Public Sector Privacy Law (applies to public bodies)

Protection of Privacy Act

The Protection of Privacy Act (POPA or Act) applies to public bodies in Alberta. Public bodies include government ministries or departments, government agencies, boards and commissions, school boards and charter schools, universities and colleges, municipalities, and police.

POPA went into force in June of 2025. It replaced the privacy part of Freedom of Information and Protection of Privacy Act (FOIP Act). The FOIP Act is no longer in force in Alberta and has been repealed.

POPA protects privacy by controlling the ways a public body may collect, use or disclose personal information. No personal information may be collected by or for a public body unless the collection is:

• Authorized by another law or enactment
• For purposes of law enforcement
• Information that relates to and is necessary for an operating program or activity of the public body including a common or integrated program or activity

Your personal information must be collected directly from you subject to certain exceptions and when collected in this manner, you must be notified about the purpose of collection. Once collected, your personal information may be used or disclosed for the intended purpose of collection. Your personal information may be used or disclosed for other purposes in some situations, such as when you consent. A public body must also protect your personal information from loss or unauthorized access or disclosure and must notify you about a breach involving your personal information if there is a real risk of significant harm to you as a result of the breach.

You have rights under POPA as it relates to your personal information, including that information collected about you must be reasonably accurate, you have the right to access your personal information, and you can make a complaint if you believe that your personal information is being collected, used or disclosed contrary to the Act.

Under POPA, public bodies are permitted to data match personal information to create additional personal information. This is called “derived data” under POPA. Public bodies are also permitted to modify personal information so that it can no longer identify an individual. This is referred to in the Act as “non-personal data”. Derived data and non-personal data are subject to the Act, meaning that the Information and Privacy Commissioner has oversight of this data. If you believe that the process used to create derived data or non-personal data is not in accordance with the Act, you can make a complaint to the Commissioner.

It is an offence for a person to collect, use or disclose personal information contrary to the Act, to perform data matching contrary to the Act, and to reidentify or attempt to reidentify personal information from non-personal data.

See below for more information about exercising your privacy rights under POPA.

For more information on submitting a privacy complaint, click here.

Back to top of the page

Health Sector Privacy Law (applies to custodians)

Health Information Act

The Health Information Act (HIA or Act) applies to “custodians”,  such as government departments responsible for health services in Alberta, provincial health agencies (Recovery Alberta, Assisted Living Alberta, Acute Care Alberta, Primary Care Alberta), hospital services (Alberta Health Services, Covenant Health, Lamont Health Care Centre), pharmacies and pharmacists, physicians, optometrists, registered nurses, dentists, and their health service providers or employees.

HIA protects privacy by controlling the ways a health custodian may collect, use or disclose health information, including diagnostic, treatment, care and registration information. Custodians are prohibited from collecting, using, or disclosing health information unless permitted by the Act.

Your health information may be used and disclosed by custodian for the purposes of providing you with health care including to other health care providers or other persons who may be involved in your health care. Your health information may also be used or disclosed for the purposes of managing the public health care system in Alberta and for making certain of your health information accessible electronically to those authorized to have this access. The electronic health care record in Alberta is called “Netcare”.

Custodians must consider your expressed wishes when deciding how much information to disclose to others and for making it accessible through Netcare. What this means is that if you inform your health care provider that you don’t want all of your health information, or certain kinds of information, such as highly sensitive health information, accessible by others, you can express this wish to a custodian and they must consider it before making the specified health information accessible.

If you were to express your wish to a custodian that you do not want your health information accessible through Netcare, the custodian could “mask” this information so that other care providers cannot access this information unless they “break the glass”, which means they may unmask it. Generally, this would only occur with your consent or in circumstances where you cannot give your consent due to your medical condition.

Your health information may also be disclosed with your consent. If disclosure of your health information is authorized without your consent, you have the right to ask about it. You also have the right to request a record – also known as an “audit log”. Requesting an audit log of Netcare accesses will show you who has accessed your health information in Netcare.

A custodian is required to protect your health information from loss, unauthorized access or disclosure and must notify you if your health information is involved in a breach and you are at risk of significant harm as a result of the breach.

In addition to the rights mentioned, you have the right under the HIA to request a correction of health information (not opinions), you have the right to access your health information and you can make a complaint if you believe that your health information has been collected, used, accessed or disclose contrary to the HIA.

It is an offence in the HIA to collect, use, access or disclose health information contrary to the HIA and to fail to protect health information as required by the Act.

See below for more information about exercising your privacy rights under HIA.

For more information on submitting a privacy complaint, click here.

