.png){kind=small}
This is an unofficial version. If you need an official copy, use the bilingual (PDF) version.
Search this document and show paragraphs with hits
You can use wild cards:
'*' allows for 0 or more characters (eg. ceas* will match 'cease', 'ceased', 'ceasing' and 'ceases')
'?' allows for 0 or 1 character (eg. cease? will match 'cease', 'ceases' and 'ceased', but not 'ceasing')
This search is not case sensitive.
S.M. 2021, c. 43
Bill 49, 3rd Session, 42nd Legislature
The Freedom of Information and Protection of Privacy Amendment Act
|
Explanatory Note This note was written as a reader's aid to the Bill and is not part of the law. This Bill amends The Freedom of Information and Protection of Privacy Act. The following are the key changes: the time for responding to a request for access is extended to 45 days from 30 days, and the period for extensions permitted under the Act is also increased to 45 days; a person's request for access may be considered abandoned if they fail to provide information requested of them that is necessary to process the request; a public body may disregard requests for information already provided, or requests that amount to an abuse of the right to make a request; specific exceptions to disclosure for labour relations information and workplace investigations are provided; a person may seek to correct their personal information without first having to request access to the information, and the process for correcting personal information is streamlined; people are to be notified if there is a real risk they will be significantly harmed as a result of a privacy breach concerning their personal information; employees of a public body may notify the Ombudsman if they reasonably believe the body is treating personal information in an unauthorized manner, and no adverse actions may be taken against them for doing so; the Ombudsman is authorized to disclose personal information if necessary to protect a person's mental or physical health or safety; records more than 100 years old are to be made available without a request, if practicable; the types of records that are to be made available without an application for access are expanded, and the minister responsible for the Act can direct education bodies, government agencies and health care bodies to make additional categories of records available; the provisions respecting offences and prosecutions are updated; the Act is to be reviewed every 5 years. Other administrative amendments are included. |
(Assented to May 20, 2021)
HER MAJESTY, by and with the advice and consent of the Legislative Assembly of Manitoba, enacts as follows:
The Freedom of Information and Protection of Privacy Act is amended by this Act.
Subsection 1(1) is amended
(a) in clause (b) of the definition "head", by adding "or the individual who is responsible for performing functions similar to those normally performed by the chief executive officer of a corporation" at the end; and
(b) by replacing clause (b) of the definition "personal information" with the following:
(b) the individual's address, telephone or facsimile number or e-mail address,
Subsection 6(1) is replaced with the following:
Part does not apply to individual's personal health information
This Part does not apply to a record or part of a record to which an individual seeks access if the record contains the individual's own personal health information.
Deemed request under Personal Health Information Act
If an individual makes a request for access to a record under section 8 that contains their own personal health information, the request or the part of it that relates to their information is deemed to be a request under section 5 of The Personal Health Information Act, and that Act applies as if the request had been made under that section.
Subsection 6(2) is renumbered as section 6.1.
Subsection 8(2) is replaced with the following:
A request must be made in writing and must provide enough detail to enable an experienced officer or employee of the public body to identify the record with a reasonable effort.
Subsection 8(3) is amended, in the part before clause (a), by striking out "An applicant" and substituting "Despite subsection (2), an applicant".
Subsection 11(1) is amended, in the part before clause (a), by striking out "30 days" and substituting "45 days".
Subsection 11(2) of the English version is amended by striking out "30 day period" and substituting "45-day period".
Subclause 12(1)(c)(iii) is amended by striking out "business telephone number" and substituting "contact information".
The following is added after section 12:
The head of a public body may require an applicant to provide additional information in relation to an application, including requesting additional information that is necessary to identify a requested record.
A request from the head must be given to the applicant in writing.
Information to be provided within 30 days
An applicant has up to 30 days from the day the request is given to provide the additional information, and if the additional information is not provided within that time, the head may determine that the applicant has abandoned the application.
