The Office of the Information and Privacy Commissioner (OIPC) of Alberta has launched a Privacy Impact Assessment (PIA) Template and a PIA Completion Guide that align with the current requirements of the Protection of Privacy Act (POPA) and its regulations, which came into effect in 2025.

The completion of PIAs by public bodies is mandatory under POPA in certain circumstances. Some of these PIAs must be submitted to the Commissioner for review and comment. The purpose of a review by the OIPC is to assess whether the public body has adequately turned its attention to its compliance obligations under POPA and will, as represented in the PIA, be compliant with POPA when implementing the project.

The template and guide will assist public bodies in completing privacy impact assessments under POPA and help ensure that any PIAs submitted to the OIPC for review and comment contain the information necessary for our review. Any public body that is required to submit a PIA to the OIPC under POPA must use the template.

The two documents are now available on the OIPC website.

“We developed the template and guide specifically to assist public bodies in Alberta,” said Information and Privacy Commissioner Diane McLeod. “However, at recent events that I have attended across Canada, in speaking about our launch of these resources, I have been approached by others looking to leverage these resources for completing PIAs in their respective jurisdictions. While this template was designed specifically to align with POPA, it contains basic PIA requirements and will also be a useful reference for those in the field of privacy responsible for completing PIAs, regardless of location.”

This set of PIA resources is the first of three to be issued by the OIPC. Once Alberta’s health information law and private sector privacy law are amended and the amendments proclaimed in force, the OIPC will create similar resources for use by custodians and organizations to meet PIA requirements under those laws.

A Notice to Public Bodies has been published on the News and Events page of the OIPC website, describing the template and guide. From there, public bodies can link to the template and guide. They may also access the tools via the Resources page of the website, or by clicking on the Submit A Privacy Impact Assessment link on the website’s home page.

The completion guide will help public bodies in filling out the template. The guide aligns with the template on a question-by-question basis and provides additional context, a description of and what is expected of each question.

The template and guide will be updated from time to time as additional guidance becomes available, based on feedback from public bodies, or when otherwise necessary.

“We welcome feedback from public bodies regarding their experiences using the template and guide,” added McLeod. “We will take any suggestions or comments into consideration when making changes. Public bodies may provide feedback when they submit their PIAs and in addition, we will host an online engagement forum after the PIA template has been in use for some time, so that public bodies may share their experiences with the template and provide feedback and suggestions.”

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act. The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

Since the enactment of the Protection of Privacy Act (POPA), the Office of the Information and Privacy Commissioner (OIPC) has developed a new Privacy Impact Assessment (PIA) Template (POPA PIA Template) and a POPA PIA Completion Guide (POPA PIA Guide) that align with the current requirements of POPA and its regulations.

The completion of PIAs by public bodies is mandatory under POPA in certain circumstances. Some of these PIAs must be submitted to the Commissioner for review and comment.

The POPA PIA Template and POPA PIA Guide will assist public bodies in completing a PIA, as required, and help ensure that any PIAs submitted to the OIPC for review and comment contain the necessary information.

The two documents are now available on the OIPC website.

Table of Contents

• • Who should use the POPA PIA Template
  • How the POPA PIA Template will help
  • The POPA PIA Guide
  • A brief transition period: PIAs previously prepared and ready for submission
  • Moving forward: What to expect next
  • Need help?

Who should use the POPA PIA Template

The purpose of a review by the OIPC is to assess whether the public body has adequately turned its attention to its compliance obligations under POPA and will, as represented in the PIA, be compliant with POPA when implementing the project.

Any public body that is required to submit a PIA to the OIPC under POPA must use the POPA PIA Template. The OIPC will not accept a PIA from a public body that does not use the template.

The template is also available for public bodies to use when completing PIAs that are prescribed under POPA but are not required to be submitted to the Commissioner. Since the Commissioner may request copies of those PIAs under section 26(3) of POPA, the OIPC strongly recommends that public bodies use the template for completing these PIAs as well.

As well, the template is available and recommended for those bodies doing POPA-related PIAs voluntarily.

Be sure to use ONLY the POPA PIA Template and POPA PIA Guide when submitting a PIA to the Commissioner under POPA. Other material on our website that deals with PIAs, such as the Privacy Impact Assessment Requirements Guide, is directed toward PIA submissions under the Health Information Act (HIA).

How the POPA PIA Template will help

The POPA PIA Template provides overarching guidance in the first few sections, entitled Introduction, Common Questions, and Read Before Completing Your PIA.

In some cases, the need to complete certain parts of the template depends on the type of project and whether it includes aspects such as data matching, a common or integrated program or service, or the use of automated decision systems such as artificial intelligence (AI).

