Commissioner’s Message

Looking back, moving forward

In introducing my final annual report as Ontario’s Information and Privacy Commissioner, I want to take a moment to reflect on the vital importance of access and privacy rights.

Access to information is a pillar of democracy, upholding the public’s right to know how decisions are made and public money is spent. This accountability is critical to promoting trust in public institutions and improving services for citizens.

Maintaining this trust is very much a two-way street. Public institutions can earn the confidence of the public by being open and transparent in their actions and by protecting the sensitive personal information in their care.

Today, personal data is collected, analyzed, and shared in ways that seemed unimaginable before. Now, more than ever, it is critical that public institutions handle the personal information of Ontarians respectfully and responsibly, honouring the public’s trust.

Focusing on Ontario

When I began my term five years ago, one of my key priorities was community outreach and engagement to raise awareness of access and privacy rights and the role of our office. Since then, I have criss-crossed the province from Windsor to Sault Ste. Marie to Ottawa, hosting Reaching Out to Ontario public information events, giving presentations, and meeting with public sector partners and residents.

It’s a big province and we’ve been able to extend our reach through our popular webinar series. These online sessions are an opportunity to respond to questions in real-time and provide in-depth information on specialized topics that matter to public institutions, health care providers, and child and family service providers.

Over the past five years, we’ve made meaningful progress in our engagement efforts and the ongoing conversation we’ve started has been both valuable and inspiring. It informs the day-to-day work of our office and the guidance we provide to institutions and the public to help them understand their rights and obligations under provincial access and privacy laws. To this end, we’ve authored more than 80 publications since 2015, providing practical advice that is tailored to Ontario’s regulatory landscape. Our guidelines use plain language, supporting increased understanding and broader adoption.

In addition to our catalogue of guidance materials, our office issues decisions and orders that act as a roadmap of sorts, providing direction in the form of legal precedents and recommendations. Early in my mandate, we expanded the range of decisions under the Personal Health Information Protection Act that were posted on our website. Since then, we’ve published more than 100 PHIPA decisions, providing additional guidance and direction on the finer points of Ontario’s health privacy law.

Strengthening tribunal services

Investigating privacy complaints and reviewing cases where access to information is denied are at the very core of the IPC’s mandate. Our capable tribunal services team leads these activities, which include the early resolution, mediation, investigation, and adjudication of access appeals and privacy complaints.

Over the past few years, the volume of complaints has remained steady while the number of appeals has increased, with the majority resolved at an early stage, thanks to the efforts of our tribunal team. Both appeals and complaints can be expected to increase in the coming years, with the IPC’s expanded oversight of Ontario’s child and family services sector. We’ve brought on additional staff, provided additional training, and put new file management systems in place to prepare for these increased demands. I have full confidence in the ability of our intake team, mediators, and adjudicators to rise to the challenge.

The investigation of privacy breaches is another area where tribunal staff shine, reviewing the circumstances of breaches, how institutions respond, and making recommendations to strengthen the security of personal information. In the last few years, we’ve seen high-profile incidents at the Rouge Valley Health System, Casino Rama, and LifeLabs, just to name a few. Time and again our investigators have triumphed under pressure, getting to the bottom of highly technical and complex privacy breaches and recommending concrete steps to prevent similar incidents from happening in the future.

Upholding access and privacy rights

Throughout my tenure as commissioner, I have advocated for increased openness and transparency, encouraging governments to share more, not less, with citizens. My office has backed up this commitment with advice and guidance materials to help institutions embrace a more open approach to government information. We’ve also challenged those who would like to pull the shades down on government activities, issuing key decisions and orders aimed at bringing the details of public spending and decision-making to light.

An example is the IPC’s groundbreaking order requiring the Ministry of Health and Long-Term Care to disclose the names of the Ontario Health Insurance Plan’s top billing doctors. We concluded that while physicians themselves are not public servants, the payments they receive from OHIP are for services to the public that are paid for by taxpayers. The order was contested twice in Ontario courts and both times the IPC’s decision was upheld. This summer, following the dismissal of an application to the Supreme Court of Canada, the names and numbers were finally released, making front page news.

This year, I ordered the release of mandate letters issued by the Premier to all Ontario government ministers. Initially, access was denied on the premise they were cabinet documents and automatically exempt from disclosure. While the letters laid out the government’s key policy priorities, in my view they did not reveal details of any government deliberations, meetings or discussions. Unless government records are exempt, they should be disclosed to the public. Ontarians have a right know what their government’s priorities are and where their tax dollars are going. As of the release of this report, the government is challenging my order in court.

Our office is always on the lookout for barriers preventing public access to government information. This year, at the request of Amnesty International, we examined how the Ministry of the Solicitor General handled a series of access requests and appeals. The investigation provided an opportunity for the IPC to take a closer look at the ways an institution was managing a high volume of freedom of information requests and provide specific recommendations other institutions can benefit from.

Continued advancements in information technologies have made possible the collection, use, and disclosure of personal information in new ways. And while the technology continues to change, the bedrock principles of our work remain the same — people have the right to expect government to manage their personal information respectfully, within the limits of the law, and to protect it from unnecessary exposure.

To this end, the IPC urged the government to put enterprise-wide policies and processes in place to safeguard the personal information of Ontarians used in data projects. Based on our recommendations for a unified privacy-protective approach to data integration, the government introduced a series of legislative amendments in 2019.

During my tenure, the IPC was recognized by the International Conference of Data Protection and Privacy Commissioners for our efforts to demystify de-identification with guidelines for institutions. To have the efforts of the IPC recognized internationally was a highlight of my time as commissioner.

Another high point was the IPC’s work in the development of a made-in-Ontario model for the review of sexual violence cases. The model uses a privacy-protective, collaborative approach, bringing in community advocates and outside experts to take a second look at cases that were reported to police and then closed without charge. This year, the model was endorsed by the Ontario and Canadian associations of chiefs of police for use by police services across the country.

Signing off

As I begin my next chapter, I want to express my gratitude to colleagues, past and present. Together, we’ve built a world-class organization guided by fairness and integrity. Your professionalism has made my time at the IPC a rewarding experience. Recently, you were tested in new and unexpected ways during the COVID-19 crisis. But you pulled together, keeping operations running while our doors were closed. This level of commitment, even in the most difficult of circumstances, is what truly sets the employees of the IPC apart. It has been an honour to work with you towards our shared goal — protecting and promoting the access and privacy rights of Ontarians.

Brian Beamish
Commissioner