Municipal Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. M.56

CONTENTS 1. Purposes 2. Interpretation 3. Designation of head PART I FREEDOM OF INFORMATION Access to Records 4. Right of access 4.1 Measures to ensure preservation of records 5. Obligation to disclose Exemptions 6. Draft by-laws, etc. 7. Advice or recommendations 8. Law enforcement 8.1 Civil Remedies Act, 2001 8.2 Prohibiting Profiting from Recounting Crimes Act, 2002 9. Relations with governments 9.1 Relations with Aboriginal communities 10. Third party information 11. Economic and other interests 12. Solicitor-client privilege 13. Danger to safety or health 14. Personal privacy 15. Information soon to be published 16. Exemptions not to apply Access Procedure 17. Request 17.1 Plan for staged access to records 17.2 Requester’s response to plan 18. Involvement of other institutions 19. Notice by head 20. Extension of time 20.1 Frivolous request 21. Notice to affected person 22. Contents of notice of refusal 23. Copy of record Information to be published or available 24. Publication of information re institutions 25. Information available for inspection 26. Annual report of head PART II PROTECTION OF INDIVIDUAL PRIVACY Collection and Retention of Personal Information 27. Application of Part 28. Personal information 29. Manner of collection 30. Retention of personal information 30.1 Breach of privacy safeguards Use and Disclosure of Personal Information 31. Use of personal information 32. Where disclosure permitted 33. Consistent purpose Right of Individuals to Whom Personal Information Relates to Access and Correction 36. Rights of access and correction 37. Access 38. Exemptions 38.1 Commissioner’s review of information practices PART III APPEAL 39. Right to appeal 40. Mediator to try to effect settlement 41. Inquiry 42. Burden of proof 43. Order 44. Delegation PART IV GENERAL 45. Fees 45.1 Whistleblowing 46. Powers and duties of Commissioner 47. Regulations 48. Offences 49. Delegation, civil proceedings 50. Informal access 51. Information otherwise available 52. Application of Act 52.1 Non-application re: Hydro One Inc. 53. Other Acts 54. Exercise of rights of deceased, etc., persons Purposes 1 The purposes of this Act are, (a) to provide a right of access to information under the control of institutions in accordance with the principles that, (i) information should be available to the public, (ii) necessary exemptions from the right of access should be limited and specific, and (iii) decisions on the disclosure of information should be reviewed independently of the institution controlling the information; and (b) to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information. R.S.O. 1990, c. M.56, s. 1. Interpretation 2 (1) In this Act, “close relative” means a parent, child, grandparent, grandchild, brother, sister, uncle, aunt, nephew or niece, including by adoption; (“proche parent”) “head”, in respect of an institution, means the individual or body determined to be head under section 3; (“personne responsable”) “Information and Privacy Commissioner” and “Commissioner” mean the Commissioner appointed under subsection 4 (1) of the Freedom of Information and Protection of Privacy Act; (“commissaire à l’information et à la protection de la vie privée”, “commissaire”) Note: On January 1, 2027, subsection 2 (1) of the Act is amended by adding the following definition: (See: 2026, c. 2, Sched. 11, s. 1 (1)) “information practices” means the practices and procedures of an institution for actions in relation to personal information, including, (a) when, how and the purposes for which the institution collects, uses, modifies, discloses, retains or disposes of personal information, and (b) the administrative, technical and physical safeguards and practices that the institution maintains with respect to protecting the information; (“pratiques relatives aux renseignements”) “institution” means, (a) a municipality, (b) a school board, municipal service board, city board, transit commission, public library board, board of health, police service board, conservation authority, district social services administration board, local services board, planning board, local roads board, police village or joint committee of management or joint board of management established under the Municipal Act, 2001 or the City of Toronto Act, 2006 or a predecessor of those Acts, (c) any agency, board, commission, corporation or other body designated as an institution in the regulations; (“institution”) “law enforcement” means, (a) policing, (b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, or (c) the conduct of proceedings referred to in clause (b); (“exécution de la loi”) “Minister” means the minister designated under section 3 of the Freedom of Information and Protection of Privacy Act as the responsible minister for the purposes of that Act; (“ministre”) “personal information” means recorded information about an identifiable individual, including, (a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual, (b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved, (c) any identifying number, symbol or other particular assigned to the individual, (d) the address, telephone number, fingerprints or blood type of the individual, (e) the personal opinions or views of the individual except if they relate to another individual, (f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence, (g) the views or opinions of another individual about the individual, and (h) the individual’s name if it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; (“renseignements personnels”) “record” means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes, (a) data, in any form, and any record made, recorded, transmitted or stored in digital form or in other intangible form by electronic, magnetic, optical or any other means, and (b) subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution; (“document”) “regulations” means the regulations made under this Act; (“règlements”) “spouse” means, (a) a spouse as defined in section 1 of the Family Law Act, or (b) either of two persons who live together in a conjugal relationship outside marriage. (“conjoint”) R.S.O. 1990, c. M.56, s. 2 (1); 1997, c. 25, Sched. E, s. 8; 2000, c. 26, Sched. J, s. 2; 2002, c. 17, Sched. F, Table; 2006, c. 19, Sched. N, s. 3 (1); 2006, c. 32, Sched. C, s. 35; 2006, c. 34, Sched. C, s. 13 (1, 2); 2016, c. 23, s. 59; 2019, c. 1, Sched. 4, s. 36; 2021, c. 4, Sched. 11, s. 25; 2026, c. 2, Sched. 11, s. 1 (2, 3). Personal information (2) Personal information does not include information about an individual who has been dead for more than thirty years. R.S.O. 1990, c. M.56, s. 2 (2). Business identity information, etc. (2.1) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity. 2006, c. 34, Sched. C, s. 13 (3). Same (2.2) For greater certainty, subsection (2.1) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling. 2006, c. 34, Sched. C, s. 13 (3). Bodies considered part of municipality (3) Every agency, board, commission, corporation or other body not mentioned in clause (b) of the definition of “institution” in subsection (1) or designated under clause (c) of the definition of “institution” in subsection (1) is deemed to be a part of the municipality for the purposes of this Act if all of its members or officers are appointed or chosen by or under the authority of the council of the municipality. R.S.O. 1990, c. M.56, s. 2 (3); 2002, c. 17, Sched. F, Table. Business days (4) For the purposes of this Act, a business day is any day that is not a Saturday or a holiday. 2026, c. 2, Sched. 11, s. 1 (4). Section Amendments with date in force (d/m/y) 1997, c. 25, Sched. E, s. 8 - 01/07/1998 2000, c. 26, Sched. J, s. 2 - 06/12/2000 2002, c. 17, Sched. F, Table - 01/01/2003 2006, c. 19, Sched. N, s. 3 (1) - 22/06/2006; 2006, c. 32, Sched. C, s. 35 - 01/01/2007; 2006, c. 34, Sched. C, s. 13 (1-3) - 01/04/2007 2016, c. 23, s. 59 - 01/01/2017 2018, c. 3, Sched. 5, s. 38 - no effect - see 2019, c. 1, Sched. 3, s. 5 - 26/03/2019 2019, c. 1, Sched. 4, s. 36 - 01/04/2024 2021, c. 4, Sched. 11, s. 25 - 19/04/2021 2026, c. 2, Sched. 11, s. 1 (1) - 01/01/2027; 2026, c. 2, Sched. 11, s. 1 (2-4) - 01/07/2026 Designation of head 3 (1) The members of the council of a municipality may by by-law designate from among themselves an individual or a committee of the council to act as head of the municipality for the purposes of this Act. R.S.O. 1990, c. M.56, s. 3 (1); 2002, c. 17, Sched. F, Table. Idem (2) The members elected or appointed to the board, commission or other body that is an institution other than a municipality may designate in writing from among themselves an individual or a committee of the body to act as head of the institution for the purposes of this Act. R.S.O. 1990, c. M.56, s. 3 (2); 2002, c. 17, Sched. F, Table. If no designation (3) If no person is designated as head under this section, the head shall be, (a) the council, in the case of a municipality; and (b) the members elected or appointed to the board, commission or other body in the case of an institution other than a municipality. R.S.O. 1990, c. M.56, s. 3 (3); 2002, c. 17, Sched. F, Table. Section Amendments with date in force (d/m/y) 2002, c. 17, Sched. F, Table - 01/01/2003 PART I FREEDOM OF INFORMATION Access to Records Right of access 4 (1) Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless, (a) the record or the part of the record falls within one of the exemptions under sections 6 to 15; or (b) the head is of the opinion on reasonable grounds that the request for access is frivolous or vexatious. Severability of record (2) If an institution receives a request for access to a record that contains information that falls within one of the exemptions under sections 6 to 15 and the head of the institution is not of the opinion that the request is frivolous or vexatious, the head shall disclose as much of the record as can reasonably be severed without disclosing the information that falls under one of the exemptions. 1996, c. 1, Sched. K, s. 13. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 13 - 30/01/1996 Measures to ensure preservation of records 4.1 Every head of an institution shall ensure that reasonable measures respecting the records in the custody or under the control of the institution are developed, documented and put into place to preserve the records in accordance with any recordkeeping or records retention requirements, rules or policies, whether established under an Act or otherwise, that apply to the institution. 2014, c. 13, Sched. 6, s. 3. Section Amendments with date in force (d/m/y) 2014, c. 13, Sched. 