Written By Stephen Burns, Sebastien Gittens and David Wainer

On June 11, 2025, two new pieces of legislation in Alberta came into effect: (1) the Protection of Privacy Act; and (2) the Access to Information Act. Both pieces of legislation are expected to significantly impact public-sector privacy obligations, and were originally introduced on November 6, 2024, through Bills C-33¹ and C-34², respectively.

Key Changes Under the Protection of Privacy Act³

With respect to public-sector privacy legislation in Alberta, among other things, the Protection of Privacy Act will impact how public bodies may collect, use and disclose personal information by:

• requiring privacy to be a key consideration in information management and program and services design (a "privacy by design" approach);⁴
• mandating that, if a public body intends to use personal information in an automated system in order to "generate content or make decisions, recommendations or predictions," that intention must be disclosed;
• outlining circumstances in which a public body may link information between two or more sets of data (data matching) and rules surrounding same;
• allowing public bodies to create and use non-personal data for certain purposes, including research and analysis or planning, administering, delivering, managing, monitoring or evaluating a program or service;
• requiring all public bodies to adopt a privacy management program that must be made available to the any person upon request;
• explicitly prohibiting public bodies from selling personal information; and
• creating a new privacy impact assessment regime.

In addition, the Protection of Privacy Act also increases the fees and penalties which may be imposed upon those who breach the Act. Some exemptions apply to records held by the courts, as well as a select group of other types of records held by public bodies.

Key Changes Under the Access to Information Act⁵

The Access to Information Act will change how individuals may access records and information held by public bodies. Some of these key changes include:

• allowing a public body to disregard a request for information if the request: (1) would unreasonably interfere with the operations of the public body; (2) is abusive, threatening, frivolous or vexatious; (3) the information the request relates to has already been disclosed to the applicant or made publicly available; or (4) is overly broad or incomprehensible;
• changing the time limit for responding from 30 days after receiving the request to 30 business days, and in some circumstances, permitting the public body to extend the time to respond to a request for "additional reasonable periods";
• expanding the scope of the “cabinet and treasury board confidences” exemption; and
• preventing a public body from making a request to access a record in the custody or control of another public body.

As with the Protection of Privacy Act, the Access to Information Act aims to increase the fees and penalties that may be imposed upon those who breach the Act.

Changes in the Legislation

Originally, the Protection of Privacy Act imposed strict rules surrounding data matching, data derived from personal information and non-personal data; however, certain amendments that received Royal Assent on May 15, 2025, excepted the Office of Statistics and Information from these requirements. For example, prior to the amendments, all public bodies were not permitted to collect personal information directly from an individual for the purposes of carrying out data matching to create data derived from personal information. After the amendments, this prohibition does not apply to the Office of Statistics and Information. Similarly, the Office of Statistics and Information is exempt from certain requirements surrounding the timeline of destroying data derived from personal information and the circumstances in which a public body may create non-personal data.

Takeaways

We expect that the Access to Information Act will have a significant impact with respect to how public bodies may:

1. respond to access requests, including requiring a greater level of detail from applicants;
2. take a longer time to respond to access requests; and
3. use discretionary exemptions to withhold more information and/or records in their response to access requests. Further, we expect that the Protection of Privacy Act will impose stricter requirements as to how public bodies must protect the personal information in their custody or control and how they may use same.

If you would like to discuss how the Protection of Privacy Act and the Access to Information Act may affect your organization, we invite you to contact the members of the Bennett Jones Privacy & Data Protection group.