For the Public: Information Access Review

The OIPC can review decisions made by public bodies, custodians and private sector organizations concerning access to information that are subject to Alberta’s access to information and privacy laws.

Before you submit your review, it is important to know what we can and cannot help you with.

What the OIPC Cannot Do

• We cannot issue monetary awards, and we do not issue fines.
• We cannot force anyone to be disciplined, suspended or fired from their job. Decisions related to job discipline are made by the employer – the public body, health custodian or private sector organization. We cannot change those decisions.
• We cannot change a decision made by another body or administrative tribunal about providing a benefit or issuing a penalty, such as decisions made by the Workers’ Compensation Board, Assured Income for the Severely Handicapped (AISH), Ombudsman, Maintenance Enforcement, and so on.
• We are not an advocate. We cannot represent you in your request for review or privacy complaint. We also do not represent the public body, health custodian or private sector organization.

Back to top of the page

What The OIPC Can Do

The OIPC has the ability to review decisions concerning access to information under the following laws:

• Freedom of Information and Protection of Privacy Act [repealed June11, 2025] (FOIP Act)
• Access to Information Act (ATIA)
• Protection of Privacy Act (POPA)
• Health Information Act (HIA)
• Personal Information Protection Act (PIPA)

You may ask the OIPC for a review (called a “request for review”):

• if you made an access to information request and you disagree with the response you received from the public body, health custodian or private sector organization;
• if a public body advised you that it has made a decision to give access to your personal or business information to an applicant. In this type of review, you will be referred to as a “Third Party”;
• if a public body advised you it has disregarded or abandoned your access request;
• if you disagree with a time extension taken by a public body, custodian or organization to respond to your access request;
• if you disagree with a fee estimated or charged by a public body, health custodian or private sector organization with respect to an access request;
• if you were denied an application to waive some or all of the costs associated with processing your access request by a public body or health custodian.

Back to top of the page

Forms

Access requests made to a public body

NOTE: The Freedom of Information and Protection of Privacy Act (FOIP) was repealed and replaced with the Access to Information Act on June 11, 2025. If your access request or third party review was made under FOIP prior to this date, use the following ATIA form for a review.

If your review concerns your request to access information use this form here: ATIA Request for Review form

Third party requests for review concerning a public body’s decision to give access to your personal or business information

If your review concerns a notice you received from a public body about this, use this form here: ATIA Third-Party Request for Review form

Access requests made to a health custodian

If your review concerns your request to access information use this form here: HIA Request for Review/Complaint form

Access requests made to a private organization

If your review concerns your request to access your personal information to a private organization, use this form here: PIPA Request for Review/Complaint form

Back to top of the page

Time limits to request a review

FOIP Act - for information access/correction requests made or third parties notified prior to June 2025, and for PIPA and HIA

Generally, you must submit a request for review to the OIPC for FOIP Act, PIPA and HIA:

• within 20 calendar days of being notified, as a third party, about a public body’s decision to give access to your personal or business information;
• within 60 calendar days of being notified about a public body’s or health custodian’s decision about your access request or your correction request;
• within 30 calendar days of being notified about a private sector organization’s decision about your access request or your correction request;

ATIA - After June 2025 for reviews concerning access to information made to public bodies

• for access requests - within 60 business days after the person asking for the review is notified of the decision, act or failure to act that is the subject of the request, or any longer period of up to 30 additional days allowed by the Commissioner.

Back to top of the page

Who is subject to Alberta’s privacy and access laws?

Public bodies were subject to the Freedom of Information and Protection of Privacy Act (FOIP) Act until June of 2025. After proclamation of the Access to Information Act (ATIA) in June 2025, ATIA repealed the FOIP Act and as of the date of the law coming into force, ATIA applies to access to information requests. Public bodies are generally government bodies, for example provincial government departments, municipalities, school divisions, and municipal police services.

The Health Information Act (HIA or Act) applies to “custodians”, such as the four government departments responsible for health services in Alberta or the provincial health agencies (Recovery Alberta, Assisted Living Alberta, Acute Care Alberta, Primary Care Alberta), hospital services (Alberta Health Services, Covenant Health, Lamont Health Care Centre), pharmacies and pharmacists, physicians, optometrists, registered nurses, dentists, and their health service providers or employees.