6, s. 3 - 01/01/2016 Obligation to disclose 5 (1) Despite any other provision of this Act, a head shall, as soon as practicable, disclose any record to the public or persons affected if the head has reasonable and probable grounds to believe that it is in the public interest to do so and that the record reveals a grave environmental, health or safety hazard to the public. Notice (2) Before disclosing a record under subsection (1), the head shall cause notice to be given to any person to whom the information in the record relates, if it is practicable to do so. Contents of notice (3) The notice shall contain, (a) a statement that the head intends to release a record or a part of a record that may affect the interests of the person; (b) a description of the contents of the record or part that relate to the person; and (c) a statement that if the person makes representations forthwith to the head as to why the record or part should not be disclosed, those representations will be considered by the head. Representations (4) A person who is given notice under subsection (2) may make representations forthwith to the head concerning why the record or part should not be disclosed. R.S.O. 1990, c. M.56, s. 5. Exemptions Draft by-laws, etc. 6 (1) A head may refuse to disclose a record, (a) that contains a draft of a by-law or a draft of a private bill; or (b) that reveals the substance of deliberations of a meeting of a council, board, commission or other body or a committee of one of them if a statute authorizes holding that meeting in the absence of the public. Exception (2) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record if, (a) in the case of a record under clause (1) (a), the draft has been considered in a meeting open to the public; (b) in the case of a record under clause (1) (b), the subject-matter of the deliberations has been considered in a meeting open to the public; or (c) the record is more than twenty years old. R.S.O. 1990, c. M.56, s. 6. Advice or recommendations 7 (1) A head may refuse to disclose a record if the disclosure would reveal advice or recommendations of an officer or employee of an institution or a consultant retained by an institution. Exceptions (2) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record that contains, (a) factual material; (b) a statistical survey; (c) a report by a valuator; (d) an environmental impact statement or similar record; (e) a report or study on the performance or efficiency of an institution; (f) a feasibility study or other technical study, including a cost estimate, relating to a policy or project of an institution; (g) a report containing the results of field research undertaken before the formulation of a policy proposal; (h) a final plan or proposal to change a program of an institution, or for the establishment of a new program, including a budgetary estimate for the program; (i) a report of a committee or similar body within an institution, which has been established for the purpose of preparing a report on a particular topic; (j) a report of a body which is attached to an institution and which has been established for the purpose of undertaking inquiries and making reports or recommendations to the institution; (k) the reasons for a final decision, order or ruling of an officer or an employee of the institution made during or at the conclusion of the exercise of discretionary power conferred by or under an enactment or scheme administered by the institution. Idem (3) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record if the record is more than twenty years old. R.S.O. 1990, c. M.56, s. 7. Law enforcement 8 (1) A head may refuse to disclose a record if the disclosure could reasonably be expected to, (a) interfere with a law enforcement matter; (b) interfere with an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result; (c) reveal investigative techniques and procedures currently in use or likely to be used in law enforcement; (d) disclose the identity of a confidential source of information in respect of a law enforcement matter, or disclose information furnished only by the confidential source; (e) endanger the life or physical safety of a law enforcement officer or any other person; (f) deprive a person of the right to a fair trial or impartial adjudication; (g) interfere with the gathering of or reveal law enforcement intelligence information respecting organizations or persons; (h) reveal a record which has been confiscated from a person by a peace officer in accordance with an Act or regulation; (i) endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required; (j) facilitate the escape from custody of a person who is under lawful detention; (k) jeopardize the security of a centre for lawful detention; or (l) facilitate the commission of an unlawful act or hamper the control of crime. R.S.O. 1990, c. M.56, s. 8 (1); 2002, c. 18, Sched. K, s. 14 (1); 2019, c. 7, Sched. 41, s. 1. Idem (2) A head may refuse to disclose a record, (a) that is a report prepared in the course of law enforcement, inspections or investigations by an agency which has the function of enforcing and regulating compliance with a law; (b) that is a law enforcement record if the disclosure would constitute an offence under an Act of Parliament; (c) that is a law enforcement record if the disclosure could reasonably be expected to expose the author of the record or any person who has been quoted or paraphrased in the record to civil liability; or (d) that contains information about the history, supervision or release of a person under the control or supervision of a correctional authority. R.S.O. 1990, c. M.56, s. 8 (2); 2002, c. 18, Sched. K, s. 14 (2). Refusal to confirm or deny existence of record (3) A head may refuse to confirm or deny the existence of a record to which subsection (1) or (2) applies. R.S.O. 1990, c. M.56, s. 8 (3). Exception (4) Despite clause (2) (a), a head shall disclose a record that is a report prepared in the course of routine inspections by an agency that is authorized to enforce and regulate compliance with a particular statute of Ontario. R.S.O. 1990, c. M.56, s. 8 (4). Idem (5) Subsections (1) and (2) do not apply to a record on the degree of success achieved in a law enforcement program including statistical analyses unless disclosure of such a record may prejudice, interfere with or adversely affect any of the matters referred to in those subsections. R.S.O. 1990, c. M.56, s. 8 (5). Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 14 (1, 2) - 26/11/2002 2019, c. 7, Sched. 41, s. 1 - 17/03/2021 Civil Remedies Act, 2001 8.1 A head may refuse to disclose a record and may refuse to confirm or deny the existence of a record if disclosure of the record could reasonably be expected to interfere with the ability of the Attorney General to determine whether a proceeding should be commenced under the Civil Remedies Act, 2001, conduct a proceeding under that Act or enforce an order made under that Act. 2001, c. 28, s. 23 (1); 2002, c. 18, Sched. K, s. 15; 2007, c. 13, s. 45 (1). Section Amendments with date in force (d/m/y) 2001, c. 28, s. 23 (1) - 12/04/2002 2002, c. 18, Sched. K, s. 15 - 26/11/2002 2007, c. 13, s. 45 (1) - 04/06/2007 Prohibiting Profiting from Recounting Crimes Act, 2002 8.2 A head may refuse to disclose a record and may refuse to confirm or deny the existence of a record if disclosure of the record could reasonably be expected to interfere with the ability of the Attorney General to determine whether a proceeding should be commenced under the Prohibiting Profiting from Recounting Crimes Act, 2002, conduct a proceeding under that Act or enforce an order made under that Act. 2002, c. 2, ss. 16 (1), 19 (8); 2002, c. 18, Sched. K, s. 16. Section Amendments with date in force (d/m/y) 2002, c. 2, s. 16 (1) - 01/07/2003; 2002, c. 18, Sched. K, s. 16 - 26/11/2002 Relations with governments 9 (1) A head shall refuse to disclose a record if the disclosure could reasonably be expected to reveal information the institution has received in confidence from, (a) the Government of Canada; (b) the Government of Ontario or the government of a province or territory in Canada; (c) the government of a foreign country or state; (d) an agency of a government referred to in clause (a), (b) or (c); or (e) an international organization of states or a body of such an organization. R.S.O. 1990, c. M.56, s. 9 (1); 2002, c. 18, Sched. K, s. 17. Idem (2) A head shall disclose a record to which subsection (1) applies if the government, agency or organization from which the information was received consents to the disclosure. R.S.O. 1990, c. M.56, s. 9 (2). Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 17 - 26/11/2002 Relations with Aboriginal communities 9.1 (1) A head may refuse to disclose a record where the disclosure could reasonably be expected to, (a) prejudice the conduct of relations between an Aboriginal community and the Government of Ontario or an institution; or (b) reveal information received in confidence from an Aboriginal community by an institution. 2017, c. 8, Sched. 20, s. 1. Definitions (2) In this section, “Aboriginal community” means, (a) a band within the meaning of the Indian Act (Canada), (b) an Aboriginal organization or community that is negotiating or has negotiated with the Government of Canada or the Government of Ontario on matters relating to, (i) Aboriginal or treaty rights under section 35 of the Constitution Act, 1982, or (ii) a treaty, land claim or self-government agreement, and (c) any other Aboriginal organization or community prescribed by the regulations; (“communauté autochtone”) “institution” includes an institution as defined in section 2 of the Freedom of Information and Protection of Privacy Act. (“institution”) 2017, c. 8, Sched. 20, s. 1. Section Amendments with date in force (d/m/y) 2017, c. 8, Sched. 20, s. 1 - 09/03/2018 Third party information 10 (1) A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to, (a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization; (b) result in similar information no longer being supplied to the institution where it is in the public interest that similar information continue to be so supplied; (c) result in undue loss or gain to any person, group, committee or financial institution or agency; or (d) reveal information supplied to or the report of a conciliation officer, mediator, labour relations officer or other person appointed to resolve a labour relations dispute. R.S.O. 1990, c. M.56, s. 10 (1); 2002, c. 18, Sched. K, s. 18; 2017, c. 8, Sched. 20, s. 2. Consent to disclosure (2) A head may disclose a record described in subsection (1) if the person to whom the information relates consents to the disclosure. R.S.O. 1990, c. M.56, s. 10 (2). Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 18 - 26/11/2002 2017, c. 8, Sched. 20, s. 2 - 17/05/2017 Economic and other interests 11 A head may refuse to disclose a record that contains, (a) trade secrets or financial, commercial, scientific or technical information that belongs to an institution and has monetary value or potential monetary value; (b) information obtained through research by an employee of an institution if the disclosure could reasonably be expected to deprive the employee of priority of publication; (c) information whose disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution; (d) information whose disclosure could reasonably be expected to be injurious to the financial interests of an institution; (e) positions, plans, procedures, criteria or instructions to be applied to any negotiations carried on or to be carried on by or on behalf of an institution; (f) plans relating to the management of personnel or the administration of an institution that have not yet been put into operation or made public; (g) information including the proposed plans, policies or projects of an institution if the disclosure could reasonably be expected to result in premature disclosure of a pending policy decision or undue financial benefit or loss to a person; (h) questions that are to be used in an examination or test for an educational purpose; (i) submissions in respect of a matter under the Municipal Boundary Negotiations Act commenced before its repeal by the Municipal Act, 2001, by a party municipality or other body before the matter is resolved. R.S.O. 1990, c. M.56, s. 11; 2002, c. 17, Sched. F, Table; 2002, c. 18, Sched. K, s. 19. Section Amendments with date in force (d/m/y) 2002, c. 17, Sched. F, Table - 01/01/2003; 2002, c. 18, Sched. K, s. 19 (1-4) - 26/11/2002 Solicitor-client privilege 12 A head may refuse to disclose a record that is subject to solicitor-client privilege or that was prepared by or for counsel employed or retained by an institution for use in giving legal advice or in contemplation of or for use in litigation. R.S.O. 1990, c. M.56, s. 12. Danger to safety or health 13 A head may refuse to disclose a record whose disclosure could reasonably be expected to seriously threaten the safety or health of an individual. R.S.O. 1990, c. M.56, s. 13; 2002, c. 18, Sched. K, s. 20. Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 20 - 26/11/2002 Personal privacy 14 (1) A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except, (a) upon the prior written request or consent of the individual, if the record is one to which the individual is entitled to have access; (b) in compelling circumstances affecting the health or safety of an individual, if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates; (c) personal information collected and maintained specifically for the purpose of creating a record available to the general public; (d) under an Act of Ontario or Canada that expressly authorizes the disclosure; (e) for a research purpose if, (i) the disclosure is consistent with the conditions or reasonable expectations of disclosure under which the personal information was provided, collected or obtained, (ii) the research purpose for which the disclosure is to be made cannot be reasonably accomplished unless the information is provided in individually identifiable form, and (iii) the person who is to receive the record has agreed to comply with the conditions relating to security and confidentiality prescribed by the regulations; or (f) if the disclosure does not constitute an unjustified invasion of personal privacy. R.S.O. 1990, c. M.56, s. 14 (1). Criteria re invasion of privacy (2) A head, in determining whether a disclosure of personal information constitutes an unjustified invasion of personal privacy, shall consider all the relevant circumstances, including whether, (a) the disclosure is desirable for the purpose of subjecting the activities of the institution to public scrutiny; (b) access to the personal information may promote public health and safety; (c) access to the personal information will promote informed choice in the purchase of goods and services; (d) the personal information is relevant to a fair determination of rights affecting the person who made the request; (e) the individual to whom the information relates will be exposed unfairly to pecuniary or other harm; (f) the personal information is highly sensitive; (g) the personal information is unlikely to be accurate or reliable; (h) the personal information has been supplied by the individual to whom the information relates in confidence; and (i) the disclosure may unfairly damage the reputation of any person referred to in the record. R.S.O. 1990, c. M.56, s. 14 (2). Presumed invasion of privacy (3) A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy if the personal information, (a) relates to a medical, psychiatric or psychological history, diagnosis, condition, treatment or evaluation; (b) was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation; (c) relates to eligibility for social service or welfare benefits or to the determination of benefit levels; (d) relates to employment or educational history; (e) was obtained on a tax return or gathered for the purpose of collecting a tax; (f) describes an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness; (g) consists of personal recommendations or evaluations, character references or personnel evaluations; or (h) indicates the individual’s racial or ethnic origin, sexual orientation or religious or political beliefs or associations. R.S.O. 1990, c. M.56, s. 14 (3). Limitation (4) Despite subsection (3), a disclosure does not constitute an unjustified invasion of personal privacy if it, (a) discloses the classification, salary range and benefits, or employment responsibilities of an individual who is or was an officer or employee of an institution; (b) discloses financial or other details of a contract for personal services between an individual and an institution; or (c) discloses personal information about a deceased individual to the spouse or a close relative of the deceased individual, and the head is satisfied that, in the circumstances, the disclosure is desirable for compassionate reasons. R.S.O. 1990, c. M.56, s. 14 (4); 2006, c. 19, Sched. N, s. 3 (2). Refusal to confirm or deny existence of record (5) A head may refuse to confirm or deny the existence of a record if disclosure of the record would constitute an unjustified invasion of personal privacy. R.S.O. 1990, c. M.56, s. 14 (5). Section Amendments with date in force (d/m/y) 2006, c. 19, Sched. N, s. 3 (2) - 22/06/2006 Information soon to be published 15 A head may refuse to disclose a record if, (a) the record or the information contained in the record has been published or is currently available to the public; or (b) the head believes on reasonable grounds that the record or the information contained in the record will be published by an institution within 90 days after the request is made or within such further period of time as may be necessary for printing or translating the material for the purpose of printing it. R.S.O. 1990, c. M.56, s. 15. Exemptions not to apply 16 An exemption from disclosure of a record under sections 7, 9, 9.1, 10, 11, 13 and 14 does not apply if a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption. R.S.O. 1990, c. M.56, s. 16; 2017, c. 8, Sched. 20, s. 3. Section Amendments with date in force (d/m/y) 2017, c. 8, Sched. 20, s. 3 - 09/03/2018 Access Procedure Request 17 (1) A person seeking access to a record shall, (a) make a request in writing to the institution that the person believes has custody or control of the record, and specify that the request is being made under this Act; (b) provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record; and (c) at the time of making the request, pay the fee prescribed by the regulations for that purpose. 1996, c. 1, Sched. K, s. 14; 2017, c. 2, Sched. 12, s. 6 (1). Frivolous request (1.1) If the head of the institution is of the opinion on reasonable grounds that the request is frivolous or vexatious, subsections (2) to (5) do not apply to the request. 1996, c. 1, Sched. K, s. 14; 2006, c. 34, Sched. C, s. 14 (1). Assistance with request (2) An institution shall make reasonable efforts to assist a person with formulating a request so as to comply with subsection (1) and shall, for that purpose, (a) respond, as soon as possible in the circumstances, to any inquiries from the person about formulating such a request; and (b) if a request is made that does not sufficiently describe the record sought, inform the person of the defect and offer assistance in reformulating the request. 2026, c. 2, Sched. 11, s. 2 (1). Request for continuing access to record (3) The person who made the request may indicate in the request that it shall, if granted, continue to have effect for a specified period of up to two years. 2006, c. 34, Sched. C, s. 14 (2); 2026, c. 2, Sched. 11, s. 2 (2). Institution to provide schedule (4) When a request that is to continue to have effect is granted, the institution shall provide the person who made the request with, (a) a schedule showing dates in the specified period on which the request shall be deemed to have been received again, and explaining why those dates were chosen; and (b) a statement that the person who made the request may ask the Commissioner to review the schedule. 2006, c. 34, Sched. C, s. 14 (2); 2026, c. 2, Sched. 11, s. 2 (2). Act applies as if new requests were being made (5) This Act applies as if a new request were being made on each of the dates shown in the schedule. 2006, c. 34, Sched. C, s. 14 (2). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 14 - 30/01/1996 2006, c. 34, Sched. C, s. 14 (1, 2) - 01/04/2007 2017, c. 2, Sched. 12, s. 6 (1) - 22/03/2017 2026, c. 2, Sched. 11, s. 2 (1, 2) - 01/07/2026 Plan for staged access to records 17.1 (1) The head of an institution may, before the expiry of the time limit set out in section 19 or, where there has been an extension of a time limit under subsection 20 (1) or (1.1), within that extended time limit, respond to a request for records by proposing a plan for providing access to the records in stages if, (a) the time required to search for responsive records would unreasonably interfere with the regular duties of employees of the institution; (b) the scope of the request is overly broad because of the period of time it covers; (c) the preparation of responsive records for disclosure would unreasonably interfere with the operations of the institution due to their volume; or (d) the person who made the request has submitted other requests to the institution and the person’s requests would, collectively, unreasonably interfere with the operations of the institution. 2026, c. 2, Sched. 11, s. 3. Nature of access plan (2) The plan respecting access to records referred to in subsection (1) shall, (a) divide the request into separate categories of records and set out the areas of the institution to be searched for those records; and (b) establish a schedule that sets out, (i) whether or not access to records, or parts of those records, will be given or an indication of when such decisions respecting access to records will be made, and (ii) when access to the records, or parts of those records, is to be given or, if necessary, when the records, or parts of those records, are to be produced. 2026, c. 2, Sched. 11, s. 3. Written notice (3) The head shall give written notice of the decision to establish a plan respecting access to records referred to in subsection (1) that sets out the plan as well as a statement that the person who made the request may appeal the decision to the Commissioner within 30 business days after the notice was given. 2026, c. 2, Sched. 11, s. 3. Same, amendment to plan (4) If the head amends a plan respecting access to records referred to in subsection (1), the head shall give written notice of the decision to amend the plan that sets out the amended plan as well as, if the plan is being amended for the first time, a statement that the person who made the request may appeal the decision to the Commissioner within 30 business days after the notice was given. 2026, c. 2, Sched. 11, s. 3. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 3 - 01/07/2026 Requester’s response to plan 17.2 (1) Where the head of an institution proposes a plan for providing access to records in stages under section 17.1 or proposes amendments to such a plan, the person who requested the records shall, within 30 business days after receiving the plan and any proposed amendments to the plan, respond in writing to the head or, in the case of a decision to propose a plan for providing access to records in stages under section 17.1 or a decision to amend such a plan for the first time, appeal the decision to the Commissioner. 2026, c. 2, Sched. 11, s. 3. Content of response (2) When responding in writing to the head under subsection (1), the person shall, (a) indicate their acceptance of the plan; (b) propose amendments to the plan; or (c) modify the scope of their request. 2026, c. 2, Sched. 11, s. 3. Effect on time limit (3) At the end of the day on which a proposed plan for providing access to records in stages under section 17.1 is sent by the institution, the time limit within which notice is required to be given under section 19 stops running and resumes running on the day on which the response under subsection (1) is received by the head or, if that day is not a business day, on the next business day following that day. 2026, c. 2, Sched. 11, s. 3. Lack of response (4) The person who made the request is deemed to have abandoned the request if, (a) the person has not responded to the head in writing within the time frame established under subsection (1) or the person’s response to the head made within that time frame does not comply with subsection (2); and (b) in the case of a decision to propose a plan for providing access to records in stages under section 17.1 or a decision to amend such a plan for the first time, the person has not appealed the decision to the Commissioner. 2026, c. 2, Sched. 