Calgary (National Times): With new legislation and regulations now in force, the Office of the Information and Privacy Commissioner (OIPC) has developed and published resources to assist Albertans in understanding and working with the new laws
The Information and Privacy Commissioner of Alberta is pleased with several elements of the regulations that were developed to accompany Alberta’s new Access to Information Act (ATIA) and Protection of Privacy Act (POPA). Commissioner Diane McLeod also has concerns about some aspects of the regulations and will closely monitor how the laws and regulations work in practice.
On June 11, 2025, ATIA and POPA were proclaimed into force. The new laws replace the Freedom of Information and Protection of Privacy Act (FOIP Act), which was repealed on June 11, 2025 by the proclamation of the new Acts.
Since the passing of Bill 33 (POPA) and Bill 34 (ATIA) in December 2024, government has been working on the drafting of the following regulations:
- Under ATIA, the Access to Information Act Regulation (ATIA Regulation) and the Designation of Public Bodies Regulation; and
- Under POPA, the Protection of Privacy (Ministerial) Regulation and the Protection of Privacy Regulation.
These regulations were brought into force on June 11, 2025.
“My office met regularly with government throughout the regulation drafting process,” said McLeod. “We were provided with ample opportunity to provide comments and recommendations to government staff assigned to draft these regulations. While we did not agree on everything, we did see many of our comments and recommendations incorporated into the regulations and we are grateful to have been given the opportunity to work so closely with government throughout the process.”
In terms of the POPA regulations, the Commissioner was pleased to see the details regarding privacy management programs, privacy impact assessments (PIAs), and information security set out in the regulations. The Commissioner was also pleased to see accountability clarified under the PIA procedures for common or integrated programs or activities, and for data matching and the creation of non-personal data.
“These provisions, together with the requirements in POPA, will significantly strengthen privacy protection for Albertans while government operationalizes its data strategy in the coming years to improve service delivery in the public sector, and as the development and use of technology to innovate in this sector, and in others, advances in the province,” added McLeod.
In terms of the ATIA regulations, the OIPC expressed concern regarding the duty to assist, specifically, that the duty to assist in section 5(1) of the ATIA Regulation appears to inappropriately reverse the duty onto the applicant. The Commissioner also raised concerns about the lack of clarity in the ATIA Regulation to better guide public bodies in understanding the breadth of this duty as it relates to helping applicants successfully submit access requests.
“Many orders of my office have set out what this duty entails,” said McLeod. “We recommended that the duty be more clearly spelled out in the ATIA Regulation, which, unfortunately, did not occur. We also expressed concern regarding the attestation procedure related to Cabinet and Treasury Board confidences set out in section 11 of ATIA, which we commented should be a sworn declaration, rather than merely a confirmation letter signed or approved by the head.”
The OIPC will closely monitor how these Acts and regulations affect the access to information and privacy rights of Albertans in the coming months and years, and will continue to voice its views to government as these laws are implemented across the province by public bodies.
In anticipation of the Acts and regulations being proclaimed into force, the OIPC developed a number of documents designed to assist public bodies in meeting their new obligations. The OIPC has also developed resources to help the public understand their rights under these laws and additional information to help them exercise these rights.
The public and public bodies may view these resources on the OIPC website at oipc.ab.ca.
Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.