Effect of request on time limits
When a request is given to an applicant under this section, the time within which the head is required to respond under subsection 11(1) is suspended until the applicant provides the additional information.
If the head determines that the application has been abandoned, the head must notify the applicant in writing of the determination, and of the applicant's right to make a complaint about the determination to the Ombudsman under Part 5.
Subsection 13(1) is replaced with the following:
Public body may disregard certain requests
The head of a public body may disregard a request for access if the head is of the opinion that
(a) the request is trivial, frivolous or vexatious;
(b) the request is for information already provided to the applicant;
(c) the request amounts to an abuse of the right to make a request because it is
(i) unduly repetitive or systematic,
(ii) excessively broad or incomprehensible, or
(iii) otherwise not made in good faith; or
(d) responding to the request would unreasonably interfere with the operations of the public body.
In making a determination under clause (1)(c) or (d), the head of a public body may take into account
(a) the number of requests made by the same applicant; or
(b) whether the request is reasonably related to requests that have been made by two or more applicants who are associated within the meaning of the regulations.
Subsection 15(1) is amended
(a) by repealing clause (a);
(b) by replacing clause (b) with the following:
(b) responding within the time period set out in section 11 is unreasonable because of
(i) the large number of records requested or that must be searched, or
(ii) the number of requests made by the applicant or by two or more applicants who are associated within the meaning of the regulations;
(c) in clause (c), by adding ", or to obtain legal advice," after "public body"; and
(d) by striking out "or" at the end of clause (c) and adding the following after clause (d):
(e) the applicant consents to the extension; or
(f) exceptional circumstances warrant the extension.
Subsection 16(1) is amended, in the part before clause (a), by striking out "seven days" and substituting "10 days".
Subsection 16(2) is amended
(a) in the section heading, by striking out "30 days" and substituting "45 days"; and
(b) in clause (b),
(i) by striking out "30 days" and substituting "45 days", and
(ii) by striking out "or notice is given to a third party under section 33".
Subsection 17(2) is amended by striking out "or" at the end of clause (h) and adding the following after clause (h):
(h.1) disclosure could reasonably be expected to reveal personal information about the applicant that a third party provided in confidence to the applicant's employer, and the disclosure could reasonably be expected to reveal the identity of the third party; or
Subsection 17(4) is amended
(a) in clause (e), in the part before subclause (i), by striking out "travel" and substituting "employment"; and
(b) by replacing clause (h) with the following:
(h) the information is about an individual who has been dead for 25 years or more;
(h.1) the information concerns a deceased individual and is disclosed to a relative of the deceased or an individual with whom the deceased shared a close personal relationship, if the head of the public body is satisfied that in the circumstances the disclosure is desirable for compassionate reasons; or
The following is added after subsection 17(4):
On refusing to disclose personal information under clause (2)(h.1), the head of the public body must give the applicant a summary of the information unless a summary cannot be prepared without revealing the identity of a third party who provided the personal information.
Subsection 20(3) is replaced with the following:
Subsections (1) and (2) do not apply if
(a) the record is more than 20 years old; or
(b) the government, local public body, organization or agency that provided the information
(i) consents to the disclosure, or
The centred heading before section 27 is replaced with "LEGAL PRIVILEGE".
Subsection 27(1) is amended
(a) by replacing the section heading with "Privileged information"; and
(b) in clause (a), by striking out "solicitor-client privilege" and substituting "any type of legal privilege, including solicitor-client privilege and litigation privilege".
Subsection 27(2) is amended by striking out "solicitor-client" and substituting "legal" in the section heading and in the section.
