Alberta legislation to refresh 'outdated' privacy laws after 20 years

A woman uses her computer keyboard to type while surfing the internet in North Vancouver, B.C., in this file photo dated December 19, 2012. (Jonathan Hayward/The Canadian Press)

As the digital world we live in continues to evolve, the province is looking to refresh its “outdated” privacy laws.

On Wednesday, the United Conservative Party (UCP) tabled legislation to replace its Freedom of Information and Privacy Act (FOIP) with two separate pieces of legislation.

One would deal with protection and privacy and the other would address access to information.

The FOIP act, passed in 1995, and hasn’t been updated in more than 20 years. During this time, the rise of the internet and social media has changed how data is collected, especially going from paper to digital.

The province hopes by separating the act into two legislations, it will streamline the process.

• The information you need to know, sent directly to you: Download the CTV News App

Bill 33: Protection of Privacy Act

The province says the proposed Protection of Privacy Act, Bill 33, would build on existing legislation and offer “stronger privacy protections” within government services.

“In this age of rapidly changing technology, people want assurance that their private information is protected,” said Technology and Innovation Minister Nate Glubish on Wednesday.

In 2019, the federal government called on provinces and territories to update their access and privacy legislation. Each one has, except for Alberta.

Glubish says the legislation hasn’t been updated because everytime the government looked to do it, it had to look at both privacy provisions and access to information, instead of one or the other, taking more time.

The province says if Bill 33 is passed, public bodies will need to change how they manage personal information.

Some of the new rules include:

• Public bodies not being able to sell personal information, including marketing and advertising;
• Public bodies must notify a person if their information is used in an automated system to generate content or make decisions, recommendations or predictions; and
• Albertans must be notified of a privacy breach where there is risk of significant harm such as financial loss, identity theft, fraud or blackmail.

If rules surrounding personal information are broken, a person could face a fine of up to $125,000 and an organization can be fined up to $750,00.

Data and non-personal information fines are up to $200,000 for a person and up to $1 million for an organization.

The proposed bill will only apply to provincial public bodies in the province, not private sector businesses.The UCP describes a public body as a government department (branch or office), an educational body (a school board or postsecondary institution), or a local government (police service, library.)

• Sign up for breaking news emails from CTV News Edmonton, right at your fingertips

Bill 34: Access to Information Act

The province said the Access to Information Act, Bill 34, aims to bring Alberta's access to information laws in line with other jurisdictions in the country.

“The bill will address key issues around definitions such as records to include electronic records, timelines for responding to requests and the ability for public bodies to proactively release information,” said Service Alberta and Red Tape Reduction Minister Dale Nally.

Some of the ways Albertans information is shared with public bodies include their medical history while seeing a doctor, registering their vehicle or to renew a driver’s license and buying or selling a house with a land title registry.

If passed, the legislation would include changes to:

• Clarify and enhance regulatory functions, including those of the Office of the Information and Privacy Commissioner (OIPC);
• Set out clear timelines for OIPC to complete reviews and response to access requests;
• Allow public bodies to proactively disclose information outside the access to information process.

It would also remove the ability for a member of the public to request the release of some records, such as emails between a cabinet member and political staff (as defined in future by the legislation). 

Nally says currently the OIPC must investigate every complaint it receives which “is a drain on resources," and the new bill would allow the privacy commissioner to discontinue a complaint where there is "no benefit to complete it."

A review of the act would be mandated every six years.

More details of the regulations will be brought forward in spring 2025.