Back to top of the page

Private Sector Privacy Law (applies to private organizations)

Personal Information Protection Act

The Personal Information Protection Act (PIPA or Act) applies to private organizations, such as businesses, employees, partnerships, trade unions and professional regulatory bodies.

PIPA protects privacy by controlling the ways a private organization may collect, use or disclose personal information and personal employee information.

Private sector organizations must have your consent to collect, use or disclose your personal information. Collection, use or disclosure without consent is authorized in some situations under PIPA. In addition to having consent, an organization must also have a reasonable purpose for this activity. The Act specifies that what is reasonable is what a reasonable person would consider appropriate in the circumstances.

If you are an employee, consent is not required for the collection, use or disclosure of personal employee information by the employer that is reasonably required for the  work relationship.

A private sector organization is required to protect your personal information from loss, unauthorized access and use or disclosure and must notify you about a breach of your personal information if you face a real risk of significant harm from the breach.

You have rights under PIPA, including the right to request access to your own personal information. You may make a complaint to the Information and Privacy Commissioner if you believe that your personal information has been collected, used, disclosed, accessed inappropriately or breached. You may also make a complaint to the Commissioner if you believe that an organization’s practices are not in compliance with PIPA.

It is an offence under PIPA for an organization, to collect, use, disclose or attempt to gain access to your personal information contrary to the Act.

See below for more information about exercising your privacy rights under PIPA.

For more information on submitting a privacy complaint, click here.

Back to top of the page

Exercising your Privacy Rights

Complaints about the collection, use or disclosure of your own personal information

If you believe your personal or health information has been collected, used, or disclosed improperly under POPA, HIA, or PIPA, you may submit a complaint in writing to the Office of the Information and Privacy Commissioner (OIPC). Before submitting your privacy complaint to the OIPC, you must first make your complaint to the public body, custodian or private organizations (as applicable).

Your written complaint must provide enough detail to support your belief that your personal or health information has been collected, used or disclosed in contravention of the law.

The Commissioner may assign a staff member to try and informally resolve your complaint (referred to as the settlement phase). If the matter is not resolved during the settlement phase, the Commissioner will decide if the matter will go inquiry. An inquiry is a formal hearing that results in an order being issued. An order made by the OIPC is final.

General complaints about non-compliance with privacy laws (not your own personal information)

You may also submit a general complaint under POPA in the following two circumstances: POPA Privacy/Correction Request form

1. You believe a public body created personal information from matching (or linking) two or more sources of personal information (this is referred to in POPA as data derived from data matching) contrary to the requirements for this activity as specified in POPA.
2. You believe there has been an actual or attempted reidentification of data by a person after personal information has been rendered as non-identifiable by a public body as required by POPA or its regulations.

You may also submit a general complaint under PIPA if you believe that an organization’s practices for protecting privacy as required by this Act are not in compliance. PIPA Request for Review/Complaint form

Back to top of the page

About the OIPC

The Information and Privacy Commissioner is responsible to monitor compliance with Alberta’s privacy laws to ensure their purposes are achieved. The work of the Commissioner is performed through the Office of the Information and Privacy Commissioner.

The Commissioner has broad authority under these laws to investigate allegations of non-compliance and to issue binding orders to enforce compliance. The Commissioner also has a number of additional responsibilities under these laws including advocating for privacy rights of Albertans. The Commissioner is an officer of the Legislature and in this capacity operates independently from government ministers and departments.

Disclaimer This document is not intended as, nor is it a substitute for, legal advice, and is not binding on the Information and Privacy Commissioner of Alberta. Responsibility for compliance with the law (and any applicable professional or trade standards or requirements) remains with each organization, custodian or public body. All examples used are provided as illustrations. The official versions of the laws the OIPC oversees and their associated regulations should be consulted for the exact wording and for all purposes of interpreting and applying the legislation. The Acts are available on the website of Alberta King's Printer.

Back to top of the page

Public Sector Access Law (applies to public bodies)

Access to Information Act

The Access to Information Act (ATIA or Act) applies to public bodies in Alberta. Public bodies include government ministries or departments, government agencies, boards and commissions, school boards and charter schools, universities and colleges, municipalities, and police.

ATIA went into force in June of 2025. It replaced the access to information part of the Freedom of Information and Protection of Privacy Act (FOIP Act). The FOIP Act is no longer in force in Alberta and has been repealed.

