Summary:

Notice to the Public and Institutions

To protect the health of our employees and to do our part to slow community transmission of the COVID-19 virus, the IPC has closed its physical office.

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.

We continue to update our FAQs as we get more information. You can also reach us by emailing info@ipc.on.ca.

If you’ve made a request for general or personal information from a public-sector organization, you should expect delays. Because of the COVID-19 outbreak, many public sector staff are working remotely and may not be in a position to search for the records you are asking for until they are back in the office.

Tips for Working from Home

We understand that these are exceptional circumstances. The reasonableness of security and privacy measures has to take into account time-limited, urgent needs.

Many organizations are striving to manage service disruptions and continue to provide essential services, especially in the health and child and family services sectors.

Here are some tips for dealing with personal information when working from home:

Mobile devices

  • password protect your device
  • lock your device when not in use
  • if using portable storage devices, such as USBs and portable hard drives, if possible, ensure they are encrypted and password protected
  • keep your software up-to-date

Emails

  • if possible, use work email accounts rather than personal ones for work-related emails involving personal data
  • before sending an email, check that you’re sending it to the correct recipient, particularly for emails involving personal data

Paper copies and files

  • only remove personal information from the office if it is necessary to carry out your job duties
  • securely store any paper files when not in use – lock files away and do not leave files in your car

Frequently Asked Questions

When will the IPC reopen?

We will continue to evaluate this evolving situation and provide regular updates here and on Twitter @IPCinfoprivacy.

What essential services will be provided by the IPC during this time?

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.

Will institutions be required to respond to requests for access to or correction of information during this time?

UPDATED MARCH 25 – The expectation to comply with Ontario’s access laws remains in effect, however this is an exceptional circumstance and we understand that many organizations will be unable to meet the 30-day response requirement. As such, we will consider these circumstances when evaluating appeals relating to deemed refusals.

What will happen with my appeal?

The Ontario government has issued a suspension order, effective March 16, under the Emergency Management and Civil Protection Act that ‘freezes’ the time limits for initiating complaints or appeals to the IPC set out in Ontario’s access laws, health privacy law, and child and family services law.

Most tribunal services will be on hold while the office is closed.

These steps are subject to any additional rules the Ontario government may establish in the interim and when lifting the suspension order.

Our top priority is keeping the public and all IPC staff safe during the COVID-19 outbreak. We will make every effort to get back to regular business quickly once this crisis is over.

What if my privacy is breached? Will the IPC be taking complaints?

Anyone with a complaint should submit it to the IPC using our online complaint forms. We will make every effort to respond to urgent matters in a timely way, but may not be able to address your complaint until the office reopens.  We appreciate your patience during this difficult time.

Can I still reach the IPC to consult or ask questions about matters related to access and privacy at my organization?

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.

We continue to update our FAQs as we get more information. You can also reach us by emailing info@ipc.on.ca.

How will I comply with the requirement to report privacy breaches to the IPC?

Institutions, health information custodians and child and family service providers should continue to report breaches at their organizations using the online breach report form. We will make every effort to respond to urgent matters in a timely way, but may not be able to address your report until the office reopens.  We appreciate your patience during this difficult time.

I am sending in an important piece of mail.  Will it be received?

No, all mail is being held until the office reopens and is not being opened. Also, if you sent any mail on or after March 9, 2020, or any courier packages on or after March 11, 2020, we may not have received them yet and they will not be opened, either. If the communication was urgent, you may email info@ipc.on.ca.

How do I get in touch with the IPC during the closure?

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors and we remain available to public organizations for consultation and discussions on access and privacy matters.

Members of the public can email info@ipc.on.ca. We will make every effort to respond to urgent matters in a timely way, but may not be able to address your email until the office reopens.

Should organizations tell staff who are working at home to avoid accessing and collecting personal information of patients/clients? Home computers may not have the same level of security as the devices in the office, which are on a secure network.

We understand that these are exceptional circumstances. The reasonableness of security and privacy measures has to take into account time-limited, urgent needs.  Many organizations are striving to manage service disruptions and continue to provide essential services, especially in the health and child and family services sectors.

If your organization believes that staff (or agents working on the behalf of the organization) should be allowed to handle personal information from home, in order to provide necessary services in an effective and efficient way, you should permit them to do so. You should guide any staff working from home on how to do their work within as privacy-protective an environment as they can, given the realities of our current situation.

In a public health crisis, it is also understandable that service professionals, especially in the health and child protection sectors, may need to send or receive information by phone, text, email or other messaging services. The above applies to the use of technologies not normally used for business, during this crisis.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.