Notice – Changes to Review Processes – Access to Information Act and Protection of Privacy Act

In mid-June 2025, the Freedom of Information and Protection of Privacy (FOIP) Act will be replaced by two new laws: the Access to Information Act (ATIA) and the Protection of Privacy Act (POPA).

The Office of the Information and Privacy Commissioner (OIPC) is revising its review processes for both the settlement and inquiry phases to support its responsibilities under the new statutes.

Under both ATIA and POPA, a review conducted by the OIPC generally consists of two phases, 1) a settlement phase where the Case Resolution Team works with the parties to try and settle a matter under review, and 2) the inquiry phase where the review file transitions to the Adjudication Team, or other delegate of the Commissioner, to issue an order if a matter under review cannot be settled. Under both laws, the Commissioner has discretion about whether to send a request for review for settlement. If the Commissioner decides not to exercise this discretion, the matter will proceed directly to inquiry which will occur for certain case types determined for expedited inquiries.

This notice is split into two areas concerning changes to the review processes for settlement and inquiries, including expedited inquiries on the following case types: requests to disregard, time extensions and abandoned access request decisions.

The OIPC will update and publish summaries from time to time of its procedures on its website.

Why are we instituting these changes?

ATIA and POPA introduce new requirements and impose limits on the time for the OIPC to complete the review process under the Acts. To meet those time limits, the office has taken steps to identify and minimize delays in the review process. This has necessitated these changes.

ATIA and POPA specify timelines within which a review must be completed. They are 180 business days with another extension of up to 180 business days that may be taken by the Commissioner. The OIPC considers this time frame to be directory rather than mandatory, meaning that the OIPC does not automatically lose jurisdiction if the review or inquiry takes longer than the 180 business days allowed for each. This is based on established statutory interpretations.  (See Peters v East 3rd Street North Vancouver Limited Partnership, 2023 BCSC 879 (CanLII), at paragraph 27; Rahman v. Alberta College and Association of Respiratory Therapy, 2001 ABQB 222 (CanLII); Alberta (Information and Privacy Commissioner) v. Alberta Teachers Association 2011 SCC 61 (CanLII)).

Nevertheless, the Legislature has clearly identified timeframes it considers acceptable for completing reviews under the ATIA and POPA. The new review processes discussed below are designed to meet those deadlines in every case possible.

Back to top of the page

How will these changes affect the parties?

These changes affect the expectations and requirements of public bodies, applicants, complainants, and other parties participating in these processes. Parties will be expected to be prepared to participate in the review process in a timely manner.

The result is that the OIPC  may not be able to accommodate requests for lengthy extensions to deadlines to provide records, submissions, responses to recommendations and other documentation. Efforts will be made to accommodate the needs of parties where the new time limits allow.

Back to top of the page

Key Changes – Case Resolution

The settlement phase of a review is a process authorized by the Commissioner to explore opportunities for resolution with the parties. The majority of cases are sent to the Case Resolution Team who are responsible for trying to settle all matters under review in a timely manner. Below are some key changes being made to the settlement process (Those marked * will apply to reviews under all of Alberta’s access and privacy laws).

New time limits and when the review is “received” to start the review

The Acts set out 180 business days to complete an inquiry with the opportunity for another 180 business day extension.  This applies to the time taken when the Commissioner authorizes a staff member to try and settle the matter under review.

A maximum of 180 business days will be allotted to the settlement phase prior to inquiry. If resolution cannot be achieved in whole or in part, the matter will be moved to the Commissioner to decide whether the matter will proceed to inquiry at which time the Commissioner will take the 180 day extension to complete the inquiry.

How will the OIPC count the 180 business days timeline for completion?

The OIPC considers a review to be “received” under section 60(1) of ATIA and section 39(1) of POPA and the 180 business days timeline starts once we have determined that:

• we have jurisdiction to conduct the review, and
• the OIPC has confirmed the issues for review in writing with the applicant or third party.

Refer to our Practice Note – Business Day – ATIA and POPA for the interpretation of “business days” under ATIA and POPA.

Third party requests for review will proceed directly to inquiry

Because affected parties are often brought in to participate, such as the applicant to the original access request, these requests for reviews are less conducive to the informal settlement process. As such, these cases will proceed directly to inquiry.

Providing records to the OIPC within 7 business days *

When a case is opened by the OIPC, a letter will be sent electronically by a new secure file transfer application to the parties which will set a timeline for the records to be provided.

The Public Body will be required to provide a copy of records to the OIPC with the inclusion of a records index within 7 business days of the date of the Commissioner’s notification letter relating to the review.  The Index of Records is, at a minimum, a listing of the page numbers and the corresponding section numbers used to withhold records or information in a record.