Public bodies should download a new copy of the template from the OIPC website each time they submit a new PIA to the Commissioner, rather than relying on previous versions of the template, as changes may have been made to the template since their last download.

PIAs should be submitted by attaching the completed PIA template, along with associated appendices, to an email, to be sent to PIA@oipc.ab.ca. Email is not a secure form of communication, so the OIPC recommends that security measures be applied to attachments sent by email.

IMPORTANT: If the POPA PIA Template is not completed appropriately, the PIA submission will be deemed incomplete and will not be reviewed by the OIPC. If this occurs, the OIPC will notify public bodies in writing.

The POPA PIA Guide

The OIPC has prepared a supplementary POPA PIA Completion Guide to assist public bodies in filling out the template. The guide aligns with the template on a question-by-question basis and provides additional context, a description of and what is expected of each question.

The POPA PIA Template and POPA PIA Completion Guide will be updated from time to time as additional guidance becomes available, based on feedback from public bodies, or when otherwise necessary.

A brief transition period: PIAs previously prepared and ready for submission

If a public body has a PIA ready for submission, which was created without access to the POPA PIA Template and POPA PIA Completion Guide, it is still advisable for those public bodies to refer to these new documents and submit their PIA using the new OIPC template.

During the first few weeks after the launch of the template by OIPC, if public bodies do not use the template, they should, at the very least, review these POPA PIA resources and make sure the requirements identified in those resources have been addressed in the PIA. The key issue is to ensure section 7(3) of the M-Regulation is met, i.e. a privacy impact assessment must provide a level of detail commensurate with the complexity of the practice, program, project or service the privacy impact assessment relates to.

If a public body submits the PIA without use of these materials, there is a risk it will not meet the OIPC requirements for review.

AS OF MAY 1, 2026, THE OIPC WILL NOT ACCEPT ANY PIA SUBMISSION THAT DOES NOT USE THE POPA PIA TEMPLATE.

Moving forward: What to expect next

The OIPC welcomes feedback from public bodies regarding their experiences using the POPA PIA Template and POPA PIA Completion Guide. We will take any suggestions or comments into consideration when making changes to the template. Public bodies may provide feedback when they submit their PIAs. Please include feedback in a separate document and attach it to the email that includes your PIA submission.

In addition to accepting this type of feedback, the OIPC will be hosting an online engagement forum after the PIA template has been in use by public bodies for some time, so that public bodies may share their experiences with the template and provide feedback and suggestions.

The PIA FAQ on the OIPC website is currently being revised and once complete, it will be posted on the OIPC website.

The POPA PIA Template references Privacy Management Programs (PMPs). The duty for public bodies to have an operational PMP will come into effect on June 11, 2026. The OIPC is currently developing PMP guidance to assist public bodies. Once available, the PMP guidance will be published on the OIPC website.

Need help?

If you have questions, please contact the OIPC at generalinfo@oipc.ab.ca or call 780-422-6860 (tollfree 1-888-878-4044).

The results of the latest Global Privacy Enforcement Network (GPEN) sweep highlight how child-friendly practices can protect children’s privacy online. Along with emerging concerns, the sweep identifies improvements in some regards.

The global sweep included 27 data protection and privacy authorities from around the world, including the Office of the Information and Privacy Commissioner (OIPC) of Alberta. The sweep examined almost 900 websites and apps that are used by children. While some are designed for children’s use, others are used by the general population but are popular with children.

“Children’s privacy remains a key priority for our office, as stated in our annual business plan,” said Information and Privacy Commissioner of Alberta Diane McLeod. “Participation in this annual initiative helps us to raise awareness about how children’s personal information is used. Our focus for the most recent sweep focussed on popular games aimed at children, even those as young as five years old, as well as educational applications and social media. We are pleased to see that protections for children have been enhanced in some regards, but new concerns have also arisen.”

The findings in Alberta align largely with findings around the globe. For example, one finding from the Alberta part of the sweep is that apps aimed specifically at children are more likely to have child-friendly privacy practices, compared to those aimed at a larger audience (but still popular amongst children).

As part of the global initiative, the Alberta OIPC looked at the platforms’ mechanisms and practices regarding the collection of users’ personal information, as well as those relating to transparency, age assurance and limitations on data collection.

By replicating a 2015 children’s privacy sweep done by GPEN, participating authorities were able to compare how online services protected children then and now.

Overall, the sweep found good practices to protect children and their personal information, such as notifications advising children not to use their real names or upload images, as well as having location-sharing disabled by default.