Under the ATIA, you have the right to:

• Request access to any information contained in a record that is in the custody or control of a public body, including your personal information, subject to limited and specific exceptions set out in the law
• Ask the OIPC to review a public body’s decision to withhold information from you in response to your access to information request
• Ask the OIPC to review when a public body has not responded to your access request within timelines or if you dispute a time extension the public body has taken to respond to your request
• Ask the OIPC to review a decision to release your personal or business information in response to another access request
• Ask the OIPC to review fees the public body has charged, estimated, or refused to waive in connection with your access request
• Ask the OIPC to review when a public body has disregarded or declared your request abandoned

To make an access request, submit it in writing to the public body that you think has the information. Provide enough detail to help find the information. You can ask to look at or receive a copy of the records.

An initial fee of $25 may be required when requesting access to general information. Additional fees may be charged depending on the extent of the request. You must be provided with an estimate of fees and you must accept the fees before your request is processed.

A fee does not apply to requesting your personal information except for the cost of producing a copy of the record. The fees that can be charged are set out in a Schedule to the ATIA Regulation. Fees can be waived in some situations, and you may ask the OIPC to review a decision to charge a fee.

There is no fee associated with asking the OIPC to review a decision made by a public body.

Back to top of the page

Health Sector Access Law (applies to custodians)

Health Information Act

The Health Information Act (HIA or Act) applies to “custodians”, such as the four government departments responsible for health services in Alberta, provincial health agencies (Recovery Alberta, Assisted Living Alberta, Acute Care Alberta, Primary Care Alberta), hospital services (Covenant Health, Lamont Health Care Centre), pharmacies and pharmacists, physicians, optometrists, registered nurses, dentists, and their health service providers or employees.

Under HIA, you have the right to:

• Request access to your own health information from a health custodian
• Ask the OIPC to review a health custodian’s decision to withhold information from you in response to your request for health information
• Ask for a correction of your health information
• Ask the OIPC to review a health custodian’s response to your request to correct your health information

To make an access request, submit it in writing to the health custodian that you think has the information. Provide enough detail to help find the information. You can ask to look at or receive a copy of the records.

An initial fee of $25 may be required when requesting access to a record containing health information. Processing of a request will not start until the $25 fee is paid, if applicable. Additional fees may be charged depending on the extent of the request. You must be provided with an estimate of fees and you must accept the fees before your request is processed.

A fee does not apply to requesting your health information except for the cost of producing a copy of the record. The fees that can be charged are set out in a Schedule to the HIA Regulation. Fees can be waived or reduced in some situations. You may ask the OIPC to review a decision to charge a fee.

There is no fee associated with asking the OIPC to review a decision made by a public body.

Back to top of the page

Private Sector Access Law (applies to private organization)

Personal Information Protection Act

The Personal Information Protection Act (PIPA) applies to private sector “organizations”, such as businesses, employees, partnerships, trade unions and professional regulatory bodies.

Under PIPA, you have the right to:

• Request access to your own personal information from an organization. The organization may refuse access to your personal information in certain circumstances prescribed by PIPA. Instead of requesting access, you can choose instead to request information about the use or disclosure of your personal information by the organization.
• Ask for a correction of your personal information
• Ask the OIPC to review a private sector organization’s response to your request for access or correction

To make an access request, submit it in writing to the private sector organization that you think has the information. Provide enough detail to help find the information.

You are not able to ask for general information about an organization, for example financial statements of a condominium corporation. You can only ask for information that is about you. You can also ask to look at or receive a copy of the records.

You may be charged a fee for processing your request. No fees can be charged if requesting your information as an employee. You must be provided with an estimate of fees and you must accept the fees before your request is processed.

You may ask the OIPC to review a decision to charge a fee or how an estimate was created.

There is no fee associated with asking the OIPC to review a decision made by a private sector organization.

Back to top of the page

About the OIPC

The Information and Privacy Commissioner enforces how Alberta’s access to information laws are applied to ensure the purposes are achieved. The Commissioner reports to all members of the Legislative Assembly of Alberta and is independent from government ministers and departments

You may ask the OIPC to:

• Review a public, health or private sector organization’s decision that relates to your request to access information, including a failure to respond, a time extension, or in the case of ATIA, if the public body has disregarded or abandoned your request.
• Review a response to your request for correction
• Review a public body’s decision to release information about you in response to another access request (ATIA Act only)

To ask for a review of your request for access information or a correction request under HIA and PIPA, you must:

• Send your request to the OIPC in writing within the timelines set out in the laws
• Provide the OIPC with a copy of your request for access or correction and a copy of the response to your request.

For more information on submitting a request to review a response to an access to information request under ATIA, HIA or PIPA, click here.

For more information on submitting a request to review a correction request, click here.

Back to top of the page

June 2025