Private sector organizations are typically any business that collects, uses or discloses personal information in Alberta. They are governed by the Personal Information Protection Act (PIPA). PIPA allows individuals to access or correct their own personal information.

Certain non-profit organizations are subject to Alberta’s private sector privacy law only when the non-profit organization collects, uses or discloses personal information in connection with a commercial activity.

Back to top of the page

Important Things to Consider When Submitting a Request for Review

Provide a completed single submission

You must provide a completed form and all supporting documents in one submission.  Otherwise, the submission will be returned.

Provide only the information that we initially ask for

Do not send large amounts of materials, as this will delay processing, cause uncertainty in understanding your concerns, and may result in your request for review being returned. Typically, submissions should not exceed 15 pages including the form and all attachments. We enforce this page limit. Your comments and attachments must be relevant to your request for review and to what our office does. If we require more information from you, we will ask for it.

Talk to the public body, health custodian or private sector organization before submitting a review

It may be possible to address and resolve your concern by calling the public body, health custodian or private sector organization and speaking with someone who can help you with your specific concern.

This may be the best option before submitting a matter to us, as your concern may be resolved more quickly.

If your only issue is that the public body, health custodian or private sector organization did not find the records you expected to get, please go to the last section of this page entitled “Read this if your only concern is that you believe the public body, organization or custodian holds more responsive records than what were processed in the request.”

Provide contact information for timely communications

Our new case resolution process involves us trying to settle matters under review in as short a time as is possible. For this reason, you must be available to participate in our process and respond to requests in a timely manner, usually by phone and/or email. Otherwise, a file may not be opened or may be discontinued. If you cannot meet this requirement, you may name an agent to represent you.

Please ensure you provide our office with an email address and phone number, in addition to a mailing address whenever possible. We will use secure email or other forms of secure electronic delivery for any communications containing sensitive information.

Learn about our process

The How OIPC Conducts Reviews page will give you an idea of what you can expect will happen after you submit a request for review.

How long will a review take?

FOIP Act, HIA and PIPA Reviews:

Because our office is currently dealing with a backlog of cases including requests for reviews under FOIP Act, HIA and PIPA, it may take several months to open and then activate your file at the case resolution phase. Once activated, we will attempt to settle the matter within 90 days.

If the matter is not settled, unsettled matters may proceed to the inquiry phase if the Commissioner decides to conduct an inquiry.

In respect of inquiry matters, it may take 18 months or more to conduct an inquiry (adjudicate) and make a formal decision on a request for review, if your concern is not resolved through the settlement process at case resolution. Please note the Commissioner may or may not decide to conduct an inquiry. Formal decisions are made through the OIPC’s inquiry process. More information on inquiries is available here.

ATIA Reviews:

The OIPC has shorter timelines to complete a review under the ATIA. A review is made up of two phases: 1) a settlement phase, and 2) an inquiry phase. The ATIA specifies that the Commissioner has 180 business days to complete a review, with the ability to extend this time by an additional 180 business days.

For reviews under the ATIA, it is imperative that all parties provide requested information and be available for discussions about the matter in a timely fashion. Requests to extend deadlines for providing information or discussing settlement must be reasonable with consideration for the reduced timelines.

Back to top of the page

Other relevant information to consider before making a request for review

• There is no charge to request a review. You do not need legal counsel, but can choose to use one if you want to.
• A copy of your completed request for review and attached documents will be shared with the public body, health custodian or private sector organization that you are contacting the OIPC about. It may not be possible to settle your review without sharing your name and the details of your concerns these bodies (as is applicable). Anonymous complaints are rarely accepted. Only in special circumstances may this be considered.
• The OIPC has a Disability Accommodation Policy on the website. Please contact us if you would like more information about using this policy.

Back to top of the page

Your only concern is that you believe the public body, organization or custodian holds more responsive records than what were processed in the request

This is called an ‘adequate search concern’. If this is your only concern, you will be required to submit the concern directly to the entity first, along with supporting evidence as to why you believe additional records exist. Please allow the entity at least 30 business days to respond to your concerns. After you attempt to resolve this matter directly with the entity, if you still have reason to believe the response does not comply with the relevant law, you may submit your review to our office.

Back to top of the page

June 2025