However, the sweep also found concerning practices and increases in some privacy risks to children over the last decade. For example, compared to 2015, more of the online services used by children now require users to provide their personal information to access the full functionality of the platform. In addition, more platforms indicated in their privacy policies that they may share personal information with third parties.

The sweep found increased use of age assurance mechanisms to limit children’s access to online services but also found that such measures could easily be circumvented. This is a particular concern when websites and apps have inappropriate content or high-risk data processing and design features for children.

“The privacy sweep is not an investigation, nor is it intended to conclusively identify compliance issues or legal contraventions,” said McLeod. “Instead, concerns identified during the sweep may support targeted advice and engagement with organizations or enforcement actions in the future.”

Quick Facts

Sweep participants evaluated websites and mobile applications based on five indicators, which largely mirrored those considered in the 2015 sweep.

• Age assurance: For 72% of websites and mobile applications reviewed, participants were able to circumvent age assurance measures, most often where self-declaration was used.
• Collection of children’s data: More than half (59%) of the websites and mobile applications required the collection of an email address to access the full functionality of the platforms, followed by 50% requiring usernames, and 46% requiring geo-location. Overall, participants noted an increase in the collection of certain types of information compared to 2015.
• Protective controls: 71% of the websites and mobile applications did not have information about protective controls and privacy practices that were tailored to children.
• Account deletion: More than one third (36%) of the websites and mobile applications did not provide an accessible way to delete accounts.
• Inappropriate content and high-risk design features: Only 35% of the websites and mobile applications identified as having high-risk data processing and design features for children had privacy information, such as a pop-up, directing a young person to seek permission from their parents to continue using the website or app.

The privacy sweep is an annual initiative aimed at increasing awareness of privacy rights and responsibilities, encouraging compliance with privacy legislation, and enhancing cooperation between international data protection and privacy authorities.

This year’s sweep was coordinated by the Office of the Privacy Commissioner of Canada, the United Kingdom Information Commissioner’s Office, and the Office of the Data Protection Authority of the Bailiwick of Guernsey.

The Global Privacy Enforcement Network was established in 2010 upon recommendation by the Organisation for Economic Co-operation and Development (OECD). The network’s aim is to foster cross-border cooperation among privacy regulators in an increasingly global market in which commerce and consumer activity relies on the seamless flow of personal information across borders. Its members work together to strengthen personal privacy protections in this global context. The informal network is comprised of more than 80 data protection and privacy authorities from around the world.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

Click here to read the GPEN news release, with links to this year’s GPEN Sweep report (in English and French) found at the bottom of the news release.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The Office of the Information and Privacy Commissioner (OIPC) of Alberta has joined other data protection authorities from around the globe today to publish a Joint Statement on AI-Generated Imagery.

The statement represents the united position of 61 authorities. It has been issued in response to serious concerns about artificial intelligence (AI) systems that generate realistic images and videos depicting identifiable individuals without their knowledge and consent. The signatories are especially concerned about potential harms to children.

The statement outlines key expectations and fundamental principles for all organisations developing and using AI content generation systems including:

• To implement robust safeguards to prevent the misuse of personal information and the generation of non-consensual intimate imagery and other harmful materials, particularly where children are depicted.
• To ensure meaningful transparency about AI system capabilities, safeguards, acceptable uses and the consequences of misuse.
• To provide effective and accessible mechanisms for individuals to request the removal of harmful content involving personal information and to respond rapidly to such requests.
• To address specific risks to children through implementing enhanced safeguards and providing clear, age-appropriate information to children, parents, guardians and educators.

The co-signatories of the joint statement aim to share information on their approaches to addressing these concerns, including in the areas of enforcement, policy and education.

The statement has been coordinated by the International Enforcement Cooperation Working Group (IEWG) of the Global Privacy Assembly (GPA).

The Alberta OIPC has been actively advocating for appropriate safeguards on AI to protect Albertans from harm, including in comments during reviews of the Freedom of Information and Protection of Privacy Act, the Health Information Act (HIA) and the Personal Information Protection Act (PIPA). Specifically, this work includes:

• Comments to the Government of Alberta on regulation of AI in healthcare after reviewing proposed amendments to HIA, December 2025;
• Guidance on development of privacy impact assessments for use of AI Scribes, September 2025;
• Report for the Government of Alberta summarizing considerations and recommendations for a legal and policy framework to regulate the use of AI in Alberta, July 2025;
• Comments to the Government of Alberta on legislation replacing the FOIP Act, November 2024;
• Submission for the PIPA review, touching on AI and numerous building blocks for AI regulation, May 2024;
• Launch, along with other Canadian privacy regulators, of the Principles for Responsible, Trustworthy and Privacy-Protective Generative AI Technologies, December 2023; and
• Guidance for small custodians on the use of AI, November 2023.