11, s. 3. Implementation of plan (5) The head of an institution may implement a plan for providing access to records in stages if the person who requested the records responds to the head under subsection (1) by indicating that the person accepts the plan. 2026, c. 2, Sched. 11, s. 3. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 3 - 01/07/2026 Involvement of other institutions 18 (1) In this section, “institution” includes an institution as defined in section 2 of the Freedom of Information and Protection of Privacy Act. R.S.O. 1990, c. M.56, s. 18 (1). Request to be forwarded (2) The head of an institution that receives a request for access to a record that the institution does not have in its custody or under its control shall make reasonable inquiries to determine whether another institution has custody or control of the record, and, if the head determines that another institution has custody or control of the record, the head shall within 15 business days after the request is received, (a) forward the request to the other institution; and (b) give written notice to the person who made the request that it has been forwarded to the other institution. R.S.O. 1990, c. M.56, s. 18 (2); 2026, c. 2, Sched. 11, s. 4 (1). Transfer of request (3) If an institution receives a request for access to a record and the head considers that another institution has a greater interest in the record, the head may transfer the request and, if necessary, the record to the other institution, within 15 business days after the request is received, in which case the head transferring the request shall give written notice of the transfer to the person who made the request. R.S.O. 1990, c. M.56, s. 18 (3); 2026, c. 2, Sched. 11, s. 4 (1). Greater interest (4) For the purpose of subsection (3), another institution has a greater interest in a record than the institution that receives the request for access if, (a) the record was originally produced in or for the other institution; or (b) in the case of a record not originally produced in or for an institution, the other institution was the first institution to receive the record or a copy of it. R.S.O. 1990, c. M.56, s. 18 (4). When transferred request deemed made (5) Where a request is forwarded or transferred under subsection (2) or (3), the request shall be deemed to have been made to the institution to which it is forwarded or transferred on the day the institution to which the request was originally made received it. R.S.O. 1990, c. M.56, s. 18 (5). Transition, business days (6) This section, as it read immediately before the day section 4 of Schedule 11 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply to requests for access to a record received by an institution before that day. 2026, c. 2, Sched. 11, s. 4 (2). Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 4 (1, 2) - 01/07/2026 Notice by head 19 (1) Where a person requests access to a record, the head of the institution to which the request is made or if a request is forwarded or transferred under section 18, the head of the institution to which it is forwarded or transferred, shall, subject to sections 20, 21 and 45, within 45 business days after the request is received, (a) give written notice to the person who made the request as to whether or not access to the record or a part of it will be given; and (b) if access is to be given, give the person who made the request access to the record or part, and if necessary for the purpose cause the record to be produced. R.S.O. 1990, c. M.56, s. 19; 1996, c. 1, Sched. K, s. 15; 2026, c. 2, Sched. 11, s. 5 (1). Same (2) A request is only received for the purposes of subsection (1) once the person who made the request has complied with subsection 17 (1). 2026, c. 2, Sched. 11, s. 5 (2). Transition, business days (3) This section, as it read immediately before the day section 5 of Schedule 11 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply to requests for access to a record made or forwarded to the head of the institution before that day. 2026, c. 2, Sched. 11, s. 5 (2). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 15 - 30/01/1996 2026, c. 2, Sched. 11, s. 5 (1, 2) - 01/07/2026 Extension of time 20 (1) A head may extend the time limit set out in section 19 for a period of time that is reasonable in the circumstances, if, (a) the request is for a large number of records or necessitates a search through a large number of records and meeting the time limit would unreasonably interfere with the operations of the institution; or (b) consultations with a person outside the institution are necessary to comply with the request and cannot reasonably be completed within the time limit. R.S.O. 1990, c. M.56, s. 20 (1). Same, second extension (1.1) If the time limit has been extended under subsection (1), the head may extend the time limit one additional time in any of the following circumstances: 1. The person who made the request consents to the extension. 2. The number of records identified as being responsive to the request is significantly more than the number of records initially identified. 3. One of the following circumstances arises, provided that it was not reasonably foreseeable when the time limit was extended under subsection (1) that the circumstance would arise: i. Employees knowledgeable in the subject matter of the request are unable to assist with responding to the request. ii. Additional consultations become necessary to respond to the request. 2026, c. 2, Sched. 11, s. 6 (1). Notice of extension (2) A head who extends the time limit under subsection (1) or (1.1) shall give the person who made the request written notice of the extension setting out, (a) the length of the extension; (b) the reason for the extension; and (c) that the person who made the request may ask the Commissioner to review the extension. R.S.O. 1990, c. M.56, s. 20 (2); 2026, c. 2, Sched. 11, s. 6 (2). Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 6 (1, 2) - 01/07/2026 Frivolous request 20.1 (1) A head who refuses to give access to a record or a part of a record because the head is of the opinion that the request for access is frivolous or vexatious, shall state in the notice given under section 19, (a) that the request is refused because the head is of the opinion that the request is frivolous or vexatious; (b) the reasons for which the head is of the opinion that the request is frivolous or vexatious; and (c) that the person who made the request may appeal to the Commissioner under subsection 39 (1) for a review of the decision. Non-application (2) Sections 21 and 22 do not apply to a head who gives a notice for the purpose of subsection (1). 1996, c. 1, Sched. K, s. 16. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 16 - 30/01/1996 Notice to affected person 21 (1) A head shall give written notice in accordance with subsection (2) to the person to whom the information relates before granting a request for access to a record, (a) that the head has reason to believe might contain information referred to in subsection 10 (1) that affects the interest of a person other than the person requesting information; or (b) that is personal information that the head has reason to believe might constitute an unjustified invasion of personal privacy for the purposes of clause 14 (1) (f). R.S.O. 1990, c. M.56, s. 21 (1). Contents of notice (2) The notice shall contain, (a) a statement that the head intends to disclose a record or part of a record that may affect the interests of the person; (b) a description of the contents of the record or part that relate to the person; and (c) a statement that the person may subject to subsection (5.1), within 20 business days after the notice is given, make representations to the head as to why the record or part should not be disclosed. R.S.O. 1990, c. M.56, s. 21 (2); 2016, c. 5, Sched. 17, s. 1 (1); 2026, c. 2, Sched. 11, s. 7 (1). Description (2.1) If the request covers more than one record, the description mentioned in clause (2) (b) may consist of a summary of the categories of the records requested if it provides sufficient detail to identify them. 1996, c. 1, Sched. K, s. 17. Time for notice (3) The notice referred to in subsection (1) shall be given within 30 business days after the request for access is received or, if there has been an extension of a time limit under subsection 20 (1), within that extended time limit. R.S.O. 1990, c. M.56, s. 21 (3); 2026, c. 2, Sched. 11, s. 7 (1). Notice of delay (4) A head who gives notice to a person under subsection (1) shall also give the person who made the request written notice of delay, setting out, (a) that the disclosure of the record or part may affect the interests of another party; (b) that the other party is being given an opportunity to make representations concerning disclosure; and (c) that the head will, within 10 business days after the expiry of the time period for making representations under subsection (5), decide whether or not to disclose the record. R.S.O. 1990, c. M.56, s. 21 (4); 2016, c. 5, Sched. 17, s. 1 (2); 2026, c. 2, Sched. 11, s. 7 (1).

Representation re disclosure (5) Where a notice is given under subsection (1), the person to whom the information relates may subject to subsection (5.1), within 20 business days after the notice is given, make representations to the head as to why the record or part should not be disclosed. R.S.O. 1990, c. M.56, s. 21 (5); 2016, c. 5, Sched. 17, s. 1 (3); 2026, c. 2, Sched. 11, s. 7 (1). Extension of time (5.1) If the time limit specified in subsection (5) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the person, the head may extend the time limit for a period of time that is reasonably required in the circumstances to accommodate the person for the purpose of making representations under that subsection. 2016, c. 5, Sched. 17, s. 1 (4). Representation in writing (6) Representations under subsection (5) shall be made in writing unless the head permits them to be made orally. R.S.O. 1990, c. M.56, s. 21 (6). Decision re disclosure (7) The head shall decide whether or not to disclose the record or part and give written notice of the decision to the person to whom the information relates and the person who made the request within 10 business days after the expiry of the time period for making representations under subsection (5). 2016, c. 5, Sched. 17, s. 1 (5); 2026, c. 2, Sched. 11, s. 7 (1). Notice of head’s decision to disclose (8) A head who decides to disclose a record or part under subsection (7) shall state in the notice that, (a) the person to whom the information relates may appeal the decision to the Commissioner within 30 business days after the notice of decision is given, subject to subsection (8.1); and (b) the person who made the request will be given access to the record or part unless an appeal of the decision is commenced within the time period specified in clause (a). 2016, c. 5, Sched. 17, s. 1 (5); 2026, c. 2, Sched. 11, s. 7 (1). Extension of time (8.1) If the time limit specified in clause (8) (a) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the person, the head may extend the time limit for a period of time that is reasonably required in the circumstances to accommodate the person for the purpose of appealing the decision under that clause.). 2016, c. 5, Sched. 17, s. 1 (5). Access to be given unless affected person appeals (9) A head who decides under subsection (7) to disclose the record or part shall give the person who made the request access to the record or part within 30 business days after notice is given under subsection (7), unless the person to whom the information relates appeals the decision to the Commissioner in accordance with clause (8) (a). R.S.O. 1990, c. M.56, s. 21 (9); 2016, c. 5, Sched. 17, s. 1 (6); 2026, c. 2, Sched. 