Ontario

Ontario

Information and Privacy Commissioner of Ontario (IPC)

The IPC provides independent oversight of Ontario's access and privacy laws in a single combined office. It performs three core functions: resolving appeals when public bodies refuse access to information, investigating complaints about the handling of personal information, and reviewing compliance with the statutes it administers. Its stated mission is to enhance Ontarians' trust that their access and privacy rights will be respected. Ontario has no general private-sector privacy statute; PIPEDA, overseen by the federal Privacy Commissioner rather than the IPC, applies by default to Ontario's commercial private sector.

Laws and regulations administered:

Other provincial legislation and developments of note

  • Enhancing Digital Security and Trust Act, 2024 (EDSTA) — enacted as Schedule 1 of Bill 194, governing cybersecurity and AI-system use by public-sector entities (FIPPA/MFIPPA institutions, children's aid societies, school boards) and digital data about minors. Two regulations under the Act — one on cybersecurity, one on the digital data of people under 18 — took effect July 1, 2026.
  • Bill 194 (S.O. 2024, c. 24, Royal Assent December 2024) also amended FIPPA to add mandatory privacy-breach reporting to the IPC and affected individuals, mandatory privacy impact assessments before collecting personal information, a new Commissioner power to review institutions' information practices, and whistleblower confidentiality provisions.
  • Bill 97, Plan to Protect Ontario Act (Budget Measures), 2026 (S.O. 2026, c. 2, Royal Assent April 24, 2026) — an omnibus budget bill that further amended FIPPA and MFIPPA: it extended access-request response deadlines from 30 to 45 business days, added staged disclosure and a second extension option, excluded EDSTA cybersecurity records from disclosure, and phased in MFIPPA breach-reporting and privacy-impact-assessment duties (July 1, 2026 and January 1, 2027). More controversially, it excluded records of the Premier, cabinet ministers, parliamentary assistants, and political staff from FIPPA's reach.

This exclusion is genuinely contested, and the government has said relatively little publicly to defend that specific piece. Where a rationale has been offered for Bill 97 generally, it has been framed around operational strain — institutions facing rising, more complex, and AI-driven request volumes without added resources, making the prior framework "increasingly difficult to administer consistently and defensibly." But that general modernization case was not, in available reporting, extended into a specific public justification for excluding political staff and cabinet records — a gap critics have treated as part of the problem. The IPC (Commissioner Patricia Kosseim) publicly opposed the exclusion in March 2026, arguing it would "materially reduce transparency, are out of step with other Canadian jurisdictions, and undermine democratic accountability," and separately told the Legislature the change removes her office's authority to even investigate how such records are handled. Opposition parties were more pointed: NDP Leader Marit Stiles called the decision to cancel public hearings on the bill "an attack on our democracy," and Green Leader Mike Schreiner suggested the government "has something to hide." Critics and legal commentators have also connected the timing to a specific Global News freedom-of-information request for the Premier's cellphone records, and have criticized the fast-tracked legislative process itself, separately from the substance of the exclusion. The exclusion passed as part of Bill 97 regardless.

  • Bill 11, More Convenient Care Act, 2025 (S.O. 2025, c. 7) — Schedule 6 adds a new Part V.2 to PHIPA establishing a "digital health identifier" framework: biometric-capable electronic identity verification (such as facial matching) so Ontarians can access their health records online through the provincial EHR, including validation, breach-notification duties, and Commissioner oversight. It re-introduces the prior Parliament's Bill 231, which died on dissolution ahead of the February 2025 election.

This schedule was contested. The IPC was highly critical of the predecessor Bill 231 version, saying it "put Ontarians' health privacy at risk and limits rather than enables their access rights," and criticizing reliance on future regulations and ministerial directives to establish core legal requirements rather than setting them out in the Act itself. University of Ottawa privacy scholar Teresa Scassa separately argued the schedule amounts to healthcare-access reform mislabelled as "PHIPA modernization," and flagged equity risks for elderly, disabled, and digitally-excluded Ontarians if non-digital alternatives to the identifier disappear.

  • Bill 119, Protecting Ontario's Streets and Communities Act, 2026 — an omnibus justice and policing bill, at Second Reading and referred to committee as of this writing. Schedule 3 would create a centralized, publicly accessible website, managed by the OPP Commissioner, for police chiefs to publish personal information about individuals convicted of an offence in Canada who are assessed as posing a significant risk to another person or to property.

This schedule is contested. In a June 24, 2026 letter, IPC Commissioner Patricia Kosseim objected that the bill sets no limits on what categories of personal information may be published and no clear rules for removal — risking indefinite publication even after a record suspension or overturned conviction — and that it would strip existing FIPPA correction and MFIPPA access rights in favour of a future regulation-based scheme she warned risks being "confusing, duplicative, and potentially inconsistent." She also noted notice requirements don't extend to third parties, such as victim-survivors, whose identity might be inferable from a posting.

  • Ontario has published a non-statutory Responsible Use of Artificial Intelligence Directive / Trustworthy AI Framework for government use of AI. This is government policy, not legislation.