Aside from the OIPC of Alberta, other Canadian signatories of today’s joint statement include the Office of the Privacy Commissioner of Canada, the OIPC for British Columbia, the OIPC for Newfoundland and Labrador, and the Commission on Access to Information of Quebec. International signatories are based in such areas as Europe, South and Central America, Australia, Asia and Africa.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The Office of the Information and Privacy Commissioner (OIPC) of Alberta is marking international Data Privacy Week by highlighting its ongoing work to protect the privacy rights of children and youth.

Data Privacy Week is celebrated around the world each year. In 2026, it takes place from January 26^th through January 30^th.

“In an increasingly digital world, children’s personal information is collected, used, altered, and shared in ways and on a scale that requires heightened care, accountability, and oversight,” said Information and Privacy Commissioner of Alberta Diane McLeod. “Children and youth are among the most vulnerable users of digital services, particularly when technology is used in education, or for social purposes. That said, I am pleased to see progress in terms of positive and necessary measures being taken. For example, Alberta’s new Protection of Privacy Act (POPA) designates children’s information as sensitive, requiring additional protection and due care. It is my hope and recommendation that upcoming changes to Alberta’s private sector privacy legislation will also further enhance privacy protection for children and protect them from associated harms. Protecting the privacy of children is a top priority for my office, as highlighted in my 2026-29 Business Plan.”

In recent years, the OIPC has undertaken and participated in various significant initiatives focused on children’s privacy. Some notable initiatives that took place in the last year are:

• In November 2025, the Alberta OIPC joined privacy regulators across Canada in issuing a joint statement on protecting the privacy of children and youth in the classroom through responsible educational technologies. The statement called on governments, school authorities, and technology providers to ensure that educational technologies are designed and used in ways that respect children’s privacy, minimize data collection, and provide meaningful safeguards.
• That same month, the Alberta OIPC published an investigation report into the PowerSchool privacy breach, which affected many schools and school boards in Alberta and elsewhere. The Alberta OIPC and its counterpart in Ontario coordinated their investigations to enhance collaboration and information-sharing in the handling of cross-jurisdictional investigations. The key focus of the investigations was on safeguarding students’ personal information. The resulting reports underscored the heightened obligations that organizations have when handling children’s personal information and the serious consequences that can arise from inadequate security practices. The Commissioners called on their respective governments to support the education sector by using their procurement lever to strengthen the bargaining power of educational bodies when negotiating agreements with edtech service providers, in order to enable educational bodies to meet their privacy law requirements.
• The Alberta OIPC participated in the 2025 Global Privacy Enforcement Network (GPEN) sweep, which focused on children’s privacy in online apps and educational technology. As part of the sweep, the OIPC of Alberta examined whether apps used by children in the province were providing clear information, limiting data collection, and offering appropriate protections for children and youth. The results of the sweep will be published in 2026.
• Also in 2025, the Alberta OIPC worked jointly with various provincial and federal counterparts on a joint investigation into TikTok. The investigation found that TikTok’s age-assurance measures and privacy protections were inadequate, and that advertisers were able to target youth, based on their profiles. The findings highlight systemic risks associated with platforms that fail to design services with children’s privacy in mind. Earlier work of the federal, provincial, and territorial privacy regulators promotes good privacy design practices and calls on organisations to prevent ‘deceptive design’ practices, which are used on websites and mobile apps to influence, manipulate, or coerce users to make decisions that are not in children’s best interests.

The Alberta OIPC regularly works with federal, territorial and other provincial privacy regulators to maximize the efficiency and impact of its work. Joint investigations, guidance development and resolutions allow regulators to address cross-jurisdictional privacy issues more effectively, particularly where children’s personal information is involved. The Alberta OIPC also participates in international groups, when doing so advances the interests of Albertans.

“Children deserve to learn and play without having their personal information misused or exploited, including while participating in online activities,” McLeod added. “They should not be subjected to harm due to the pursuit of profit by others. During Data Privacy Week, we re-affirm our commitment to work with partners in Alberta, across Canada, and internationally to ensure that children’s privacy remains at the centre of our privacy protection efforts.”

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca

The 2024-25 Annual Report of the Office of the Information and Privacy Commissioner (OIPC) of Alberta was tabled today by the Speaker of the Alberta Legislative Assembly and has now been published online by the OIPC.

“The 2024-25 fiscal year was one that saw good progress toward meeting our goals,” said Commissioner Diane McLeod. “Along with that, we tackled a number of complex challenges that took a great deal of time and resources to surmount.”

