IPC 2024 Annual Report: Commissioner urges government to close regulatory gaps and secure public trust

TORONTO, ON (June 12, 2025) — Ontario’s Information and Privacy Commissioner, Patricia Kosseim, is urging the provincial government to address regulatory gaps to better protect Ontarians’ personal information from cybersecurity attacks, commercialization of children’s data, and the use of AI technologies without clear rules or oversight. The call to action is outlined in the 2024 annual report of the Office of the Information and Privacy Commissioner of Ontario (IPC), From Vision to Impact: Five Years of Privacy and Transparency in a Digital Ontario, released today. The report also includes an appendix containing the IPC’s findings and recommendations emerging from a series of access-to-information appeals involving the Greenbelt land removals.

“In a world where trust is increasingly hard to come by, Ontarians deserve clear rules, strong safeguards, and full transparency from their institutions,” said Commissioner Kosseim. “Whether it’s how decisions are made, how personal data is used, or how emerging technologies are governed, our office will continue pushing for real accountability, because public trust is the foundation of a healthy democracy.”

Make AI and privacy laws work for Ontarians

The IPC is urging the government to develop meaningful, enforceable regulations to address key legislative gaps left behind by Bill 194 that enacted the Enhancing Digital Security and Trust Act (EDSTA) and amended the Freedom of Information and Protection of Privacy Act (FIPPA). Specifically, the IPC is calling for:

• binding guardrails and independent oversight for public sector use of AI
• robust cybersecurity measures that protect Ontarians' sensitive information
• stronger and clearer protections for children’s digital information
• amendments to the Municipal Freedom of Information and Protection of Privacy Act to match FIPPA changes. Failing to align the two laws risks creating confusion for institutions and frustration for Ontarians, who expect consistent privacy rights across all of Ontario's public sector

Protect patient rights in a digital health system

Ensure that stronger accountability measures are embedded in the Personal Health Information Protection Act and that any future accompanying regulations strengthen meaningful access and protections for individuals' health information, rather than undermine them. Enabling greater access to the electronic health record system through digital health IDs may be a good thing, but not if the system lacks the necessary safeguards, clarity, and transparency. The IPC is calling on the government to retain individuals’ full access rights to their health records, embed privacy-enhancing principles into the design of digital health IDs, and ensure strong governance and oversight, particularly when the provision of digital health services involves third-party vendors. 

Restore transparency and accountability in government decision-making

In an appendix to its annual report, the IPC examines how the government handled a series of access to information requests related to the Greenbelt land removal decisions. The IPC identified several systemic issues, including: the use of personal devices and email accounts for government-related business, the use of code words that had the effect of frustrating FOI searches, the lack of proper documentation of key government decisions and poor information retention practices. These practices, if left unaddressed, risk undermining transparency and eroding public trust in government institutions. The IPC calls on the government to strengthen its record-keeping policies and practices, prohibit the use of personal accounts and devices for government-related business, regularly monitor for compliance, and codify a legal duty to document communications, decisions, and actions, as well as an explicit requirement for institutions to define and implement appropriate retention measures.

The full 2024 annual report, including the Greenbelt appendix and key recommendations, is available on the IPC website.

Additional resources:

• From Vision to Impact: Five Years of Privacy and Transparency in a Digital Ontario, 2024 Annual Report 
• Statistical Report

Contact:

@email