The OIPC will provide a link that respondents must use to securely send records and any other sensitive documentation to the OIPC.

For instructions on providing records at issue see Practice Note – Preparing Records at Issue and Index of Records.

Request for copy of access request (if missing) and any correspondence in public body file that may assist in the review *

Sometimes the applicant does not have a copy of the access request.

If that is the case, we may be asking the public body to provide the OIPC with a copy of the access request and any correspondence concerning the request with the applicant in the initial notification letter when it provides the records at issue to the OIPC

Late raising of discretionary exceptions to access

The request for review is not an opportunity for the public body to reprocess the access request and apply more discretionary exceptions.

The OIPC will not consider any late raising of discretionary exceptions under ATIA at the settlement phase after the acknowledgement letter is issued because, at that time, we have confirmed the issues with the applicant.

See Practice Note – Late Raising of Discretionary Exceptions – ATIA

Explanation needed for supporting the withholding of records that are not provided to OIPC

In the settlement phase, if the public body decides not to provide the OIPC with records or information described in section 50(6) of ATIA (sections 4(1)(a), (s), (t), (w), section 27 cabinet confidences,  section 32 legal privilege), we will require the page numbers and an explanation that supports the application of the sections to any record or information not provided to the OIPC as described in that section.

Back to top of the page

What will remain the same

The OIPC will continue with the processes introduced in spring of 2024 to help increase efficiency and decrease the time it takes to review a matter.  Those include:

• a refer back process for privacy complaints that have not been provided to the public body before coming to the OIPC for review (sections 38(2) and 41(2)(b) POPA);
• a refer back process for single issue ‘adequacy of search’ reviews to allow public bodies the opportunity to respond before the matter is dealt with by our office (section 62(2)(b) ATIA)
• identification of complaint and review issues by the OIPC at the intake phase with the applicant/complainant;
• a requirement that the public body be asked to provide a contact person, with the ability to settle the issues, who will be responsible for working with the OIPC investigator to settle the matter; and
• discussions between the OIPC investigator (Senior Information and Privacy Manager or SIPM) and the contact for the public body, custodian, or organization over the phone or a virtual platform to try to settle the matter.

Back to top of the page

Key Changes –Inquiries

The inquiry process is a formal adjudicative process. Most inquiries are conducted in writing. The applicant or complainant who requested the review, and the public body are parties to the inquiry, and will be given an opportunity to provide a submission. Below are some key changes being made to the inquiry process.

Inquiries to be conducted electronically

Inquiries will generally be conducted by email or other electronic means as determined by the Commissioner. Parties will be asked to provide an email address for receiving inquiry correspondence.  We will use secure email for any email communications containing sensitive information.

Exceptions will be made for individuals who cannot participate by email. An individual must request that an exception be made in their case.

Submissions

In order to streamline the inquiry process, the number of submissions will be reduced. If the Commissioner or adjudicator has further questions after reviewing the submission of each party, further information will be requested.

Deadline extension requests

Requests to extend deadlines for providing submissions will be considered in some circumstances; however, only short extensions may be accommodated due to the shorter timelines to complete an inquiry under the ATIA and POPA.

Late-raising of discretionary exceptions to access at inquiry

Where a public body has applied a new discretionary exception to access under the AITA that was not considered during that process, the adjudicator will determine at the inquiry stage whether the public body should be permitted to apply that exception.

Expedited inquiry process

In some circumstances, a request for a review may be streamlined to an expedited inquiry process. In general, the following requests for review may proceed to an expedited inquiry:

• a public body’s decision to extend its time to respond
• a public body’s decision to disregard a request; or
• a public body’s decision that a request was abandoned

A public body’s failure to respond to an access request may also be streamlined directly to an expedited inquiry process.

The expedited inquiry process generally involves bypassing the settlement phase, condensing the usual inquiry process, including shortening submission schedules, and a strict adherence to timelines

Back to top of the page

Transition period from the FOIP Act to the ATIA and POPA

 It is expected that ATIA and POPA will be proclaimed to be in force in June 2025. However, access and privacy reviews started under the FOIP Act must be reviewed under that same statute.

There will be a period of time in which the OIPC will be dealing with the FOIP Act and the new ATIA and POPA.  To assist in determining which statute will be involved, applicants will be expected to provide the OIPC with the date an access request was submitted to a respondent.  Complainants will be similarly queried to help establish which statute the privacy complaint will fall under.

Please see Practice Note -Transitional Provisions – FOIP Act to ATIA and POPA on how we are interpreting the transition periods under ATIA and POPA.

Back to top of the page