The following is added after section 29 and before the centred heading that follows it:
LABOUR RELATIONS INFORMATION
Disclosure harmful to public body's labour relations
The head of a public body may refuse to disclose information to an applicant if
(a) disclosure would reveal labour relations information of the public body as an employer;
(b) the information was prepared by or supplied to the public body, explicitly or implicitly, on a confidential basis and treated consistently as confidential information by the public body as an employer; and
(c) disclosure could reasonably be expected to
(i) harm the competitive position or interfere with contractual or other negotiations of the public body as an employer,
(ii) result in significant financial loss or gain to the public body as an employer,
(iii) result in similar information no longer being supplied to the public body when it is in the public interest that similar information continue to be supplied, or
(iv) reveal information supplied to, or the report of, an arbitrator, mediator, labour relations officer or other person or body appointed to resolve or inquire into a labour relations dispute.
WORKPLACE INVESTIGATIONS
Information relating to workplace investigations
The head of a public body may refuse to disclose information to an applicant if
(a) the information relates to an ongoing investigation by or on behalf of the public body into the employment-related conduct of an employee; or
(b) the information was created or collected for the purpose of such an investigation, regardless of whether the investigation took place, and disclosure of the information could reasonably be expected to cause harm to the applicant, a public body or a third party.
Subsection 32(1) is amended by striking out "90 days" and substituting "60 days".
The following is added after subsection 32(1):
Despite subsection (1), the head of a public body may refuse to disclose to an applicant information that will be made available to the public under section 76.2.
Subsection 32(2) is amended
(a) in the part before clause (a), by striking out "subsection (1)" and substituting "subsection (1) or (1.1)"; and
(b) in clause (b),
(i) by striking out "90 days" and substituting "60 days", and
(ii) by striking out "90 day period" and substituting "60-day period".
The following is added after subsection 34(1):
Consideration of third party representations
When making a decision, the head of the public body must consider any response received from the third party, if such a response is received within 20 days after notice is given under subsection 33(1).
The following is added after subsection 34(3):
Access with third party's consent
If the head of the public body decides to give access to the record or part of the record and the third party has consented to the disclosure, the notice under subsection (2) must inform the applicant that access to the record or part of the record is granted and where, when and how access will be given.
Subsection 34(4) is replaced with the following:
Complaint about decision to give access
If the head of the public body decides to give access to the record or part of the record without the consent of the third party, the notice under subsection (2) must state that
(a) the third party may make a complaint to the Ombudsman under Part 5 within 21 days after the notice is given; and
(b) the applicant will be given access to the record upon completion of the 21-day period, unless, within that period, the third party
(i) makes a complaint under Part 5, and
(ii) gives notice of the complaint being made to the head of the public body.
Subsection 34(5) is amended by striking out "21 days" and substituting "60 days".
Clause 37(2)(c) is amended by striking out "title, business address and telephone number" and substituting "title and contact information".
Subsection 39(1) is replaced with the following:
An individual who believes there is an error or omission in a record containing their own personal information may request the head of the public body that has the information in its custody or under its control to correct the record.
The following is added after subsection 39(2):
Public body may disregard certain requests
The head of a public body may disregard a request for correction on any ground on which the head may disregard a request for access under section 13, and section 13 applies with necessary changes to the decision.
Subsection 39(3) is amended
(a) in clause (a), by striking out "the applicant of the correction" and substituting "the individual in writing of the correction"; and
(b) by replacing clause (b) with the following:
(b) notify the individual in writing of the following:
(i) the head's refusal to correct the record,
(ii) the reason for the refusal,
(iii) the individual's right to add a statement of disagreement to the record,
(iv) the individual's right to make a complaint about the refusal under Part 5.
The following is added after subsection 39(4):
The head of a public body who refuses to make a correction requested under this section must
(a) permit the individual to file a concise statement of disagreement stating the correction requested and the reason for the correction; and
(b) add the statement of disagreement to the record in such a manner that it will be read with and form part of the record or be adequately cross-referenced to it.
No entitlement to file statement
Subsection (4.1) does not apply to a request that the head of a public body has disregarded under subsection (2.1).
Subsections 39(5) and (6) are amended by striking out "request for correction" wherever it occurs and substituting "statement of disagreement".
