I’m Kate Dewhirst.

My team and I write about legal issues affecting healthcare in Canada.

Kate Dewhirst Health Law - bringing the law to life. Meet Kate (in 13 seconds)

IPC Annual Report 2021

Posted by

Ontario’s Information and Privacy Commissioner (Patricia Kosseim) has released her 2021 annual report. The report reflects on the shift towards an increasingly digital society over the course of the past year and describes the IPC’s role in protecting people’s privacy while supporting innovation in our province. In addition to reporting on the IPC’s adjudication of complaints, the report outlined the IPC’s efforts to conduct public education and outreach as well as advice and consultations in four strategic areas:

Privacy and Transparency in a Modern Government

This priority is centered on improving people’s privacy and access rights by ensuring that public institutions have appropriate frameworks in place to govern digital technology. The IPC advised government on the development of privacy principles to inform the governance of digital technologies such as Ontario’s Digital Identity Program, the Trustworthy Artificial Intelligence Framework and the establishment of a provincial data authority. Priorities included minimizing data collection, developing a model which allows individuals to control the use of their personal information and using artificial intelligence in a manner that maintains democratic principles and individual rights. Other themes included ensuring that initiatives are inclusive and accessible across economic, social, physical or administrative barriers and pairing data sharing powers with enhanced privacy protections such as mandatory privacy impact assessments and breach reporting.

Trust in Digital Health

The goal of this priority is to promote confidence in the digital health care system by encouraging custodians to respect the privacy and access rights of Ontarians, creating resources that guide custodians through recent legislative and regulatory changes to PHIPA that were made to facilitate the provision of digital health services and supporting the use of personal health information for research and analytics in a manner that serves the public good.

In 2021, the IPC consulted on the development of the government’s mandatory proof of vaccination certificate program and the implementation of virtual care solutions, including vendor selection, consent processes and safeguards for virtual care visits. It also completed an initial review of Ontario Health as a prescribed organization under PHIPA, which is essential to the development of a provincial electronic health record system. Consultations will continue in 2022 to address the IPC’s recommendations. Finally, the IPC revised the Manual for the Review and Approval of Prescribed Persons and Prescribed Entities, a document that is used to guide the review of entities entrusted with large volumes of personal health information or who have significant responsibilities under PHIPA and who do so without consent for the benefit of the public, subject to scrutiny of their practices every three years.

Although the advances in health privacy were significant in 2021, a number of the amendments to Ontario’s Personal Health Information Protection Act have not yet taken effect, for example: the IPC’s powers to impose monetary penalties against individuals and organizations for serious breaches of PHIPA. The IPC continues to advocate for the details of this scheme to be set out in regulations so that it can impose real consequences on bad actors who undermine Ontarians’ confidence in the health system.

Useful digital health resources developed by the IPC in 2021:

Children and Youth in a Digital World

This priority is about protecting Ontario’s children and youth in an environment where digitization is threatening their privacy, autonomy and well-being at an increasing rate. The goal is to promote privacy literacy amongst children and youth and protect their access and privacy rights by holding institutions accountable for protecting the children and youth they serve. In 2021, the IPC developed a webinar for Ontario educators about protecting student privacy rights, a set of games and activities for kids called “Privacy Pursuit!” and a podcast called “Teaching kids about privacy”. The IPC also issued its first decisions under Part X of the Child, Youth and Family Services Act and sponsored a resolution at the Global Privacy Assembly, which represents a commitment to promoting the digital rights of children and youth, in collaboration with stakeholders, policy makers and other data protection authorities. Finally, the IPC advocated for children’s data rights in the private sector via a White Paper on Modernizing Privacy in Ontario.

Next-Generation Law Enforcement

This priority is focused on building public trust in law enforcement by establishing guidelines for the use of technology so that access and privacy rights are preserved in conjunction with improvements to operational efficiency and enhanced public safety. Among the topics for 2021 were the expansion of closed-circuit television systems, and new community-based approaches to policing (such as the toolkit for mobile crisis response teams). The IPC held a webcast discussion panel on the role of accountability and transparency in building public trust in law enforcement and released draft guidelines to infuse legal controls and privacy protections to minimize intrusiveness in the use of facial recognition technology by police. Consultations on the finalization of the guidelines will continue in 2022.

You can access the 2021 Annual Report and related Statistical Reports here.


If you enjoyed this article please share it:


Previous and next posts from Kate:

Some of Kate’s recent and upcoming events

Free healthcare privacy webinar - ask me anything!
the first Wednesday of every month

Free webinars - advance registration needed

Whether you're an experienced privacy officer or new in the field, pick Kate’s brain for free for an hour, in this live webinar. No charge, but you’ll need to register in advance.

Primary care webinars: Employment Law Update & Legal Issues for EDs and Board members

Part of Kate’s monthly webinar series.

Our 2025 program is now live.
Full details of the 2024 webinar series and registration here.

Mental Health webinars: Legal issues for mental health and addictions agencies and teams
Annual membership 2025

For managers and other leaders from mental health and addictions agencies, hospitals, CMHAs, CHCs, school boards, FHTs and Indigenous health services

This is an annual membership program with monthly webinars.
Full details and registration here.

Health Privacy Officer Foundations training
starts Spring 2025

For Privacy Officers within healthcare organizations.

This course focuses on how to become a more confident privacy officer and gives you the tools to document your privacy program. Full details and registration here...

Join the Shush: a collective of health privacy officers
Annual membership 2024

For Privacy Officers within healthcare organizations

This is an annual membership program that takes theory into practice and tackles real life scenarios to build Privacy Officer skills.
Full details and registration here.

Team Privacy Training Events

For Primary Care clinics, Hospitals, Community Agencies, Mental Health Teams, Public Health Units, School Boards, Police departments

Scheduled to your team's needs for comprehensive or refresher training More details...

Free summary of all PHIPA IPC decisions

Want to read privacy breach stories to learn how to improve your work? We have summarized all the Information and Privacy Commissioner's health privacy decisions for you Download here...

Kate Dewhirst Health Law

Kate says:

My mission is bringing the law to life. I make legal theory understandable, accessible and fun! I’m available and love to work for all organizations in the healthcare sector across Ontario and beyond.

Subscribe to my mailing list and keep up to date with news:

Latest Tweets

  • Our twitter feed is unavailable right now. Follow us on Twitter
  • contact details

    P.O. Box 13024, RPO Bradford Centre
    Bradford, ON, L3Z 2Y5

    (416) 855 9557

    .