Ontario's municipal freedom of information law gets major overhaul: new privacy breach rules, staged-access plans, and whistleblower protection

Plain-language summary · AI-assisted · not legal advice

Ontario has made sweeping changes to the Municipal Freedom of Information and Protection of Privacy Act affecting how municipal institutions handle access requests and protect personal information. Institutions can now propose a staged access plan when a request is unusually large or burdensome, and requesters must respond within 30 business days or risk being deemed to have abandoned their request. Response deadlines are shifting from calendar days to business days, and the main response period is increasing from 30 to 45 business days, with a new second extension available in limited circumstances. Institutions will be required to conduct written privacy impact assessments before collecting personal information, implement reasonable safeguards to protect it, and report thefts, losses or unauthorized disclosures to the Privacy Commissioner and affected individuals when there is a real risk of significant harm. A new whistleblower provision allows anyone with reasonable grounds to report suspected contraventions confidentially to the Commissioner. The personal information bank concept and related index requirements are being repealed, and the Commissioner gains new powers to review an institution's information practices and order corrective action.

Who this affects: municipal institutions and their heads · people making freedom of information requests · privacy and compliance officers at municipalities · Information and Privacy Commissioner of Ontario · individuals whose personal information is held by municipalities