See also:
The purpose of this document is to provide parties with a summary of the procedures under which reviews and investigations are conducted by the Office of the Information and Privacy Commissioner (OIPC) and the anticipated date for completion of the reviews and investigations.
Please note that our office made some adjustments to our procedures on April 1, 2024, in the interest of creating greater efficiencies in our work. This page has been updated to reflect those changes.
Forms referenced in this document are available on our office’s website at www.oipc.ab.ca under the Forms tab.
Also, please note that some important definitions are provided at the bottom of this page.
Commissioner’s Mandate
The Commissioner is not a part of the Government of Alberta. The Commissioner is an independent Officer of the Legislature and reports directly to the Alberta Legislative Assembly.
Through the OIPC, the Commissioner performs the legislative and regulatory responsibilities set out in the Freedom of Information and Protection of Privacy Act (FOIP Act), the Health Information Act (HIA) and the Personal Information Protection Act (PIPA).
What We Do…
- review the decisions of public bodies, health custodians, and private sector organizations in response to requests for access to information or correction of personal/health information made under the Acts
- investigate complaints regarding the collection, use or disclosure of personal or health information
- under PIPA, investigate complaints about whether an organization is in compliance with the Act, such as enquiries into an organization’s general practices
- conduct inquiries and issue binding orders
What We Do Not Do…
- act as an advocate on behalf of any party to a review or investigation
- release records that are the subject of a review
- store records on behalf of the Government of Alberta or any other party
- impose fines or award damages
- hear appeals of claims, benefits or decisions that do not fall under the Acts
- discipline, terminate or reinstate employees
- regulate the actions of individuals as private citizens
- regulate the constituency offices of members of the legislative assembly (but we do regulate access and privacy issues involving actions of cabinet members and ministries)
Making a Request for Review or Complaint to the Commissioner
Under the Acts:
- an applicant may ask the Commissioner to review any decision, act or failure to act by the public body, custodian or organization that relates to an applicant’s access to information request or request for correction
- a complainant may ask the Commissioner to investigate if they believe that personal/health information has been collected, used or disclosed in contravention of the Acts
- a third party who has been notified by a public body under the FOIP Act that its information will be given to an applicant may ask the Commissioner to review that decision
An applicant/complainant must complete and submit a Request for Review/Complaint Form to the OIPC within the following timelines:
FOIP Act and HIA
Within 60 days after they are notified of the decision by the public body or custodian (FOIP Act and HIA) or become aware of an incident involving the collection, use and disclosure of personal/health information.
PIPA
Within 30 days from the day that they are notified of the decision by the organization. [Note: Incidents involving the collection, use and disclosure of personal information under PIPA must be delivered to the Commissioner within a reasonable time period.]
The Commissioner may allow for reviews or complaints to be submitted outside of the time limits above, based on the circumstances.
FOIP and Third Parties
A third party must complete and submit a Request for Review/Complaint Form to the OIPC within 20 days after being notified by a public body of its decision to give an applicant access to third party information. The Commissioner has no power to allow a third party a longer period than 20 days to submit a request for review.
Note this important process change for public bodies and third parties:
As of February 1, 2024, the OIPC no longer conducts courtesy searches on behalf of public bodies to determine if a third party request for review has been received by this office. The provision of this service is not a responsibility of the OIPC under the FOIP Act and as our office works to streamline and improve our processes to provide better service to Albertans in the areas of our legislated responsibilities, the provision of this courtesy service has been discontinued. Sections 30 and 31 outline the statutory obligations of public bodies and third parties under FOIP. Public bodies and third parties should communicate directly with each other respecting these statutory obligations. In their written notice, public bodies may advise third parties that if the third party decides to ask for a review under section 31(3), and if the third party does not want to risk inadvertent disclosure of information by the public body, that third party should directly notify the public body that it has asked for a review.
Overview of Proceedings
- Intake
Applicants and complainants must provide a completed Request for Review/Complaint Form and all supporting documents in one submission. Otherwise, the submission will be returned. We also enforce a 15-page limit for submissions.