The centred heading before section 40 is amended by adding "AND SECURITY" after "RETENTION".
Section 41 is amended by striking out "making reasonable security arrangements" and substituting "adopting reasonable administrative, technical and physical safeguards".
The following is added after section 41 as part of Division 2 of Part 3:
The following definitions apply in this section.
"privacy breach" means, in relation to personal information,
(a) theft or loss; or
(b) access, use, disclosure, destruction or alteration in contravention of this Act. (« atteinte à la vie privée »)
"significant harm" includes, in relation to an individual, bodily harm, humiliation, damage to the individual's reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the individual's credit rating or report, and damage to or loss of the individual's property. (« préjudice grave »)
Notifying individual of privacy breach
The head of a public body that has custody or control of personal information about an individual must notify the individual about a privacy breach relating to the information if, after considering the relevant factors prescribed by regulation, the breach could reasonably be expected to create a real risk of significant harm to the individual.
Notice to the individual must
(a) be given as soon as practicable after the privacy breach becomes known to the head of the public body;
(b) be given in the form and manner, and include the information, required by the regulations; and
(c) be given directly to the individual except in circumstances set out in the regulations, in which case it may be given indirectly in the form and manner required by the regulations.
If the head of a public body is required to notify an individual about a privacy breach under subsection (2), the head must also notify the Ombudsman at the time and in the form and manner that the Ombudsman requires.
Disclosure of unauthorized activity to Ombudsman
An employee of a public body who believes in good faith that the public body is collecting, using, disclosing, retaining, concealing, altering or destroying personal information in contravention of this Act may notify the Ombudsman.
In notifying the Ombudsman, the employee must not disclose personal information unless the Ombudsman requests it.
An employee is not liable to prosecution for an offence under this Act for disclosing personal information requested by the Ombudsman under subsection (2).
An employee who notifies the Ombudsman under subsection (1) may request that the Ombudsman keep the employee's identity confidential, in which case the Ombudsman must take reasonable steps to protect the identity of the employee.
The following is added after subsection 42(3):
Subsections (2) and (3) apply to the name of an applicant and to any other personal information concerning a request for access to a record.
Subsection 44(1) is amended
(a) in clause (w) of the English version, by striking out "Legislature" and substituting "Legislative Assembly"; and
(b) in clause (z), by adding "or to an individual with whom the deceased shared a close personal relationship," after "deceased individual".
Section 49 is amended by striking out "and" at the end of clause (i), adding "and" at the end of clause (j) and adding the following after clause (j):
(k) exchange information with a person who, in respect of Canada or another province or territory, has duties and powers similar to those of the Ombudsman under this Act or under The Personal Health Information Act, and enter into information sharing and other agreements with such a person for the purpose of co-ordinating activities and handling complaints involving the jurisdictions.
Subsections 50(1) and (2) are amended by adding "or audit" after "investigation".
Section 52 is amended by adding "or audit" after "investigation" in the section heading and in the section.
Subsection 53(1) is amended, in the part before clause (a), by adding "or audit" after "investigation".
Section 54 is amended by adding "or audit" after "investigation".
Section 55 is amended by adding the following after subsection (3):
Disclosure to prevent risk of harm
The Ombudsman may disclose information to any person if the Ombudsman reasonably believes that the disclosure is necessary to prevent or lessen a risk of serious harm to the health or safety of the individual the information is about or to another individual.
Subsection 59(1) is amended by striking out ", including a refusal to make a correction under section 39".
Subsection 59(3) is replaced with the following:
An individual may make a complaint to the Ombudsman if the individual believes that their own personal information
(a) has been collected, used or disclosed in violation of Part 3; or
(b) has not been protected in a secure manner as required by Part 3.
An individual who has requested a correction under section 39 may make a complaint to the Ombudsman about any decision, act or failure to act of the head of the public body that relates to the request, including a refusal to make the correction.