11, s. 7 (1). Personal information about deceased (10) In the case of a request by the spouse or a close relative of a deceased individual for disclosure of personal information about the deceased individual, the person making the request shall give the head all information that the person has regarding whether the deceased individual has a personal representative and how to contact the personal representative. 2006, c. 19, Sched. N, s. 3 (3). Deemed references (11) If, under subsection (10), the head is informed that the deceased individual has a personal representative and is given sufficient information as to how to contact the personal representative, and if the head has reason to believe that disclosure of personal information about the deceased individual might constitute an unjustified invasion of personal privacy unless, in the circumstances, the disclosure is desirable for compassionate reasons, subsections (1) to (9) apply with the following modifications: 1. The expression “the person to whom the information relates” in subsections (1), (5), (7), (8) and (9) shall be deemed to be the expression “the personal representative”. 2. The expression “the person” in clauses (2) (a) and (b) shall be deemed to be the expression “the deceased individual” and the expression “the person” in clause (2) (c) shall be deemed to be the expression “the personal representative”. 2006, c. 19, Sched. N, s. 3 (3). Transition, business days (12) This section, as it read immediately before the day section 7 of Schedule 11 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply to requests for access to a record received by an institution before that day. 2026, c. 2, Sched. 11, s. 7 (2). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 17 - 30/01/1996 2006, c. 19, Sched. N, s. 3 (3) - 22/06/2006 2016, c. 5, Sched. 17, s. 1 (1-6) - 19/04/2016 2026, c. 2, Sched. 11, s. 7 (1, 2) - 01/07/2026 Contents of notice of refusal 22 (1) Notice of refusal to give access to a record or part under section 19 shall set out, (a) where there is no such record, (i) that there is no such record, and (ii) that the person who made the request may appeal to the Commissioner the question of whether such a record exists; or (b) where there is such a record, (i) the specific provision of this Act under which access is refused, (ii) the reason the provision applies to the record, (iii) the name and position of the person responsible for making the decision, and (iv) that the person who made the request may appeal to the Commissioner for a review of the decision. R.S.O. 1990, c. M.56, s. 22 (1). Same (2) A head who refuses to confirm or deny the existence of a record as provided in subsection 8 (3) (law enforcement), section 8.1 (Civil Remedies Act, 2001), section 8.2 (Prohibiting Profiting from Recounting Crimes Act, 2002) or subsection 14 (5) (unjustified invasion of personal privacy), shall state in the notice given under section 19, (a) that the head refuses to confirm or deny the existence of the record; (b) the provision of this Act on which the refusal is based; (c) the name and office of the person responsible for making the decision; and (d) that the person who made the request may appeal to the Commissioner for a review of the decision. R.S.O. 1990, c. M.56, s. 22 (2); 2001, c. 28, s. 23 (2); 2002, c. 2, ss. 16 (2), 19 (9); 2007, c. 13, s. 45 (2). Idem (3) A head who refuses to disclose a record or part under subsection 21 (7) shall state in the notice given under subsection 21 (7), (a) the specific provision of this Act under which access is refused; (b) the reason the provision named in clause (a) applies to the record; (c) the name and office of the person responsible for making the decision to refuse access; and (d) that the person who made the request may appeal to the Commissioner for a review of the decision. R.S.O. 1990, c. M.56, s. 22 (3). Description (3.1) If a request for access covers more than one record, the statement in a notice under this section of a reason mentioned in subclause (1) (b) (ii) or clause (3) (b) may refer to a summary of the categories of the records requested if it provides sufficient detail to identify them. 1996, c. 1, Sched. K, s. 18. Deemed refusal (4) A head who fails to give the notice required under section 19 or subsection 21 (7) concerning a record shall be deemed to have given notice of refusal to give access to the record on the last day of the period during which notice should have been given. R.S.O. 1990, c. M.56, s. 22 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 18 - 30/01/1996 2001, c. 28, s. 23 (2) - 12/04/2002 2002, c. 2, s. 16 (2) - 01/07/2003; 2002, c. 2, s. 19 (9) - 01/07/2003 2007, c. 13, s. 45 (2) - 04/06/2007 Copy of record 23 (1) Subject to subsection (2), a person who is given access to a record or a part of a record under this Act shall be given a copy of the record or part unless it would not be reasonably practicable to reproduce it by reason of its length or nature, in which case the person shall be given an opportunity to examine the record or part. Access to original record (2) If a person requests the opportunity to examine a record or part and it is reasonably practicable to give the person that opportunity, the head shall allow the person to examine the record or part. Copy of part (3) A person who examines a record or a part and wishes to have portions of it copied shall be given a copy of those portions unless it would not be reasonably practicable to reproduce them by reason of their length or nature. R.S.O. 1990, c. M.56, s. 23. Information to be published or available Publication of information re institutions 24 (1) The Minister shall cause to be published a compilation listing all institutions and, in respect of each institution, setting out, (a) where a request for a record should be made; and (b) the title of the head of the institution. Idem (2) The Minister shall cause the compilation to be published before the 1st day of January, 1992 and at least once every three years thereafter. R.S.O. 1990, c. M.56, s. 24. Information available for inspection 25 (1) A head shall cause to be made available for inspection and copying by the public information containing, (a) a description of the organization and responsibilities of the institution; (b) a list of the general classes or types of records in the custody or control of the institution; (c) the title, business telephone and business address of the head; and (d) the address to which a request under this Act should be made. Idem (2) The head shall ensure that the information made available is amended as required to ensure its accuracy. R.S.O. 1990, c. M.56, s. 25. Annual report of head 26 (1) A head shall make an annual report, in accordance with this section, to the Commissioner. 2006, c. 19, Sched. N, s. 3 (4). Note: On January 1, 2027, subsection 26 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 11, s. 8 (1)) Annual report of head (1) A head shall provide to the Commissioner an annual report with respect to the previous calendar year in accordance with this section. 2026, c. 2, Sched. 11, s. 8 (1). Contents of report (2) A report made under subsection (1) shall specify, (a) the number of requests under this Act or the Personal Health Information Protection Act, 2004 for access to records made to the institution or to a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; (b) the number of refusals by the head to disclose a record under this Act, the provisions of this Act under which disclosure was refused and the number of occasions on which each provision was invoked; (c) the number of refusals under the Personal Health Information Protection Act, 2004 by a health information custodian, within the meaning of that Act, that is the institution or that is acting as part of the institution, of a request for access to a record, the provisions of that Act under which disclosure was refused and the number of occasions on which each provision was invoked; Note: On January 1, 2027, subsection 26 (2) of the Act is amended by adding the following clause: (See: 2026, c. 2, Sched. 11, s. 8 (2)) (c.1) the number of thefts, losses or unauthorized uses or disclosures of personal information recorded under subsection 30.1 (8); (d) the number of uses or purposes for which personal information is disclosed if the use or purpose is not included in any written public statement provided under subsection 16 (1) of the Personal Health Information Protection Act, 2004 by a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; (e) the amount of fees collected under section 45 of this Act by the institution and under subsection 54 (10) of the Personal Health Information Protection Act, 2004 by the institution or a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; and (f) any other information indicating an effort by the institution or by a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution to put into practice the purposes of this Act or the purposes of the Personal Health Information Protection Act, 2004. 2006, c. 19, Sched. N, s. 3 (4); 2026, c. 2, Sched. 11, s. 8 (3). Separate information (3) The information required by each of clauses (2) (a), (d), (e) and (f) shall be provided separately for, (a) each separate health information custodian that is the institution or that is acting as part of the institution; and (b) the institution other than in its capacity as a health information custodian and other than in its capacity as an institution containing a health information custodian. 2006, c. 19, Sched. N, s. 3 (4). Same (4) The information required by clause (2) (c) shall be provided separately for each separate health information custodian that is the institution or that is acting as part of the institution. 2006, c. 19, Sched. N, s. 3 (4). Note: On January 1, 2027, section 26 of the Act is amended by adding the following subsection: (See: 2026, c. 2, Sched. 11, s. 8 (4)) Form of report etc. (5) The annual report shall be provided no later than the date specified by the Commissioner, if any, and shall be in the form and manner as may be specified by the Commissioner. 2026, c. 2, Sched. 11, s. 8 (4). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 91 - 01/11/2004 2006, c. 19, Sched. N, s. 3 (4) - 22/06/2006 2026, c. 2, Sched. 11, s. 8 (1, 2, 4) - 01/01/2027; 2026, c. 2, Sched. 11, s. 8 (3) - 01/07/2026 PART II PROTECTION OF INDIVIDUAL PRIVACY Collection and Retention of Personal Information Application of Part 27 This Part does not apply to personal information that is maintained for the purpose of creating a record that is available to the general public. R.S.O. 1990, c. M.56, s. 27. Personal information 28 (1) In this section and in section 29, “personal information” includes information that is not recorded and that is otherwise defined as “personal information” under this Act. Note: On January 1, 2027, subsection 28 (1) of the Act is amended by striking out “section 29” and substituting “section 29 and subsection 30 (5)”. (See: 2026, c. 2, Sched. 11, s. 9 (1)) Collection of personal information (2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. R.S.O. 1990, c. M.56, s. 28. Note: On January 1, 2027, section 28 of the Act is amended by adding the following subsections: (See: 2026, c. 2, Sched. 11, s. 9 (2)) Privacy impact assessment (3) Unless the regulations provide otherwise, before collecting personal information, the head of an institution shall ensure that a written assessment is prepared that contains the following information respecting any personal information that the institution intends to collect: 1. The purpose for which the personal information is intended to be collected, used and disclosed, as applicable, and an explanation of why the personal information is necessary to achieve the purpose. 2. The legal authority for the intended collection, use and disclosure of the personal information. 3. The types of personal information that is intended to be collected and, for each type of personal information collected, an indication of how the type of personal information is intended to be used or disclosed. 