The office continued its ongoing work to streamline procedures for settlement of review and complaint files and for review of privacy impact assessments and breach reports. This is part of the work toward the Commissioner’s goal to enhance internal processes to support the office’s legislative mandate and improve timelines.

Legislative reform was a significant focus throughout the year because all three of the laws that set out the office’s mandate were under review.

“We were pleased to see the reviews undertaken, given that the laws are outdated and require modernization,” said McLeod. “However, undertaking reviews of all three laws in such a short period of time was a tremendous amount of work.”

The 2023-24 Annual Report outlined the major concern of abandoned health records. These cases continue to be on the rise, putting patients’ health information at risk. During the 2024-25 fiscal year, the OIPC began to see an uptick in the use of virtual care and artificial intelligence (AI) in the health sector, and the office devoted resources to understanding the associated benefits and risks and to providing education and guidance to custodians under the Health Information Act, as well as other Albertans. For example, the office developed a guidance document to help custodians meet their obligations regarding the use of such technologies, to provide deeper understanding of the privacy risks and to suggest ways to mitigate them.

There were a significant number of formal investigations generated by the Commissioner open and ongoing during 2024-25. A total of 163 formal investigations were open at the end of the fiscal year.

“These high numbers are partially due to the nature of some of the investigations,” commented McLeod. “In some cases they were ‘umbrella’ investigations including multiple files that are related to each other. One example is the systemic investigation into 27 Government of Alberta departments under the FOIP Act.”

The commissioner also launched 51 informal investigations in 2024-25, with 42 being the result of the PowerSchool breach involving educational bodies in Alberta.

The Commissioner added a new section to this year’s annual report to highlight an ongoing challenge with judicial reviews.

“Over the years, the number of judicial reviews of OIPC orders has generally been on the increase, resulting in significant demands on our resources,” said Mcleod. “Participating in these legal actions has cost the office about $3.5 million up to June of this year. This is a significant cost to taxpayers, which is even greater when one considers that the majority of the bodies who judicially review our orders are public bodies, whose activities are also paid for through taxes.”

The annual report addresses these and other issues in greater detail and describes the work of the office throughout 2024-25. The report is available on the OIPC website here.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca

Mobile: (587) 983-8766

www.oipc.ab.ca

The Information and Privacy Commissioner of Alberta, Diane McLeod, is raising concerns with the Government of Alberta about amendments to the Health Information Act (HIA), which were tabled in the Legislative Assembly of Alberta on November 24^th. The amendments are set out in Bill 11, the Health Statutes Amendment Act, 2025 (No. 2), and are currently being debated in the Legislative Assembly of Alberta.

The Commissioner has written a letter to the Minister of Primary and Preventative Health Services (PPHS), Adriana LaGrange, and the Minister of Hospital and Surgical Health Services, Matt Jones, who share responsibility for HIA. Earlier, on October 20^th, the Commissioner submitted comments and recommendations regarding proposed amendments to HIA as described in a policy document received from representatives of PPHS. The submission contained comments and 31 recommendations.

“I would like to acknowledge that several of my recommendations have been accepted, which I am pleased to see,” said McLeod. “For those recommendations not accepted, I have been informed by representatives of PPHS that most will be addressed through regulation and that PPHS will work with my office on the development of the regulations. We look forward to this engagement. That said, given the importance of privacy rights and for the sake of providing certainty to both custodians and the public, it is my view that these requirements should be codified in the Act, not in the regulations, as it is up to the legislature to establish the most important high-level principles that will guide the overall governance and accountability under HIA, which is quasi-constitutional legislation.”

The letter to the two ministers describes in detail positive aspects as well as gaps in the amendments being considered. Some of the gaps in the proposed legislation include the following.