Subsection 59(4) is amended by striking out "A relative of a deceased" and substituting "An".
Subsection 60(1) is replaced with the following:
A complaint to the Ombudsman must be made in writing and must be in a form acceptable to the Ombudsman.
Subsection 60(2) is replaced with the following:
A complaint under subsection 59(1), (3.1) or (4) must be delivered to the Ombudsman within 60 days after the person complaining is notified of the decision.
21-day limit for complaint by third party
A complaint under subsection 59(2) must be delivered to the Ombudsman within 21 days after notice of the decision is given to the third party.
Clause 66(6)(a) is amended by striking out "subsection 59(1), (2) or (4)" and substituting "subsection 59(1), (2), (3.1) or (4)".
Subsection 66.5(3) is replaced with the following:
Clause 67(2)(b) is replaced with the following:
(b) in the case where the Ombudsman's report contains recommendations respecting the complaint, the deadline set out in subsection 66.1(4) for the Ombudsman to request the adjudicator to review the matter has expired, and the Ombudsman did not request a review.
The following is added before section 76:
Notice of the receipt of a request made under section 8 being received must be made publicly available on a website by the head of the following public bodies, within 14 days of the request being received:
(a) a department;
(b) a government agency that is subject to The Crown Corporations Governance and Accountability Act;
(c) the Executive Council Office;
(d) the office of a minister;
(e) an educational body, a government agency or a health care body that is designated in the regulations.
A notice must provide a summary of the request received, but the notice must not include the name of an applicant or information that is subject to an exception to disclosure under Part 2.
This section does not apply to a request made by an individual seeking access to a record containing the individual's own personal information.
The following is added after subsection 76(1):
Records more than 100 years old
If reasonably practicable, records that are more than 100 years old are to be specified under this section.
The following is added after section 76.1:
The Executive Council must make the following available to the public within the time specified:
(a) as soon as reasonably practicable, an order in council;
(b) within 30 days, any letter or revised letter in which the President of the Executive Council establishes the mandate of a minister.
The government must make the following available to the public within the time specified:
(a) within 60 days after a minister assumes office, the table of contents and index for the package of briefing materials that is prepared for a minister for the purpose of enabling the minister to assume the powers, duties and functions of their office;
(b) within 60 days after the estimates of a department are concurred with by the Assembly,
(i) the table of contents and index for the package of briefing materials that the department prepared for the minister concerning the department's estimates, and
(ii) the content of the package of briefing materials that is not otherwise subject to an exception to disclosure under Part 2.
A government agency that is subject to The Crown Corporations Governance and Accountability Act and an educational body, government agency or health care body that is designated in the regulations must make the following records available to the public without an application for access under this Act:
(a) employee codes of conduct;
(b) employee engagement surveys and a summary of the survey results;
(c) summaries of the total annual amount of out-of-province transportation and travel expenses incurred by
(i) each member of the board of management, board of directors or governing board, and
(ii) the chief executive officer or equivalent;
(d) a summary of respectful workplace reports and statistics for each year, including the number of respectful workplace complaints received, the number of investigations conducted and, unless otherwise subject to an exception to disclosure under Part 2, the outcomes of the investigations and related disciplinary actions taken;
(e) records or a category of records as directed by the responsible minister.
The government must make the following records available to the public without an application for access under this Act:
(a) employee codes of conduct;
(b) employee engagement surveys and a summary of the survey results;
(c) a summary of respectful workplace reports and statistics for each year, including the number of respectful workplace complaints received, the number of investigations conducted and, unless otherwise subject to an exception to disclosure under Part 2, the outcomes of the investigations and related disciplinary actions taken;
(d) records or a category of records as directed by the responsible minister.
A directive issued under clause (1)(e) or (2)(d) must be in writing, and a public body that receives a directive must comply with it.
