Canada’s take on data privacy: The Freedom of Information and Protection of Privacy Act (FIPPA)
Canada's legislative landscape is marked by a diverse array of laws and regulations - the Freedom of Information and Protection of Privacy Act (FIPPA) stands out as a cornerstone.
Enacted in 1988, FIPPA applies to a wide array of public bodies - including provincial government ministries, municipalities, crown corporations, universities, school boards, health authorities, and self-governing bodies of professions.
FIPPA serves three pivotal roles:
Ensuring public access: At its heart, FIPPA guarantees the public's entitlement to information held by various governmental bodies, underpinning the principles of transparency and accountability crucial to democratic governance.
Safeguarding individual privacy: the Act enforces stringent guidelines on the collection, use, disclosure, and management of personal information by public entities, thereby providing a robust shield for individual privacy rights.
Striking a balance: FIPPA aims to navigate the delicate equilibrium between the public's right to know and the imperative to protect sensitive or personal data. It incorporates specific mandatory and discretionary exemptions and mechanisms for public interest considerations.
Regional variations in FIPPA
Provincial variations of FIPPA reflect the diverse legal and societal landscapes across Canada. These differences indicate the provinces' efforts to strike a balance between public access and privacy protection, considering their specific legal traditions and societal needs.
For example, Ontario has separate legislation for municipal entities, while British Columbia's stringent data residency requirements have recently been relaxed to allow more flexibility in digital service delivery.
In fact, as of February 1, 2023, significant amendments to British Columbia's FIPPA have been enacted to strengthen privacy and information management. These updates mandate privacy breach notifications and the establishment of privacy management programs to enhance transparency and accountability. They also update data residency rules to allow for more flexible use of digital technologies.
Alberta and Manitoba each emphasise archival use of information and public access rights, which demonstrates the tailored approaches each province takes to address its unique needs.
Key distinctions among provincial FIPPA laws also include the scope of application, exemptions, and the role of Information and Privacy Commissioners.
Comparisons with international standards
FIPPA's approach to data privacy and access to information differs quite considerably from international standards like the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
Unlike GDPR, which emphasises individual consent and data portability, FIPPA focuses more on the right to access public records and the conditions under which personal information can be disclosed or protected. On the other hand, the CCPA grants consumers comprehensive rights regarding their personal information held by businesses - a scope that FIPPA does not directly address, as its primary focus is on public bodies.
The future of FIPPA
The future of FIPPA involves navigating potential updates and legal challenges, especially regarding its exemptions and alignment with the Canadian Charter of Rights and Freedoms - notably challenged in the Criminal Lawyers’ Association v. Ontario case.
This case questioned FIPPA's compatibility with the Charter, particularly focusing on the absence of a "public interest override" for certain exemptions, such as law enforcement and solicitor-client privilege.
As a result, there is a critical tension within FIPPA—striking a balance between public access and the need to protect sensitive information. This ongoing legal discourse highlights the evolving nature of FIPPA in the broader context of public interest and privacy standards. Moreover, with the Act being enacted in 1988, a time when the digital landscape and privacy concerns were markedly different from today, FIPPA must continually evolve to address the complexities of modern data management and the ever-changing expectations of privacy.
FIPPA embodies Canada's commitment to balancing the public's right to know with the protection of individual privacy. As it adapts to new challenges and legal interpretations, FIPPA will continue to play a critical role in shaping Canada's approach to information management and privacy protection.