• Sharing custodian model: HIA is being amended to permit shared custody and control of health information by sharing custodians. This is a new model not seen anywhere in Canada. Without adequate protections, it has the potential to create confusion across the health system, which in turn would create significant risks to Albertans’ health information and to their privacy rights under HIA. The amendments to HIA would not create an adequate governance structure and there would be no clear accountability for sharing custodians.
• Abandoned health records: It is positive to see provisions in Bill 11 to address abandoned health records, given that the number of records abandoned over the past few years has been significant. However, the provisions are not clear enough to set out what happens when ‘another person’ or a ‘regulatory college’ assumes custody or control of the records, so that an individual can exercise their right of access to records that have been transferred, including for ongoing care.
• Non-identifying health information: The amendments in Bill 11 would expand data-sharing between custodians and public bodies through a new authority in HIA that would permit disclosure of health information to a public body for data-matching and for common or integrated programs or services. There are also expanded authorities regarding the inputting of health information into an automated system. The Commissioner recommends that the definition of ‘non-identifying’ health information be strengthened in HIA to align with that found in the Protection of Privacy Act (POPA) because the definition in POPA is stronger and is more likely to ensure individually-identifying health information will truly be non-identifying prior to disclosure. In addition, POPA has a process built into the Act that public bodies must follow to ensure identifiable information is transformed into non-identifiable information so that it cannot be re-identified. The Commissioner also recommended that this be built into HIA. Such improvements would also promote harmonization between laws.
• Use of automated systems: The proposed changes to HIA include permissions for custodians to use health information in automated systems for decision-making, which include artificial intelligence (AI), as part of health services delivery. However, there are no corresponding privacy rights for individuals in the amendments that relate to use of these systems. The protection of these rights is now common in other modernized privacy laws which permit use of AI.
• Health care card modernization: Bill 11 proposes changes to enable adding personal health numbers (PHNs) of Albertans to driver’s licences or identification cards. The Commissioner previously recommended against use of PHNs on these types of cards because it creates risks, including fraud. The fraudulent use of someone’s PHN to access medical care could result in the wrong health information appearing in the person’s health record, which could cause them harm. A related concern is that the Registrar of Motor Vehicles, the branch that will be collecting this information to put it on driver’s licences or identification cards, is not subject to privacy laws in Alberta. As such, it will hold the highly-sensitive health information of all Albertans, with no corresponding duty to protect this information and no consequences for breaches. There is also no oversight by the Office of the Information and Privacy Commissioner (OIPC). Since Bill 11 was tabled, the OIPC has received more than 50 emails from Alberta citizens raising concerns about adding PHNs to driver’s licences.
• Enforcement: Considering the significant expansion of information-sharing proposed under the new sharing model and in other areas of the proposed HIA amendments, the Commissioner has recommended her office be given the authority to issue administrative monetary penalties to deter non-compliance, including by snoopers or by parties outside the health sector to which HIA applies. Such penalties are now becoming a common measure to deter non-compliance in modernized privacy laws, including in Ontario. Bill 11 does not provide this authority.
• Whistleblower protection: The Commissioner recommended that government ensure the whistleblower provisions are broad enough to facilitate disclosures to the Commissioner about any non-compliance with HIA and to ensure that the provisions protect the whistleblower from retaliation. Currently, there is no protection from retaliation built into the amendments. This gap must be addressed to broaden who can blow the whistle concerning any suspected or actual non-compliance with HIA and to include provisions to protect the whistleblower from retaliation. These provisions are necessary, especially in light of the new expanded sharing of health information and the new permitted uses of this information in HIA.

“HIA is an important piece of legislation that establishes the privacy rights of Albertans regarding their highly-sensitive health information,” added McLeod. “Any amendments must ensure these rights are upheld and strengthened as HIA expands the sharing and use of health information. I am pleased that the amendments address modern issues, including the use of technology to enhance delivery of public health services. However, advancing these policies must be balanced with adequate rights, so that individuals can continue to effectively control their own health information, which is the primary purpose of privacy laws. In my view, Bill 11 as it is currently before the legislative assembly does not effectively achieve this balance.”

McLeod is encouraging government and legislators to consider her comments and recommendations as Bill 11 makes its way through the legislative process.

Through the OIPC, the Information and Privacy Commissioner performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca

Mobile: (587) 983-8766

www.oipc.ab.ca

As Canada marks National Child Day, privacy authorities from across the country have issued a joint resolution to help ensure that privacy rights and the best interests of children are paramount in the development, procurement, and deployment of educational technologies (EdTech). The resolution was unanimously adopted at the annual meeting of Canada’s information and privacy regulators in Banff, Alberta, on October 8, 2025, hosted by the Information and Privacy Commissioner of Alberta.

Educational technologies have become deeply embedded in the way that education is delivered. They are now a central feature of Canadian classrooms particularly since their adoption increased exponentially during the COVID-19 pandemic.

EdTech includes technologies that support curriculum delivery, content engagement, attendance, and testing and assessment of students in elementary, secondary and post-secondary institutions.

However, they can also introduce new risks to privacy — especially for children and young people who have no choice but to use educational platforms that collect and use their personal information in the classroom. Such risks include significant data breaches, student profiling, biometric surveillance, and manipulative design.

The joint resolution affirms that the right to education and the right to privacy are fundamental and interdependent rights. It calls on governments to assume their responsibility for ensuring student privacy when assessing or authorizing EdTech; education institutions to protect privacy throughout the procurement process; and vendors to design privacy-protective tools that take the best interests of children into account.

