As Federal Legislation Stalls, Alberta Continues to Move Forward with its Privacy Reform Efforts
The proclamation proroguing Parliament earlier this year significantly reduced the likelihood of reforms to Canada’s Federal privacy legislation in the near term. However, the provinces are continuing to evaluate and move forward with potential reforms. Alberta has already passed Bill 33: the Protection of Privacy Act (“POPA”) and Bill 34: the Access to Information Act (“ATIA”), both introduced to modernize Alberta’s public sector privacy and access to information legislation.
The ongoing implementation of POPA and ATIA is continuing, with minor amendments introduced for “clarity and consistency” on March 20, 2025. These updates are expected to come into force later this year, replacing the existing Freedom of Information and Protection of Privacy Act (“FOIP Act”). Public bodies in Alberta and organizations that do business with them should be actively working to update their practices to comply with the requirements of these two new statutes.
Meanwhile, Alberta is also examining potential changes to its private sector privacy regime. The Standing Committee on Resource Stewardship recently concluded its review of Alberta’s Personal Information Protection Act (“PIPA”) and delivered 12 recommendations for potential reforms.
PIPA governs the collection, use, retention, protection, and disclosure of personal information by Alberta’s private sector organizations. Under a legislative mandate, this Act undergoes periodic reviews by a special committee of Alberta’s Legislative Assembly. The Committee began its second review in January 2024, held stakeholder consultations throughout 2024, and released its Final Report – Review of the Personal Information Protection Act on February 21, 2025.
Among the 12 recommendations, the Committee suggested that PIPA should be amended to provide specific requirements for the collection, use, and disclosure of a minor’s personal information. While acknowledging the importance of children’s privacy, the Committee did not elaborate on what those provisions might entail.
In addition, the Committee recommended that the Alberta Government monitor the consideration of the federal Bill C-27, which has been effectively terminated following Parliament's prorogation. This recommendation may be somewhat moot, as any future federal privacy reforms will need to be evaluated to determine if and how Alberta can maintain its “substantially similar” designation in relation to federal private-sector personal information privacy legislation.
Another significant recommendation was to amend PIPA to grant the Office of the Information and Privacy Commissioner of Alberta (“OIPC”) authority to impose administrative monetary penalties (“AMPs”). The OIPC pointed out that AMPs are already common in privacy frameworks such as the European Union’s General Data Protection Regulation (“GDPR”). Implementing AMPs could strengthen enforcement, encourage compliance, and help Alberta’s PIPA remain aligned with potential emerging federal standards.
The Committee also recommended that PIPA include comprehensive provisions regarding deidentification and anonymization of personal information. This includes introducing clearer definitions and standards for the creation and handling of deidentified and anonymized information, which is crucial given the growing ease of re-identification due to advances in computing and data-linking techniques.
Furthermore, the Committee suggested that the Alberta Government take steps to improve alignment among Alberta’s private, public, and health-sector privacy laws. This would streamline compliance efforts and promote consistency in privacy practices across sectors.
Among other recommendations, the Committee called for clarifying the definition of a commercial activity for nonprofit organizations, amending PIPA to more clearly define forms of consent, and ensuring that penalties for committing an offence under the Act are the same or higher than those of similar legislation in other Canadian jurisdictions.
In response to the recommendations, the OIPC Commissioner expressed satisfaction, stating, “We were very happy to see that several of the recommendations in the report align with our recommendations to the standing committee” and emphasized the need for modernizing PIPA to address evolving technological needs.
Looking ahead, it is now up to the Alberta Government to consider the Committee’s recommendations and determine if, when, and how to bring forward any potential amendments to PIPA. The Committee’s recommendations suggest possible changes ahead for businesses operating in Alberta’s private sector should the Government proceed with formal amendments to the legislation.
If the Government decides to formally adopt any of these recommendations into law, organizations may need to prepare for possible AMPs, stricter enforcement mechanisms, revised definitions, and new obligations related to handling children’s data, automated decision-making, and service-provider contracts.
Meanwhile, in Nova Scotia, lawyer David Nurse has been appointed as the province’s new Freedom of Information and Protection of Privacy (FOIPOP) Review Officer. Nurse brings extensive knowledge of the FOIPOP process, gained through his work in government and as a private-sector lawyer.
Becky Druhan, Attorney General and Minister of Justice, welcomed Nurse to the role, stating, “His broad range of experience makes him an excellent fit to deliver the crucial mandate of upholding Nova Scotians’ right to access information while safeguarding their personal and private data.”
The review officer is responsible for reviewing access to information requests from individuals and organizations dissatisfied with responses from public bodies under various acts, including the FOIPOP Act, the Municipal Government Act, and the Personal Health Information Act. Nurse takes over from Tricia Ralph, whose five-year term ended on February 28, 2025.
Nurse expressed his enthusiasm for the new role, stating, “I am honoured to take on this role. I look forward to serving Nova Scotians in this capacity and to working collaboratively to strengthen transparency and trust in our public institutions.”
As Canada grapples with its privacy and data protection laws, the appointment of experienced individuals like Nurse and the ongoing reforms in Alberta signal a commitment to enhancing privacy rights and access to information for Canadians.
