Information and Privacy Commissioner calls for strengthened access and privacy protections for all Ontarians

TORONTO, ON (June 5, 2024) — Ontario’s Information and Privacy Commissioner, Patricia Kosseim, is calling on the Ontario government to strengthen and enhance Ontarians’ access and privacy protections. The recommendation is included in the 2023 annual report of the Office of the Information and Privacy Commissioner of Ontario (IPC), released today.

Key findings and recommendations

The 2023 annual report summarizes major activities of the past year and highlights several critical areas where improvements are needed to protect Ontarians' privacy and access rights. The IPC's key recommendations include:

• Implementing a strong and consistent privacy regime with equivalent protections across all regulated sectors in Ontario, including enhanced transparency and accountability requirements, robust security safeguards, and mandatory breach reporting to the IPC
• Ensuring a strong legislative framework governing the use of AI technologies to ensure they are used in ways that respect privacy rights and prevent algorithmic biases and discrimination
• Protecting and empowering children and youth to safeguard their personal information online and building privacy protections and digital literacy into Ontario’s education curriculum 

Bill 194, recently introduced in the Ontario legislature, aims to address many of the issues the IPC has been advocating for, including modernization of Ontario’s access and privacy laws, cybersecurity, AI, and children's digital protection. While the bill represents a step toward that goal, the details will be crucial, and the IPC looks forward to engaging in the public debate about it.

“Ontarians need to know that their access and privacy rights will be protected in a rapidly changing digital landscape. We need modern and strong access and privacy laws to reflect the contemporary needs of the people of Ontario and lay the groundwork for a secure digital future,” said Patricia Kosseim, Information and Privacy Commissioner of Ontario. “Legislative reforms are crucial for ensuring consistent privacy protections across all sectors, enhancing institutional accountability, and maintaining public trust.”

Key trends and ongoing challenges

The IPC’s 2023 annual report also reveals significant trends and challenges arising from mandatory statistics reported to our office by regulated entities. In particular, the following trends require more urgent attention:

Increase in snooping 

Despite years of focus on cases involving unauthorized access to personal information (i.e., snooping by employees or other insiders), this year's statistics show a 34 per cent increase in snooping cases across all sectors, continuing to seriously undermine public trust in Ontario’s public institutions.

With the introduction of administrative monetary penalties (AMPs) under Ontario’s health privacy law, health information custodians should be especially aware of the potentially severe consequences of unauthorized access to personal health information. Health information custodians, as with all institutions, must take the necessary measures to curb this type of behaviour by developing ongoing training programs, limiting access on a need-to-know basis, and implementing effective checks and balances, such as electronic audit trails. 

Increased public demand for information

In 2023, 66,422 freedom of information (FOI) requests were filed across Ontario, nearly a 14 percent increase over 2022. While there were some improvements in the response times for FOI requests, particularly in the provincial sector, there is still progress to be made to ensure timely access to information.

Access to government-held records is more critical than ever in an era of misinformation and disinformation, which leads to social divisiveness, undermines confidence in democratic institutions, and harms our vulnerable populations the most.

Public institutions must prioritize good information management practices by adequately resourcing FOI units, providing training for all staff on records retention and preservation, investing in robust systems and technologies, and — most importantly — promoting a culture of proactive disclosure, openness and transparency.

Misdirected faxes in health sector

Unauthorized disclosure continues to be a leading cause of health privacy breaches, with more than 56 per cent resulting from misdirected faxes, an increase of 10 per cent from 2022. Once again, this year’s statistics reveal the critical need to end the use of faxes and forever eradicate them from Ontario’s health care system. We urge the government to make good on its promise to finally “axe the fax” in health care by 2025. 

The IPC’s 2023 in review, comprehensive statistics, including freedom of information requests, compliance rates, appeals and privacy complaints, are available at www.ipc.on.ca/en/media-centre/annual-reports.

Additional resources:

•    IPC 2023 annual report key statistics and trends