4. The sources of the personal information that is intended be collected. 5. The position titles of the officers, employees, consultants or agents of the institution who will have access to the personal information. 6. Any limitations or restrictions imposed on the collection, use or disclosure of the personal information. 7. The period of time that the personal information would be retained by the institution, in accordance with subsection 30 (1). 8. An explanation of the administrative, technical and physical safeguards and practices that would be used to protect the personal information in accordance with subsection 30 (5) and a summary of any risks to individuals in the event of a theft, loss or unauthorized use or disclosure of the personal information. 9. The steps to be taken by the institution, i. to prevent or reduce the likelihood of a theft, loss or unauthorized use or disclosure of personal information from occurring, and ii. to mitigate the risks to individuals in the event of such an occurrence. 10. Such other information as may be prescribed. 2026, c. 2, Sched. 11, s. 9 (2). Risk mitigation (4) The head of an institution shall ensure that the steps mentioned in paragraph 9 of subsection (3) are implemented, (a) before collecting the personal information mentioned in that subsection; or (b) if it is not possible to implement the steps before collecting the personal information, within a reasonable time after collecting the information. 2026, c. 2, Sched. 11, s. 9 (2). Requirement to update (5) Unless the regulations provide otherwise, before making any significant change to the purpose for which personal information mentioned in subsection (3) is used or disclosed, the head of an institution shall, (a) update the assessment prepared under subsection (3) to reflect the proposed change and to set out the proposed intended use or disclosure; and (b) implement any additional steps identified under paragraph 9 of subsection (3). 2026, c. 2, Sched. 11, s. 9 (2). Copy to Commissioner (6) The head of an institution shall, on request, provide the Commissioner with access to, or a copy of, an assessment prepared under subsection (3) or updated under subsection (5). 2026, c. 2, Sched. 11, s. 9 (2). Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 9 (1, 2) - 01/01/2027 Manner of collection 29 (1) An institution shall collect personal information only directly from the individual to whom the information relates unless, (a) the individual authorizes another manner of collection; (b) the personal information may be disclosed to the institution concerned under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act; (c) the Commissioner has authorized the manner of collection under clause 46 (c); (d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act; (e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service; (f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or judicial or quasi-judicial tribunal; (g) the information is collected for the purpose of law enforcement; or (h) another manner of collection is authorized by or under a statute. R.S.O. 1990, c. M.56, s. 29 (1). Notice to individual (2) If personal information is collected on behalf of an institution, the head shall inform the individual to whom the information relates of, (a) the legal authority for the collection; (b) the principal purpose or purposes for which the personal information is intended to be used; and (c) the title, business address and business telephone number of an officer or employee of the institution who can answer the individual’s questions about the collection. R.S.O. 1990, c. M.56, s. 29 (2). Exception (3) Subsection (2) does not apply if, (a) the head may refuse to disclose the personal information under subsection 8 (1) or (2) (law enforcement), section 8.1 (Civil Remedies Act, 2001) or section 8.2 (Prohibiting Profiting from Recounting Crimes Act, 2002); (b) the Minister waives the notice; or (c) the regulations provide that the notice is not required. R.S.O. 1990, c. M.56, s. 29 (3); 2001, c. 28, s. 23 (3); 2002, c. 2, ss. 16 (3), 19 (10); 2007, c. 13, s. 45 (3). Section Amendments with date in force (d/m/y) 2002, c. 2, s. 19 (10) - 01/07/2003 2007, c. 13, s. 45 (3) - 04/06/2007 Retention of personal information 30 (1) Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information. Standard of accuracy (2) The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date. Exception (3) Subsection (2) does not apply to personal information collected for law enforcement purposes. Disposal of personal information (4) A head shall dispose of personal information under the control of the institution in accordance with the regulations. R.S.O. 1990, c. M.56, s. 30. Note: On January 1, 2027, section 30 of the Act is amended by adding the following subsection: (See: 2026, c. 2, Sched. 11, s. 10) Privacy safeguards (5) The head of an institution shall take steps that are reasonable in the circumstances to ensure that personal information in the custody or under the control of the institution is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the personal information are protected against unauthorized copying, modification or disposal. 2026, c. 2, Sched. 11, s. 10. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 10 - 01/01/2027 Note: On January 1, 2027, the Act is amended by adding the following section: (See: 2026, c. 2, Sched. 11, s. 11) Breach of privacy safeguards 30.1 (1) The head of an institution shall report to the Commissioner any theft, loss or unauthorized use or disclosure of personal information in the custody or under the control of the institution if it is reasonable in the circumstances to believe that there is real risk that a significant harm to an individual would result or if any other prescribed circumstances exist. 2026, c. 2, Sched. 11, s. 11. Report requirements (2) The report mentioned in subsection (1) must contain the prescribed information and must be made in the prescribed form and manner as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure has occurred. 2026, c. 2, Sched. 11, s. 11. Notification to individual (3) Unless otherwise prohibited by law, the head of an institution shall notify an individual of any theft, loss or unauthorized use or disclosure of the individual’s personal information that is in the custody or under the control of the institution if it is reasonable in the circumstances to believe that there is a real risk of significant harm to the individual or if any other prescribed circumstances exist. 2026, c. 2, Sched. 11, s. 11. Contents of notification (4) The notification mentioned in subsection (3) must contain a statement that the individual is entitled to make a complaint to the Commissioner and any other prescribed information and must be made in the prescribed form and manner as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure of personal information has occurred. 2026, c. 2, Sched. 11, s. 11. Complaints — time limit (5) A complaint mentioned in subsection (4) must be made in writing and filed with the Commissioner within one year after the subject-matter of the complaint first came to the attention of the complainant or should reasonably have come to the attention of the complainant, whichever is the shorter. 2026, c. 2, Sched. 11, s. 11. Extension of time limit (6) Despite subsection (5), a complaint may be filed with the Commissioner after the time limit set out in that subsection if, (a) the Commissioner is satisfied that the significance of the matter warrants a time extension and that the time extension would not result in any prejudice to any person; or (b) the time limit set out in subsection (5) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the complainant and the Commissioner is satisfied that the time extension is reasonably required in the circumstances to accommodate the complainant for the purpose of making the complaint. 2026, c. 2, Sched. 11, s. 11. Real risk of significant harm — factors (7) The factors that are relevant to determining whether a theft, loss or unauthorized use or disclosure of personal information creates a real risk of significant harm to an individual include, (a) the sensitivity of the personal information; (b) the probability that the personal information has been, is being or will be misused; (c) the availability of steps that the individual could take to, (i) reduce the risk of the harm occurring, or (ii) mitigate the harm should it occur; (d) any direction, recommendation or guidance provided by the Commissioner pertaining to what constitutes a real risk of significant harm; and (e) any other prescribed factor. 2026, c. 2, Sched. 11, s. 11. Records (8) The head of an institution shall, in accordance with any prescribed requirements, keep and maintain a record of every theft, loss or unauthorized use or disclosure of personal information reported under subsection (1). 2026, c. 2, Sched. 11, s. 11. Provision to Commissioner (9) The head of an institution shall, on request, provide the Commissioner with access to, or a copy of, the record. 2026, c. 2, Sched. 11, s. 11. Definition (10) In this section, “significant harm” includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. 2026, c. 2, Sched. 11, s. 11. Regulations (11) The Lieutenant Governor in Council may make regulations respecting anything in this section that is referred to as being prescribed. 2026, c. 2, Sched. 11, s. 11. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 11 - 01/01/2027 Use and Disclosure of Personal Information Use of personal information 31 An institution shall not use personal information in its custody or under its control except, (a) if the person to whom the information relates has identified that information in particular and consented to its use; (b) for the purpose for which it was obtained or compiled or for a consistent purpose; or (c) for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act. R.S.O. 1990, c. M.56, s. 31. Where disclosure permitted 32 An institution shall not disclose personal information in its custody or under its control except, (a) in accordance with Part I; (b) if the person to whom the information relates has identified that information in particular and consented to its disclosure; (c) for the purpose for which it was obtained or compiled or for a consistent purpose; (d) if the disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions; (e) where permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada; (f) if disclosure is by a law enforcement institution, (i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or (ii) to another law enforcement agency in Canada; (g) to an institution or a law enforcement agency in Canada if, (i) the disclosure is to aid in an investigation undertaken by the institution or the agency with a view to a law enforcement proceeding, or (ii) there is a reasonable basis to believe that an offence may have been committed and the disclosure is to enable the institution or the agency to determine whether to conduct such an investigation; (h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification is mailed to the last known address of the individual to whom the information relates; (i) in compassionate circumstances, to facilitate contact with the spouse, a close relative or a friend of an individual who is injured, ill or deceased; (j) to the Minister; (k) to the Information and Privacy Commissioner; (l) to the Government of Canada or the Government of Ontario in order to facilitate the auditing of shared cost programs. R.S.O. 1990, c. M.56, s. 32; 2006, c. 19, Sched. N, s. 3 (5); 2006, c. 34, Sched. C, s. 15; 2019, c. 7, Sched. 41, s. 2. Section Amendments with date in force (d/m/y) 2006, c. 19, Sched. N, s. 3 (5) - 22/06/2006; 2006, c. 34, Sched. C, s. 15 - 01/04/2007 2019, c. 7, Sched. 