, and poor retention practices. Such issues, if left unaddressed, risk undermining government accountability and eroding public trust. The IPC’s findings, lessons learned, and recommendations for upholding access to information rights in Ontario are detailed in an appendix to this annual report.
Enhancing service to Ontarians
Over the past five years, demand for the IPC’s services has grown to an all-time high, with nearly 1,000 more incoming files in 2024 compared to 2020, representing a 30 per cent increase in volumes. At the same time, we have successfully closed a record number of cases and reduced the average time to resolve cases overall, ensuring that Ontarians receive faster and more efficient services. We also managed to reduce our backlog of files by more than 17 per cent. We’ve been able to achieve these results by streamlining our tribunal operations and adopting more modern and flexible approaches to resolution.
For example, we recently launched an expedited process that fast-tracks straightforward access appeals and complaints, significantly reducing wait times for many Ontarians. In 2024, our expedited team successfully resolved nearly 15 per cent of all closed files in just its first nine months of operation. We also updated our Code of Procedure, practice directions, and policies to improve timeliness of the general appeals process and make most efficient use of public resources, while still providing fair and just consideration of appeals and being transparent about our procedures.
Together, we've built a solid foundation, and with the privilege of a renewed mandate, I look forward to continuing to build on this to shape a brighter, more transparent and privacy-protective future for all those who are proud and fortunate to call Ontario — and Canada — home.
Faster, smarter operations
As a modern and effective regulator, we’ve been working hard to enhance our own digital capabilities. By migrating our servers to the cloud and leveraging new digital collaboration tools, we’ve been able to adopt more modern ways of working and seamlessly connecting with others, while also enhancing the overall cyber security and resiliency of our network. Through better internal communications and knowledge management functions, we’ve been able to respond more efficiently to increasing demands for our services and provide more timely and accessible answers to public inquiries and requests for consultations.
Our new and improved website also provides features for improved accessibility and search functions, making it easier for the public to find the information they need quickly and for institutions to have direct access to up-to-date resources and guidance in real-time.
Acknowledging our people and our partners
As I look back on the past year, and indeed the past five years, I am proud of what we’ve been able to accomplish together. By together, I mean the many highly dedicated people who have contributed to supporting and advancing the IPC’s vision of becoming a modern and effective regulator with real-world impact.
I want to begin by thanking the members of the Legislative Assembly, and particularly, the members of the Board of Internal Economy, for the trust and confidence they have placed in me and my office throughout my first term. I would be remiss if I did not acknowledge their continuing support and how instrumental it has been in helping us fulfil our mandate with the resources and independence we need to be effective. I also want to thank my fellow Officers of the Legislative Assembly and my fellow federal, provincial, and territorial commissioners, both past and present, for their guidance, support and collegiality.
Thanks to the members of our Strategic Advisory Council who have given so generously of their time and collective wisdom to the IPC. Through their valuable input and guidance, we have gained a better understanding of the practical access and privacy issues that Ontario institutions face, and the multiple perspectives they bring to the table. SAC members have helped make us more strategic, effective, and impactful in advancing our strategic goals, and have supported us in building bridges and collaborations across various groups and communities of interest.
I am particularly grateful to our Youth Advisory Council, ten very bright, engaged and inspiring youth who genuinely care about the state of their digital future and constantly remind us that we should too. By providing us with their feedback, YAC members help make us more relevant and effective in our public education efforts aimed at reaching younger audiences. They help raise awareness about online privacy by serving as privacy leaders and ambassadors among their peers. I was especially proud of their presentation at this year’s FPT meeting, where they made an impassioned plea to all Canadian commissioners to remain strategically focused on protecting children’s privacy.
Last, but certainly not least, I want to thank the IPC team for the unwavering dedication and passion they bring to their work every day in the service of Ontarians. I am humbled by their hard work and commitment to excellence, their deep knowledge and expertise, and the impressive capacity they have shown for change and innovation. How fortunate I’ve been to work with such a collegial and professional team that has energized and inspired me every day throughout my term to continue striving for better.
Together, we’ve built a solid foundation, and with the privilege of a renewed mandate, I look forward to continuing to build on this to shape a brighter, more transparent and privacy-protective future for all those who are proud and fortunate to call Ontario — and Canada — home.
Patricia