Taking children’s best interests into account when procuring, designing or implementing EdTech means, among other things:

• Embedding privacy by design into products and services;
• Following data-minimization principles;
• Ensuring that safeguards are proportionate to the sensitivity of collected information;
• Avoiding design practices that would influence, manipulate or coerce users into making decisions that go against their privacy interests;
• Building in appropriate access controls and encryption;
• Establishing privacy settings to their most protective level by default;
• Prioritizing privacy protection when selecting educational technologies; and
• Funding and implementing digital education and privacy training and digital literacy skill development.

“This joint resolution, passed in early October, follows strong statements in previous years on this topic made by myself and my privacy colleagues across the country,” said Diane McLeod, Alberta Information and Privacy Commissioner. “It also supports one of the key goals of my office. My business plan states that one of my highest priorities is to identify, facilitate and support opportunities to enhance access and privacy education and protections for children and youth. The importance of this goal is highlighted by the investigation reports issued earlier this week by my office and the Office of the Information and Privacy Commissioner of Ontario into the massive PowerSchool privacy breach involving schools in both provinces, as well as educational bodies around the world. More than 700,000 individuals in Alberta were affected by this breach, including students, staff and parents/guardians. Our investigation reports made critical recommendations to reduce privacy risks and ensure privacy is enhanced and protected as schools continue to utilize EdTech, which also provides many benefits to students and schools. Similarly, this resolution calls on governments, schools, school boards, administrators, post-secondary institutions, and EdTech vendors to take actions that will help all parties effectively navigate the risks for a safe, secure and responsible digital education experience.”

Quick facts

• Canada’s privacy authorities include federal, provincial and territorial information and privacy commissioners and ombuds responsible for privacy law oversight.
• National Child Day is celebrated in Canada and many countries around the world on November 20 to acknowledge the importance of children’s rights. It commemorates the day in 1989 when children’s human rights were recognized in the United Nations Convention on the Rights of the Child.

Through the OIPC, the Information and Privacy Commissioner of Alberta performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

Related links

• Resolution: Protecting the privacy of children and youth in the classroom through responsible educational technologies
• Provincial and territorial collaboration

For more information, contact:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766
www.oipc.ab.ca

Ontario and Alberta Information and Privacy Commissioners have released the findings of their investigations into a massive privacy breach involving PowerSchool education technology (edtech) used by schools in their respective provinces.

The incident, which affected millions of Canadians across the country, highlights the importance of educational bodies, including school boards, maintaining high standards for protecting sensitive personal information of their students and educators, including when using service providers.

Although they issued separate investigation reports, the Ontario and Alberta commissioners coordinated their investigations under a memorandum of understanding to enhance collaboration and information-sharing in the handling of cross-jurisdictional investigations. Both reports have key findings in common, including that some or all of the educational bodies:

• failed to include certain privacy and security-related provisions in their contractual agreements with PowerSchool to ensure that the educational bodies meet the requirements of applicable provincial public sector privacy law;
• lacked policies and procedures to effectively monitor and oversee PowerSchool’s technical and security safeguards to ensure the company complied with its contractual terms and conditions, including in respect of user access privileges for remote support personnel and the use of multi-factor authentication;
• failed to limit remote access to their student information systems by PowerSchool support personnel for only as long as necessary to address specific technical issues; and,
• lacked adequate breach response plans or protocols.

The Ontario and Alberta commissioners made recommendations to address the findings in their respective reports, including that the educational bodies:

• review and, as needed, renegotiate agreements with PowerSchool to include the recommended privacy and security-related provisions to ensure that the educational bodies meet the requirements of applicable provincial public sector privacy law;
• implement effective monitoring and oversight over PowerSchool’s technical and security safeguards to ensure they are compliant with applicable provincial public sector privacy law and leading industry standards, including by conducting a privacy impact assessment of their student information system;
• limit remote access to their student information systems on an as-needed basis only; and
• ensure they have adequate policies and procedures to respond to breaches in the future.

Both Ontario and Alberta commissioners call on their respective governments to support the education sector by using their procurement lever to strengthen the bargaining power of educational bodies when negotiating agreements with edtech service providers and that will enable educational bodies to meet their privacy law requirements. The commissioners also call on their respective governments to provide educational bodies with the technical guidance or assistance needed to assess the privacy and cybersecurity posture of edtech vendors. This would assist educational bodies in carrying out their monitoring and oversight responsibilities.