41, s. 2 (1, 2) - 17/03/2021 Consistent purpose 33 The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31 (b) and 32 (c) only if the individual might reasonably have expected such a use or disclosure. R.S.O. 1990, c. M.56, s. 33. 34 Repealed: 2026, c. 2, Sched. 11, s. 12. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 12 - 01/07/2026 35 Repealed: 2026, c. 2, Sched. 11, s. 12. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 12 - 01/07/2026 Right of Individuals to Whom Personal Information Relates to Access and Correction Rights of access and correction Right of access to personal information 36 (1) Every individual has a right of access to any personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to render it reasonably retrievable by the institution. 2026, c. 2, Sched. 11, s. 13. Right of correction (2) Every individual who is given access under subsection (1) to personal information is entitled to, (a) request correction of the personal information if the individual believes there is an error or omission; (b) require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made; and (c) require that any person or body to whom the personal information has been disclosed within the year before the time a correction is requested or a statement of disagreement is required be notified of the correction or statement of disagreement. R.S.O. 1990, c. M.56, s. 36. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 13 - 01/07/2026 Access 37 (1) An individual seeking access to personal information about the individual shall, (a) make a request in writing to the institution that the individual believes has custody or control of the personal information, and specify that the request is being made under this Act; (b) identify the location of the personal information; and (c) at the time of making the request, pay the fee prescribed by the regulations for that purpose. 2017, c. 2, Sched. 12, s. 6 (2); 2026, c. 2, Sched. 11, s. 14. Access procedures (2) Subsections 4 (2), 17 (1.1) and (2) and sections 18, 19, 20, 20.1, 21, 22 and 23 apply with necessary modifications to a request made under subsection (1). 1996, c. 1, Sched. K, s. 19. Comprehensible form (3) If access to personal information is to be given, the head shall ensure that the personal information is provided to the individual in a comprehensible form and in a manner that indicates the general conditions under which the personal information is stored and used. R.S.O. 1990, c. M.56, s. 37 (3). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 19 - 30/01/1996 2017, c. 2, Sched. 12, s. 6 (2) - 22/03/2017 2026, c. 2, Sched. 11, s. 14 - 01/07/2026 Exemptions 38 A head may refuse to disclose to the individual to whom the information relates personal information, (a) if section 6, 7, 8, 8.1, 8.2, 9, 9.1, 10, 11, 12, 13 or 15 would apply to the disclosure of that personal information; (b) if the disclosure would constitute an unjustified invasion of another individual’s personal privacy; (c) that is evaluative or opinion material compiled solely for the purpose of determining suitability, eligibility or qualifications for the awarding of contracts and other benefits by an institution if the disclosure would reveal the identity of a source who furnished information to the institution in circumstances where it may reasonably have been assumed that the identity of the source would be held in confidence; (c.1) if the information is supplied explicitly or implicitly in confidence and is evaluative or opinion material compiled solely for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service; (d) that is medical information if the disclosure could reasonably be expected to prejudice the mental or physical health of the individual; or (e) that is a research or statistical record. R.S.O. 1990, c. M.56, s. 38; 2001, c. 28, s. 23 (4); 2002, c. 2, ss. 16 (4), 19 (11); 2002, c. 18, Sched. K, s. 21; 2005, c. 28, Sched. J. s. 1; 2017, c. 8, Sched. 20, s. 4. Section Amendments with date in force (d/m/y) 2001, c. 28, s. 23 (4) - 12/04/2002 2002, c. 2, s. 16 (4) - 01/07/2003; 2002, c. 2, s. 19 (11) - 01/07/2003; 2002, c. 18, Sched. K, s. 21 - 26/11/2002 2005, c. 28, Sched. J, s. 1 - 10/06/2006 2017, c. 8, Sched. 20, s. 4 - 09/03/2018 Note: On January 1, 2027, the Act is amended by adding the following section: (See: 2026, c. 2, Sched. 11, s. 15) Commissioner’s review of information practices 38.1 (1) The Commissioner may conduct a review of the information practices of an institution if the Commissioner has received a complaint under subsection 30.1 (4) or has other reason to believe that the requirements of this Part are not being complied with. 2026, c. 2, Sched. 11, s. 15. Informal dispute resolution (2) Before conducting a review, the Commissioner may try to resolve the matter through mediation, conciliation or any other informal means of dispute resolution that the Commissioner considers appropriate. 2026, c. 2, Sched. 11, s. 15. No review (3) The Commissioner may decide not to conduct a review for whatever reason the Commissioner considers proper, including if satisfied that, (a) the institution has responded adequately to the complaint; (b) the complaint has been or could be more appropriately dealt with, initially or completely, by means of a procedure other than a complaint under this Act; (c) there is insufficient evidence to warrant a review; (d) the complaint is trivial, frivolous or vexatious or is made in bad faith; (e) the subject matter of the complaint is already the object of an ongoing review under this section; or (f) the subject matter of the complaint has already been the subject of a review by the Commissioner. 2026, c. 2, Sched. 11, s. 15. Conduct of review (4) In conducting a review referred to in subsection (1), the Commissioner shall review the institution’s information practices to determine whether, (a) there has been unauthorized collection, use, modification, disclosure, access to or retention of personal information collected under this Part; and (b) the requirements under this Part, including requirements with respect to notice, retention, security and secure disposal, have been met. 2026, c. 2, Sched. 11, s. 15. Duty to assist (5) The head and all officers, employees, consultants and agents of an institution shall co-operate with and assist the Commissioner in the conduct of a review, including using any data storage, processing or retrieval device or system to produce a record required by the Commissioner in readable form. 2026, c. 2, Sched. 11, s. 15. Powers of Commissioner (6) The Commissioner may require the production of such information and records that are relevant to the subject matter of the review and that are in the custody or under the control of an institution. 2026, c. 2, Sched. 11, s. 15. Orders (7) If, after giving an opportunity to be heard to the head of the institution, the Commissioner determines that an information practice contravenes this Part, the Commissioner may order the head to do any of the following: 1. Discontinue the information practice. 2. Change the information practice as specified by the Commissioner. 3. Return, transfer or destroy personal information collected or retained under the information practice. 4. Implement a different information practice as specified by the Commissioner. 5. Make a recommendation in respect of how the information practice could be improved. 2026, c. 2, Sched. 11, s. 15. Limit on certain orders (8) The Commissioner may order under subsection (5) no more than what is reasonably necessary to achieve compliance with this Part. 2026, c. 2, Sched. 11, s. 15. Procedure (9) The Statutory Powers Procedure Act does not apply to a review conducted under this section. 2026, c. 2, Sched. 11, s. 15. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 15 - 01/01/2027 PART III APPEAL Right to appeal 39 (1) A person may appeal any decision of a head under this Act to the Commissioner if, (a) the person has made a request for access to a record under subsection 17 (1); (b) the person has made a request for access to personal information under subsection 37 (1); (c) the person has made a request for correction of personal information under subsection 36 (2); or (d) the person is given notice of a request under subsection 21 (1). R.S.O. 1990, c. M.56, s. 39 (1). Limit on right of appeal (1.0.1) Despite subsection (1), a decision of a head to amend a plan for providing access to the records in stages referred to in subsection 17.1 (1) after the plan has already been amended once by the head may not be appealed to the Commissioner. 2026, c. 2, Sched. 11, s. 16 (1). Fee (1.1) A person who appeals under subsection (1) shall pay the fee prescribed by the regulations for that purpose. 1996, c. 1, Sched. K, s. 20. Time for application (2) Subject to subsection (2.0.1), an appeal under subsection (1) shall be made within 30 business days after the notice was given of the decision appealed from by filing with the Commissioner written notice of appeal. R.S.O. 1990, c. M.56, s. 39 (2); 2016, c. 5, Sched. 17, s. 2 (1); 2026, c. 2, Sched. 11, s. 16 (2). Extension of time (2.0.1) If the time limit specified in subsection (2) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the person, the Commissioner may extend the time limit for a period of time that is reasonably required in the circumstances to accommodate the person for the purpose of making the appeal. 2016, c. 5, Sched. 17, s. 2 (2). Transition, business days (2.0.2) Subsection (2), as it read immediately before the day section 16 of Schedule 11 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply in respect of notices given before that day. 2026, c. 2, Sched. 11, s. 16 (3). Immediate dismissal (2.1) The Commissioner may dismiss an appeal if the notice of appeal does not present a reasonable basis for concluding that the record or the personal information to which the notice relates exists. 1996, c. 1, Sched. K, s. 20. Non-application (2.2) If the Commissioner dismisses an appeal under subsection (2.1), subsection (3) and sections 40 and 41 do not apply to the Commissioner. 1996, c. 1, Sched. K, s. 20. Notice of application for appeal (3) Upon receiving a notice of appeal, the Commissioner shall inform the head of the institution concerned of the notice of appeal and may also inform any other institution or person with an interest in the appeal, including an institution within the meaning of the Freedom of Information and Protection of Privacy Act, of the notice of the appeal. 2006, c. 34, Sched. C, s. 16. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 20 - 30/01/1996 2006, c. 34, Sched. C, s. 16 - 01/04/2007 2016, c. 5, Sched. 17, s. 2 (1, 2) - 19/04/2016 2026, c. 2, Sched. 11, s. 16 (1-3) - 01/07/2026 Mediator to try to effect settlement 40 The Commissioner may authorize a mediator to investigate the circumstances of any appeal and to try to effect a settlement of the matter under appeal. R.S.O. 1990, c. M.56, s. 40. Inquiry 41 (1) The Commissioner may conduct an inquiry to review the head’s decision if, (a) the Commissioner has not authorized a mediator to conduct an investigation under section 40; or (b) the Commissioner has authorized a mediator to conduct an investigation under section 40 but no settlement has been effected. 