Bill 22, the Freedom of Information and Protection of Privacy Amendment Act, 2021, received royal assent and became law on November 25, 2021. The Bill made significant amendments to British Columbia’s Freedom of Information and Protection of Privacy Act (FOIPPA) but two additional amendments that came into force on February 1, 2023 materially change how public bodies must address privacy issues in British Columbia.

The two amendments contained in Bill 22 that came into force on February 1, 2023 require:

1. A public body to give notice of a “privacy breach” to any “affected individual” and to the Office of the Information and Privacy Commissioner of British Columbia (OIPC); and
2. All public bodies to have a Privacy Management Program (PMP).

The full text of Bill 22 can be found here.

Background

FOIPPA governs the collection, use and disclosure of personal information by British Columbian public bodies. Public bodies include provincial government ministries, school boards, health authorities, crown corporations and municipalities. The OIPC is responsible for oversight and enforcement of FOIPPA and its private sector counterpart, theBritish Columbia Personal Information Protection Act (PIPA). Its responsibilities include conducting audits on private or public bodies where there may be non-compliance with applicable privacy legislation, educating the public about their right to privacy and investigating alleged privacy breaches.

Privacy breach reporting obligations

FOIPPA defines a “privacy breach” as the theft, loss, or  unauthorized collection, use or disclosure of personal information in the custody or under the control of a public body. In the event of a privacy breach, the head of the public body is required to notify both the OIPC and any individuals that could reasonably be expected to suffer “significant harm” as a result of the breach. Significant harm is also defined in FOIPPA, and includes bodily harm, humiliation, damage to reputation, financial loss, or damage to property.

The necessary parties are required to be notified in writing of the privacy breach “without unreasonable delay.” The written notification must include the name of the public body, the date on which the privacy breach came to the attention of the public body, a description of the privacy breach, contact information for a responsible individual, and a description of the containment measures which have been implemented.

The OIPC recently released a guidance document which contains further information about reporting obligations in the event of a privacy breach. To date, PIPA had not been amended to introduce mandatory breach reporting.

Privacy management programs

PMPs are intended to ensure that public bodies appropriately manage and are accountable for protecting British Columbians’ personal information. To be compliant with FOIPPA, a PMP must contain the following components:

1. The designation of an internal Privacy Officer who is responsible for ensuring that the public body remains compliant with FOIPPA;
2. A procedure for completing and documenting privacy impact assessments as required and information sharing agreements as appropriate under FOIPPA;
3. A procedure for responding to privacy complaints and privacy breaches;
4. A commitment to ongoing privacy awareness activities to educate employees about their privacy obligations and responsibilities;
5. Set methods to ensure that service providers are aware of their privacy obligations (for example, by including mandatory contractual obligations in all service contracts); and
6. A procedure for regularly monitoring and updating the PMP as required.

Privacy policies and procedures are required to be made available to the employees of the public body, and, to the extent reasonable, may also be required to be accessible by the public.

The OIPC’s guidance document contains further considerations for how to design and implement an appropriate PMP.

If you have any questions about privacy obligations of your organization, please contact Eleni Kassaris or Salim Visram.