“One of my office’s highest priorities is to identify, facilitate and support opportunities to enhance access and privacy education and protections for children and youth,” said Diane McLeod, Information and Privacy Commissioner of Alberta. “The investigation reports from my office and the office of my counterpart in Ontario establish beyond a doubt that the risks to privacy caused by the PowerSchool breach were significant, for both the students as well as the adults affected. It is essential to remember that privacy does not happen on its own. It requires a concerted effort by public bodies to create and implement policies and procedures that ensure privacy is protected. There is no way around this. It simply must be done. I believe the recommendations in our reports, including those to government, set out a path that, if followed, will ensure that appropriate actions are taken.”

“This type of sector-wide coordination and cooperation among school boards, strongly supported by our respective governments, would strengthen contract negotiations with edtech service providers, as well as the oversight and monitoring measures necessary to ensure compliance with their obligations under the Acts,” said Patricia Kosseim, Information and Privacy Commissioner of Ontario. “Most importantly, such efforts would provide students, their parents and guardians, and educators with the personal information protection they deserve and an education system they can trust.”

Through the OIPC, the Information and Privacy Commissioner of Alberta performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

Learn more:

• Investigation Report from Alberta OIPC
• Investigation Report from Ontario OIPC

For more information, contact:

Office of the Information and Privacy Commissioner of Alberta
Elaine Schiman
Communications Manager
communications@oipc.ab.ca
Mobile: (587) 983-8766
www.oipc.ab.ca

Office of the Information and Privacy Commissioner of Ontario
media@ipc.on.ca
www.ipc.on.ca

In an era where false and misleading information can spread rapidly and influence public discourse, Canada’s federal, provincial, and territorial information commissioners and ombuds (FPT Information Regulators) are urging governments and public institutions to modernize access to information laws, proactively disclose records, and ensure the integrity of public information.

The call comes in a joint resolution, entitled “Trust, transparency, and democracy in a era of misinformation”, which was passed at the annual meeting of FPT Information Regulators responsible for overseeing access to information. The meeting was held in Banff in early October, hosted by the Office of the Information and Privacy Commissioner of Alberta.

The resolution calls upon governments to promote a more robust information ecosystem.

“Rapid changes in technology, the advent of AI, and a growing tendency to spend a significant amount of time online have meant that people are exposed every day to misinformation and disinformation,” said Information and Privacy Commissioner of Alberta, Diane McLeod. “This means that citizens can often have difficulty knowing what to believe. As information regulators, we are tackling this problem in a wide range of ways. A key element is encouraging governments to provide information about their operations that is accurate, reliable and easy to access.”

“In today’s digital world, Canadians are bombarded with information every day—some of it true, some of it not. When governments are transparent and information is easy to access, people can make informed decisions about their health, their communities, and their democracy. This resolution is about protecting the public’s right to know and building trust in the institutions that serve them,” said Caroline Maynard, Information Commissioner of Canada.

Misinformation thrives in environments where transparency is lacking. “By embracing transparency and proactively making accurate information available to the public, public institutions can play a crucial role in strengthening our collective information ecosystem, countering misinformation, enhancing trust, and preserving the integrity and resilience of democratic societies”, states the resolution.

Access to government-held information matters to Canadians. Whether it’s understanding how public health decisions are made, accessing environmental data, or verifying the facts behind government policies, reliable information empowers Canadians to make informed choices. When institutions are transparent and information is easy to access, citizens are better equipped to engage in public life, challenge misinformation, and hold decision-makers accountable. Transparency is key to a healthy democracy.

The resolution outlines specific recommendations, including:

• Codifying a duty to document and setting minimum standards for proactive disclosure;
• Ensuring public institutions have the resources to effectively run their access and transparency programs;
• Supporting media and civil society in promoting the public’s right to know, and
• Enhancing digital and media literacy and regulating online platforms for greater transparency.

The regulators also commit to improving their own transparency practices, collaborating with other oversight bodies, and reducing delays in access to information processes.

In recent years, related joint resolutions focused on restoring trust through access to government records (2023) and promoting transparency by default in public service delivery (2024).

Through the OIPC, the Information and Privacy Commissioner of Alberta performs the responsibilities set out in Alberta’s access to information and privacy laws, the Access to Information Act, the Protection of Privacy Act, the Freedom of Information and Protection of Privacy Act during the transition period, the Health Information Act, and the Personal Information Protection Act.  The Commissioner operates independently of government.

Related documents:
Joint resolution: Trust, transparency, and democracy in an era of misinformation

News release: Canada’s information and privacy regulators wrap up meeting that focused on critical access and privacy issues facing Canadians

For more information:

Elaine Schiman
Communications Manager
Office of the Information and Privacy Commissioner of Alberta
communications@oipc.ab.ca
Mobile: (587) 983-8766

www.oipc.ab.ca