Ontario’s Information and Privacy Commissioner (Patricia Kosseim) has released her 2021 annual report. The report reflects on the shift towards an increasingly digital society over the course of the past year and describes the IPC’s role in protecting people’s privacy while supporting innovation in our province. In addition to reporting on the IPC’s adjudication of complaints, the report outlined the IPC’s efforts to conduct public education and outreach as well as advice and consultations in four strategic areas:

Privacy and Transparency in a Modern Government

This priority is centered on improving people’s privacy and access rights by ensuring that public institutions have appropriate frameworks in place to govern digital technology. The IPC advised government on the development of privacy principles to inform the governance of digital technologies such as Ontario’s Digital Identity Program, the Trustworthy Artificial Intelligence Framework and the establishment of a provincial data authority. Priorities included minimizing data collection, developing a model which allows individuals to control the use of their personal information and using artificial intelligence in a manner that maintains democratic principles and individual rights. Other themes included ensuring that initiatives are inclusive and accessible across economic, social, physical or administrative barriers and pairing data sharing powers with enhanced privacy protections such as mandatory privacy impact assessments and breach reporting.

Trust in Digital Health

The goal of this priority is to promote confidence in the digital health care system by encouraging custodians to respect the privacy and access rights of Ontarians, creating resources that guide custodians through recent legislative and regulatory changes to PHIPA that were made to facilitate the provision of digital health services and supporting the use of personal health information for research and analytics in a manner that serves the public good.

In 2021, the IPC consulted on the development of the government’s mandatory proof of vaccination certificate program and the implementation of virtual care solutions, including vendor selection, consent processes and safeguards for virtual care visits. It also completed an initial review of Ontario Health as a prescribed organization under PHIPA, which is essential to the development of a provincial electronic health record system. Consultations will continue in 2022 to address the IPC’s recommendations. Finally, the IPC revised the Manual for the Review and Approval of Prescribed Persons and Prescribed Entities, a document that is used to guide the review of entities entrusted with large volumes of personal health information or who have significant responsibilities under PHIPA and who do so without consent for the benefit of the public, subject to scrutiny of their practices every three years.

Although the advances in health privacy were significant in 2021, a number of the amendments to Ontario’s Personal Health Information Protection Act have not yet taken effect, for example: the IPC’s powers to impose monetary penalties against individuals and organizations for serious breaches of PHIPA. The IPC continues to advocate for the details of this scheme to be set out in regulations so that it can impose real consequences on bad actors who undermine Ontarians’ confidence in the health system.

Useful digital health resources developed by the IPC in 2021:

• Privacy and Security Considerations for Virtual Health Care Visits 
• Digital Health under PHIPA: Selected Overview
• From the bedside to the board: Building a culture of privacy and security in health institutions
• Use and Disclosure of Personal Health Information for Broader Public Health Purposes
• Resolution on data sharing for the public good

Children and Youth in a Digital World

This priority is about protecting Ontario’s children and youth in an environment where digitization is threatening their privacy, autonomy and well-being at an increasing rate. The goal is to promote privacy literacy amongst children and youth and protect their access and privacy rights by holding institutions accountable for protecting the children and youth they serve. In 2021, the IPC developed a webinar for Ontario educators about protecting student privacy rights, a set of games and activities for kids called “Privacy Pursuit!” and a podcast called “Teaching kids about privacy”. The IPC also issued its first decisions under Part X of the Child, Youth and Family Services Act and sponsored a resolution at the Global Privacy Assembly, which represents a commitment to promoting the digital rights of children and youth, in collaboration with stakeholders, policy makers and other data protection authorities. Finally, the IPC advocated for children’s data rights in the private sector via a White Paper on Modernizing Privacy in Ontario.

Next-Generation Law Enforcement

This priority is focused on building public trust in law enforcement by establishing guidelines for the use of technology so that access and privacy rights are preserved in conjunction with improvements to operational efficiency and enhanced public safety. Among the topics for 2021 were the expansion of closed-circuit television systems, and new community-based approaches to policing (such as the toolkit for mobile crisis response teams). The IPC held a webcast discussion panel on the role of accountability and transparency in building public trust in law enforcement and released draft guidelines to infuse legal controls and privacy protections to minimize intrusiveness in the use of facial recognition technology by police. Consultations on the finalization of the guidelines will continue in 2022.

You can access the 2021 Annual Report and related Statistical Reports here.