In Part 2 of our introduction to Alberta’s proposed new public sector privacy legislation, we explore Bill 34: the Access to Information Act (“AIA”).  The AIA along with the Protection of Privacy Act (“POPA”) are intended to replace Alberta’s Freedom of Information and Protection of Privacy Act (“FOIPPA”). The AIA aims to modernize rules and processes for accessing records from public bodies in Alberta, but like POPA does not represent a wide-scale reframing of access to information rights in Alberta.

Public bodies will be happy to see a number of changes including additional tools to handle challenging access to information requests (the “Access Request”) upon receipt. Certain amendments also aim to promote dialogue between individuals seeking access to information and the public body to resolve disputes that may arise from an Access Request. Although two separate pieces of legislation have been created to govern the protection of privacy and access to information, the Office of the Information and Privacy Commissioner will remain a single office with regulatory oversight.

Additional Exemptions to Access

Exemptions to access (i.e. records that would not fall under the scope of the AIA and will not be subject to access requests) have largely stayed the same. Common exceptions like information in a court file, quality assurance records, certain records of quasi-judicial bodies (like draft decisions) have been carried over from FOIPPA.

A new exemption has been created for “a record of communication between political staff, or a member of Executive Council and political staff that does not involve any other employee of a public body”. The term “political staff” is yet to be defined, and the section as a whole will likely attract future scrutiny by the OIPC. Communications falling within this exemption overlap with existing exceptions to access like communications containing advice, recommendations, consultations and deliberations, but the exception will create another layer of analysis when communications of a political nature are being sought.

Initial Management of Access Requests

Public bodies now have 30 business days rather than 30 calendar days to respond to an access request. While the change is not insignificant, public bodies that were previously struggling to meet the 30-calendar day target likely needed more than a couple of extra weeks to respond to an access request.  Regardless, this change will provide some additional breathing room for public bodies.

Perhaps more significant is the power given to public bodies to extend timelines for an additional 30 business days and then for “additional reasonable periods” in certain circumstances. FOIPPA analysts for public bodies may shed a small tear of happiness as one circumstance is when “a large number of records are requested and more time is required to process the request”.

As counsel for numerous public bodies, we have seen increasingly broad access requests over the years that have caused significant operational impacts. The number of records that public bodies now have custody or control over are much more significant with the introduction of the electronic age over the last few decades. No longer are public bodies simply pulling physical files to respond to access requests, but they need to review multiple electronic repositories. Even electronic communications have ventured beyond simply email.  Other mechanisms of communications like Teams, and other chat applications are now widely used and may need to be search in response to an Access Request (this raises the importance of records management which we will not bore you with today).

On a final note with respect to extensions, the AIA grants an automatic extension to the public body for responding to requests where there is an emergency, disaster, or other event causing unplanned operational interruptions (notice must be provided to the Commissioner as soon as practicable).

Public Body has Power to Disregard an Access Request

Another change that will be viewed favourably by public bodies is the ability to disregard an Access Request without application to the OIPC under certain circumstances. These circumstances include instances where the Access Request would “unreasonably interfere with the operations of the public body”, where the request is “otherwise overly broad or incomprehensible” or when “the information the request relates to has already been provided to the applicant”. 

A long-standing tenant in prior OIPC orders is that the access regime under FOIPPA does not alter discovery mechanisms in other processes like civil litigation or administrative hearings. For example, a vexatious litigant in civil litigation proceedings was entitled to make Access Requests despite the broad nature of document discovery rules under the Alberta Rules of Court. Public bodies now arguably have the tools to put a stop to this and place the onus on the Applicant to seek relief from the OIPC if they feel a public body’s decision to disregard their request was unfair.

Despite these new tools, public bodies ought not to forget about their duty to assist applicants. When handling an overly broad request, a public body will have a duty to communicate with the applicant and narrow the scope of the request or better understand what the applicant is looking for.

Privileged Records

Public bodies may continue to withhold records containing privileged information (like s. 27 of FOIPPA, this includes a record that is subject to “any type of legal privilege including solicitor-client privilege or parliamentary privilege”).

The Privacy Commissioner has long desired the ability to access privileged records to exercise her duties, including during a review or inquiry. That wish has not been granted by the AIA.  Rather, the AIA codifies the Privacy Commissioner’s inability to seek production of privileged records from a public body.

Therefore, the status quo is preserved. Public bodies will not have to hand over privileged records to the OIPC if they are at issue during a review or inquiry but can expect a request for a listing and description of those records pursuant to the OIPC’s Privilege Practice Note.

Takeaways

These are exciting time for privacy and access to information professionals in Alberta (your definition of excitement may differ from ours). The AIA contains amendments that will hopefully promote meaningful access rights to Albertans while streamlining administrative processes that have been longstanding issues within public bodies.  At the same time, if the AIA operates as intended, it will also free up resources within the OIPC as a greater onus is placed on public bodies to resolve disputes with individuals as they seek access to information.

It's important to stay informed about Alberta’s evolving privacy and access laws to ensure your organization is prepared for the changes under the AIA. If you need guidance on navigating these updates or managing access requests effectively, contact Marc Yu in Edmonton, Kelly Nicholson in Calgary or any member of our Privacy + Data Management Group for support and compliance strategies.