The Request for Review/Complaint Form is checked for:
- jurisdiction (is it something the OIPC can do under one of the three Acts?)
- whether it was received by the OIPC within the required time limits
- whether there is evidence that substantiates the request for review or complaint
Applicants/complainants will be contacted at the intake stage to discuss their submission and obtain clarification. They must be available to participate in our process and respond to requests in a timely manner, usually by phone and/or email. Otherwise, a file may not be opened.
The responding public body, custodian or organization may also be contacted at this stage, as required.
Please note our new refer-back process for privacy complaints and adequacy of search reviews which applies to submissions received on or after April 1, 2024.
Refer-back for privacy complaints: For complaints regarding the collection, use or disclosure of personal or health information, the OIPC will usually refer a complainant back to the public body, custodian or organization, if the complainant has not already given the entity an opportunity to resolve the complaint.
Refer-back for adequacy of search reviews: For reviews where the only concern is that an applicant believes the public body, organization or custodian holds more responsive records than what were processed in the request (the OIPC calls this an ‘adequate search concern’), the applicant will usually be told to submit the concern directly to the entity first, along with supporting evidence as to why they believe additional records exist.
We require that the entity be given at least 30 business days to respond before the applicant/complainant can bring the concern back to our office. At that point, our office will consider whether further investigation by the OIPC is warranted.
Issue identification: Working with the applicant/complainant, the OIPC will identify the review or complaint issues at the intake phase. Only those issues that (a) have enough evidence; and, (b) are within our jurisdiction will move forward. Those issues will be communicated to the applicant/complainant to confirm their understanding and, if applicable, to advise on the limits of our jurisdiction.
If the OIPC proceeds with a review or investigation, a file is opened and an acknowledgment letter (containing the confirmed issues) is issued to the applicant/complainant and the public body/custodian/organization. A copy of the Request for Review/Complaint Form and any attachments to the Form are included with the letter.
In the letter to the public body/custodian/organization, it will be asked to provide a contact person who will be responsible for working with the assigned investigator to settle the matter. The contact person must have the ability to settle the issues. This means that they must have timely access to the decision-maker or directly involve the decision-maker in the conversations.
Request for Review/Complaint Form and Attachments Must Be Disclosed
A copy of the Request for Review/Complaint Form, and accompanying attachments, will be provided to the public body/custodian/organization and to anyone else the Commissioner believes is affected by the request.
Applicants and complainants must identify to the OIPC if there is specific information in the Request for Review/Complaint Form or accompanying attachments that should not be disclosed.
Address for Service
Each party must provide an address for service to which all official communications will be sent for the purposes of the review/investigation.
As noted above, we must have an effective and timely means of communication with the parties. As such, our preference is for each party to provide us with an email address for this purpose. We also require a mailing address to deliver certain correspondence related to the file. We will use secure email for any email communications containing sensitive information.
Applicant/Complainant
The address for service is to be identified on the Request for Review/Complaint Form.
Public Body/Custodian/Organization
The address for service of the public body/custodian/organization will be identified in the acknowledgement letter that the OIPC sends to each party as part of the initial notification process.
Changes or Updates
A party must use the Change of Contact and/or Address for Service Form to update contact information or the address for service at any time during the review/investigation.
The address for service of each party will be circulated to all other parties.
- Review and Investigation
An OIPC investigator, known as a Senior Information and Privacy Manager (SIPM) will be assigned to try to settle your request for review or privacy complaint.
The office receives a high volume of requests for reviews and complaints. As such, your file may be inactive until the SIPM has the capacity to begin to work on it. The parties will be notified when the SIPM starts actively working on the file. While the parties wait to hear from the SIPM, we encourage the parties to try to resolve the matter directly with one another.
Our new case resolution process involves us trying to settle matters under review or investigation in as short a time as is possible. That is why we try to settle matters verbally over the phone. As such, once a file is activated, we must be able to reach the parties, usually by phone, in a timely manner in order to participate in our case resolution process. If we cannot reach the applicant/complainant, we may discontinue the review or investigation. If this occurs, the parties will be notified.
