The IPC recommended stringent safeguards and mandatory breach reporting
Ontario’s Information and Privacy Commissioner, Patricia Kosseim, has urged the Ontario government to enhance and strengthen the province’s access and privacy protections.
This recommendation is part of the 2023 annual report from the Office of the Information and Privacy Commissioner of Ontario (IPC). The report outlined the significant activities undertaken by the IPC over the past year and identified several critical areas where improvements are needed to better protect Ontarians' privacy and access rights.
The IPC recommended implementing a robust and consistent privacy regime with equivalent protections across all regulated sectors in Ontario, including enhanced transparency and accountability requirements, stringent security safeguards, and mandatory breach reporting to the IPC. Additionally, the report called for establishing a strong legislative framework for using AI technologies to ensure they respect privacy rights and prevent algorithmic biases and discrimination. The report also emphasized the need to protect and empower children and youth by safeguarding their personal information online and incorporating privacy protections and digital literacy into Ontario’s education curriculum.
The IPC report highlighted Bill 194, recently introduced in the Ontario legislature, which aims to address many issues the IPC has been advocating for. This bill seeks to modernize Ontario’s access and privacy laws, address cybersecurity concerns, regulate AI use, and enhance digital protection for children. While the bill represents a positive step, Commissioner Kosseim emphasized the importance of detailed and comprehensive legislative measures.
"Ontarians need to know that their access and privacy rights will be protected in a rapidly changing digital landscape. We need modern and strong access and privacy laws to reflect the contemporary needs of the people of Ontario and lay the groundwork for a secure digital future," said Patricia Kosseim. "Legislative reforms are crucial for ensuring consistent privacy protections across all sectors, enhancing institutional accountability, and maintaining public trust."
The report also reveals significant trends and challenges from mandatory statistics reported by regulated entities. Notably, there has been a 34 percent increase in cases of unauthorized access to personal information, or "snooping," across all sectors. This trend continues to undermine public trust in Ontario’s public institutions. Health information custodians, in particular, must be vigilant, with the introduction of administrative monetary penalties (AMPs) under Ontario’s health privacy law highlighting the severe consequences of unauthorized access.
In 2023, Ontario received 66,422 freedom of information (FOI) requests, nearly a 14 percent increase over 2022. Although some improvements in response times for FOI requests, especially in the provincial sector, were made, further progress is needed to ensure timely access to information. The report stressed that access to government-held records is critical, particularly in an era of misinformation and disinformation, which can undermine democratic institutions and harm vulnerable populations.
Unauthorized disclosures remain a significant issue in the health sector, with over 56 percent of breaches resulting from misdirected faxes, a 10 percent increase from 2022. The IPC called for the government to fulfil its promise to eliminate faxes in healthcare by 2025.
The 2023 annual report is available on the IPC’s website for more detailed insights and comprehensive statistics.