A directive must not be made in respect of a record or a category of records that contain personal information, unless the information, if disclosed, would not constitute an unreasonable invasion of an individual's personal privacy under Part 2.
Minister may obtain information for publication
The responsible minister may direct a public body to provide the minister with a copy of any record that the public body is required to publish or otherwise disclose under an enactment.
A directive issued under subsection (1) must be in writing, and a public body that receives a directive must comply with it.
The minister must make the information provided under subsection (1) publicly available on a website.
Clause 79(c) of the French version is replaced with the following:
c) par un fondé de pouvoir agissant en vertu d'une procuration donnée par le particulier, si l'exercice de ces droits ou pouvoirs sont liées aux attributions que la procuration confère;
Subsection 82(1) is replaced with the following:
The head of a public body may require an applicant to pay to the public body the fees provided for in the regulations.
Subsection 82(6) is amended by striking out
"search, preparation, copying and delivery".
The following is added after subsection 82(6):
The head of a public body must give the applicant written notice if their application is considered abandoned under subsection (3).
Subsection 85(1) is amended
(a) in clause (a), by adding "collects, uses or" before "discloses";
(b) by adding the following after clause (a):
(a.1) gains access, or attempts to gain access, to personal information in contravention of this Act;
(a.2) fails to comply with section 41.1 (notification of privacy breach);
(c) by replacing clause (d) with the following:
(d) destroys, erases, conceals, alters or falsifies a record that is subject to this Act with the intent to evade a request for access to records;
(d) by adding "or" at the end of clause (e) and adding the following after clause (e) and before the part that follows it:
(f) helps another person, or counsels another person, to do anything mentioned in clauses (a) to (e);
Subsection 85(2) is replaced with the following:
A prosecution for an offence under this Act may not be commenced later than two years after the day on which evidence sufficient to justify a prosecution for the offence came to the knowledge of the Ombudsman. The certificate of the Ombudsman as to the day on which the evidence came to their knowledge is evidence of that date.
Subsection (2) applies to an offence committed before or after the coming into force of this subsection.
Section 86 is replaced with the following:
Defence under other enactments
A person is not guilty of an offence or subject to disciplinary action of any kind under any other enactment by reason of
(a) complying with a request or requirement to produce a record or provide information or evidence to the Ombudsman or the adjudicator, or a person acting for or under the direction of the Ombudsman or the adjudicator, under this Act; or
(b) in good faith, giving a notification or disclosing information to the Ombudsman under section 41.2.
A public body or a person acting on behalf of a public body must not take any adverse employment action against an employee as a result of the employee doing any of the things described in clause (1)(a) or (b).
Section 87 is amended
(a) by adding the following after clause (b):
(b.1) prescribing circumstances in which two or more people are considered to be associated for the purpose of clause 13(1.1)(b) and subclause15(1)(b)(ii);
(b) by adding the following after clause (g):
(g.1) for the purpose of subsection 41.1(2), prescribing relevant factors to be considered in determining if a privacy breach can reasonably be expected to create a real risk of significant harm;
(g.2) for the purpose of subsection 41.1(3), specifying the form and manner of, and the information to be included in, a notice to an individual, whether given directly or indirectly, and prescribing the circumstances in which a notice may be given indirectly;
(c) by adding the following after clause (k):
(k.1) designating educational bodies, government agencies and health care bodies for the purpose of clause 75.1(1)(e) or subsection 76.3(1);
Subsection 98(1) is replaced with the following:
Review of Act within five years
The responsible minister must undertake a comprehensive review of the operation of this Act, which involves public representations, within five years after the day on which this section comes into force.
TRANSITIONAL AND COMING INTO FORCE
In this section, "former Act" means The Freedom of Information and Protection of Privacy Act as it read immediately before the coming into force of this section.
A request for access to a record received under the former Act and a complaint made under the former Act must be dealt with under the former Act as if this Act had not come into force.
This Act comes into force on a day to be fixed by proclamation.