The SIPM begins the review or investigation by examining the confirmed issues, the submission of the applicant/complainant and, in the case of a review of an access request, the records provided by the public body/custodian/organization. The SIPM also reviews the relevant law and any past cases that have interpreted the law against the issues to be determined.
The SIPM will contact the public body/custodian/organization (respondent) to gather any relevant evidence necessary to form an opinion about whether the law was complied with by the respondent.
The SIPM may also need to contact the applicant/complainant for additional information. Please note that we will not accept documented evidence from an applicant/complainant unless it is requested by the SIPM. Any unsolicited evidence will be returned or deleted.
The SIPM will form an opinion about whether the respondent has complied with the law as it relates to the issues under review or investigation. The SIPM will discuss the opinion with the parties in an effort to settle the issues. The respondent may agree to take certain actions in order to remedy any non-compliance.
Any resolution reached will be documented in writing and sent to the parties. As applicable, the SIPM will ensure that any agreed-upon terms are followed by the respondent.
- Inquiries
If any or all of the issues are not settled and the applicant/complainant wants to proceed further in our process, the SIPM will work with the parties to determine any agreed-upon facts. The file will then be brought to the Commissioner to determine whether an inquiry will proceed, only on those unsettled issues.
The Request for Inquiry form used in the past will no longer be used.
Once the file is transferred to the Commissioner, the SIPM will close the file at the case resolution stage.
Inquiries are formal adjudicative proceedings. The inquiry process is not an examination of the process or an evaluation of the findings and recommendations made during the review and investigation process. The inquiry gives the parties an opportunity to present their evidence “de novo” (from the beginning) and to rebut or support evidence presented by the other party.
The Commissioner may refuse to conduct an inquiry in certain circumstances:
- the subject matter has been dealt with, in an order or investigation report of the Commissioner
- the circumstances warrant refusing to conduct an inquiry (for instance, if there is no meaningful remedy)
A decision to refuse to conduct an inquiry will be issued to the parties in writing.
If any unsettled issues proceed to inquiry, a Notice of Inquiry will be issued to the parties. The Notice of Inquiry will confirm the issues for the inquiry and the schedule for the required submissions. The Notice of Inquiry will include a copy of the Request for Review/Complaint Form and attachments.
Note: Under FOIP and HIA, a complaint that is not about the complainant’s own personal/health information cannot proceed to inquiry.
- Affected Parties and Intervenors
Some inquiries may include “affected parties”. An affected party is any other party who, in the opinion of the Commissioner, is affected by the request for review or complaint. A copy of the Request for Review/Complaint Form and attachments may be provided to the affected party.
An affected party may make representation to the Commissioner at inquiry, but is not required to participate.
In certain cases, the Commissioner may give intervenor status to parties, if the Commissioner determines it is appropriate. An intervenor can be useful in bringing a broader perspective to issues than the parties involved.
- Order
On completing an inquiry, the Commissioner or delegated adjudicator must issue an Order disposing of the matter.
An Order made by the Commissioner or delegated adjudicator is final. However, a party may apply to the Court of King’s Bench of Alberta for judicial review of an Order.
Timelines
Under FOIP and HIA, the Commissioner is to complete a review within 90 days after the OIPC received the request for review/complaint unless that period is extended by the Commissioner.
PIPA allows the Commissioner to complete a review/investigation within one year from the day that the request for review/complaint was received by the OIPC. PIPA also allows the Commissioner to extend that period.
Parties will be notified as to the anticipated date for completion and any extensions to the anticipated date for completion.
For estimated timelines for case resolution, see investigation timelines at: https://oipc.ab.ca/request-a-review-file-a-complaint/.
Definitions
- Applicant – a person who makes an access to information request or a request for correction of their personal/health information
- Complainant – a person who believes their personal or health information has been collected, used or disclosed in contravention of one of the Acts
- Custodians – health entities subject to HIA
- Organizations – private sector entities subject to PIPA
- Public Bodies – public sector entities subject to FOIP
- Third Party – a person, a group of persons, or an organization other than an applicant or a public body
If you have any questions with respect to the OIPC review/investigation process, please contact the OIPC.
April 2024