1996, c. 1, Sched. K, s. 21. Procedure (2) The Statutory Powers Procedure Act does not apply to an inquiry under subsection (1). R.S.O. 1990, c. M.56, s. 41 (2). Inquiry in private (3) The inquiry may be conducted in private. R.S.O. 1990, c. M.56, s. 41 (3). Powers of Commissioner (4) In an inquiry, the Commissioner may require to be produced to the Commissioner and may examine any record that is in the custody or under the control of an institution, despite Parts I and II of this Act or any other Act or privilege, and may enter and inspect any premises occupied by an institution for the purposes of the investigation. R.S.O. 1990, c. M.56, s. 41 (4). Record not retained by Commissioner (5) The Commissioner shall not retain any information obtained from a record under subsection (4). R.S.O. 1990, c. M.56, s. 41 (5). Examination on site (6) Despite subsection (4), a head may require that the examination of a record by the Commissioner be of the original at its site. R.S.O. 1990, c. M.56, s. 41 (6). Notice of entry (7) Before entering any premises under subsection (4), the Commissioner shall notify the head of the institution occupying the premises of his or her purpose. R.S.O. 1990, c. M.56, s. 41 (7). Examination under oath (8) The Commissioner may summon and examine on oath any person who, in the Commissioner’s opinion, may have information relating to the inquiry and, for that purpose, the Commissioner may administer an oath. R.S.O. 1990, c. M.56, s. 41 (8). Evidence privileged (9) Anything said or any information supplied or any document or thing produced by a person in the course of an inquiry by the Commissioner under this Act is privileged in the same manner as if the inquiry were a proceeding in a court. R.S.O. 1990, c. M.56, s. 41 (9). Protection (10) Except on the trial of a person for perjury in respect of his or her sworn testimony, no statement made or answer given by that or any other person in the course of an inquiry by the Commissioner is admissible in evidence in any court or any inquiry or in any other proceedings, and no evidence in respect of proceedings before the Commissioner shall be given against any person. R.S.O. 1990, c. M.56, s. 41 (10). Idem (11) A person giving a statement or answer in the course of an inquiry before the Commissioner shall be informed by the Commissioner of his or her right to object to answer any question under section 5 of the Canada Evidence Act. R.S.O. 1990, c. M.56, s. 41 (11). Prosecution (12) No person is liable to prosecution for an offence against any Act, other than this Act, by reason of his or her compliance with a requirement of the Commissioner under this section. R.S.O. 1990, c. M.56, s. 41 (12). Representations (13) The person who requested access to the record, the head of the institution concerned and any other institution or person informed of the notice of appeal under subsection 39 (3) shall be given an opportunity to make representations to the Commissioner, but no person is entitled to have access to or to comment on representations made to the Commissioner by any other person or to be present when such representations are made. 2006, c. 34, Sched. C, s. 17 (1). Right to representation (14) Each of the following may be represented by a person authorized under the Law Society Act to represent them: 1. The person who requested access to the record. 2. The head of the institution concerned. 3. Any other institution or person informed of the notice of appeal under subsection 39 (3). 2006, c. 34, Sched. C, s. 17 (5). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 21 - 30/01/1996 2006, c. 21, Sched. C, s. 119 - 01/05/2007; 2006, c. 34, Sched. C, s. 17 (1, 2) - 01/04/2007; 2006, c. 34, Sched. C, s. 17 (5) - 01/05/2007 Burden of proof 42 If a head refuses access to a record or a part of a record, the burden of proof that the record or the part falls within one of the specified exemptions in this Act lies upon the head. R.S.O. 1990, c. M.56, s. 42. Order 43 (1) After all of the evidence for an inquiry has been received, the Commissioner shall make an order disposing of the issues raised by the appeal. Idem (2) If the Commissioner upholds a decision of a head that the head may refuse to disclose a record or a part of a record, the Commissioner shall not order the head to disclose the record or part. R.S.O. 1990, c. M.56, s. 43 (1, 2). Conditions (3) Subject to this Act, the Commissioner’s order may contain any conditions the Commissioner considers appropriate. R.S.O. 1990, c. M.56, s. 43 (3); 1996, c. 1, Sched. K, s. 22. Notice of order (4) The Commissioner shall give the appellant and the persons who received notice of the appeal under subsection 39 (3) written notice of order. R.S.O. 1990, c. M.56, s. 43 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 22 - 30/01/1996 Delegation 44 The Commissioner shall not delegate to a person other than an Assistant Commissioner his or her power to require a record referred to in section 8 to be produced and examined. R.S.O. 1990, c. M.56, s. 44. PART IV GENERAL Fees 45 (1) A head shall require the person who makes a request for access to a record to pay fees in the amounts prescribed by the regulations for, (a) the costs of every hour of manual search required to locate a record; (b) the costs of preparing the record for disclosure; (c) computer and other costs incurred in locating, retrieving, processing and copying a record; (d) shipping costs; and (e) any other costs incurred in responding to a request for access to a record. 1996, c. 1, Sched. K, s. 23 (1). (2) Repealed: 1996, c. 1, Sched. K, s. 23 (1). Estimate of costs (3) If the head estimates that the amount required to be paid under this Act is over $25, the head shall, before giving access to a record, (a) give the person requesting access a reasonable estimate of the amount; and (b) inform the person that they may request that the head waive the payment of all or any part of the amount. 2026, c. 2, Sched. 11, s. 17. Timing of estimate (3.1) The estimate shall be given before the expiry of the time limit set out in section 19 or, where there has been an extension of a time limit under subsection 20 (1) or (1.1), within that extended time limit. 2026, c. 2, Sched. 11, s. 17. Effect on time limit (3.2) At the end of the day on which the estimate is given, the time limit within which notice is required to be given under section 19 stops running and resumes running on the day on which any fee required under this section is paid or waived or, if that day is not a business day, on the next business day following that day. 2026, c. 2, Sched. 11, s. 17. Waiver of payment (4) A head shall waive the payment of all or any part of an amount required to be paid under subsection (1) if, in the head’s opinion, it is fair and equitable to do so after considering, (a) the extent to which the actual cost of processing, collecting and copying the record varies from the amount of the payment required by subsection (1);

(b) whether the payment will cause a financial hardship for the person requesting the record; (c) whether dissemination of the record will benefit public health or safety; and (d) any other matter prescribed in the regulations. R.S.O. 1990, c. M.56, s. 45 (4); 1996, c. 1, Sched. K, s. 23 (2). Review (5) A person who is required to pay a fee under subsection (1) may ask the Commissioner to review the amount of the fee or the head’s decision not to waive the fee. R.S.O. 1990, c. M.56, s. 45 (5); 1996, c. 1, Sched. K, s. 23 (3). Disposition of fees (6) The fees provided in this section shall be paid and distributed in the manner and at the times prescribed in the regulations. 1996, c. 1, Sched. K, s. 23 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 23 (1-4) - 30/01/1996 2026, c. 2, Sched. 11, s. 17 - 01/07/2026 Note: On January 1, 2027, the Act is amended by adding the following section: (See: 2026, c. 2, Sched. 11, s. 18) Whistleblowing 45.1 (1) Any person who has reasonable grounds to believe that an institution has contravened or is about to contravene this Act or the regulations may notify the Commissioner of the particulars of the matter and may request that their identity be kept confidential with respect to the notification. 2026, c. 2, Sched. 11, s. 18. Confidentiality (2) The Commissioner must keep confidential the identity of a person who has notified the Commissioner under subsection (1) and to whom an assurance of confidentiality has been provided by the Commissioner. 2026, c. 2, Sched. 11, s. 18. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 18 - 01/01/2027 Powers and duties of Commissioner 46 The Commissioner may, (a) offer comment on the privacy protection implications of proposed programs of institutions; (b) after hearing the head, order an institution to, (i) cease a collection practice that contravenes this Act, and (ii) destroy collections of personal information that contravene this Act; (c) in appropriate circumstances, authorize the collection of personal information otherwise than directly from the individual; (d) engage in or commission research into matters affecting the carrying out of the purposes of this Act; (e) conduct public education programs and provide information concerning this Act and the Commissioner’s role and activities; and (f) receive representations from the public concerning the operation of this Act. R.S.O. 1990, c. M.56, s. 46. Regulations 47 (1) The Lieutenant Governor in Council may make regulations, (0.a) prescribing standards for determining what constitutes reasonable grounds for a head to conclude that a request for access to a record is frivolous or vexatious; (0.a.1) prescribing Aboriginal organizations and communities for the purposes of clause (c) of the definition of “Aboriginal community” in subsection 9.1 (2); (a) respecting the procedures for access to original records under section 23; (a.1) requiring the head of an institution to assist persons with disabilities in making requests for access under subsection 17 (1) or 37 (1); (b) prescribing the circumstances under which records capable of being produced from machine readable records are not included in the definition of “record” for the purposes of this Act; Note: On January 1, 2027, subsection 47 (1) of the Act is amended by adding the following clause: (See: 2026, c. 2, Sched. 11, s. 19) (b.1) governing assessments under section 28, including prescribing information to be included in an assessment and providing for circumstances in which an assessment or an update is not required to be prepared; (c) setting standards for and requiring administrative, technical and physical safeguards to ensure the security and confidentiality of records and personal information under the control of institutions; (c.1) providing for procedures to be followed by an institution if personal information is disclosed in contravention of this Act; (d) setting standards for the accuracy and completeness of personal information that is under the control of an institution; (e) prescribing time periods for the purposes of subsection 30 (1); (e.1) respecting the disposal of personal information under subsection 30 (4), including providing for different procedures for the disposal of personal information based on the sensitivity of the personal information; (f) prescribing the amount, the manner of payment and the manner of allocation of fees described in clause 17 (1) (c) or 37 (1) (c), subsection 39 (1.1) or section 45 and the times at which they are required to be paid; (g) prescribing matters to be considered in determining whether to waive all or part of the costs required under section 45; (h) designating any agency, board, commission, corporation or other body as an institution; (i) prescribing circumstances under which the notice under subsection 29 (2) is not required; (j) prescribing conditions relating to the security and confidentiality of records used for a research purpose; (k) prescribing forms and providing for their use; (l) respecting any matter the Lieutenant Governor in Council considers necessary to carry out effectively the purposes of this Act. R.S.O. 1990, c. M.56, s. 47; 1996, c. 1, Sched. K, s. 24 (1, 2); 2006, c. 34, Sched. C, s. 18; 2017, c. 8, Sched. 20, s. 5. Categories of fees (2) A regulation made under clause (1) (f) may prescribe a different amount, manner of payment, manner of allocation or time of payment of fees for different categories of records or persons requesting access to a record. 1996, c. 1, Sched. K, s. 24 (3). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 24 (1-3) - 30/01/1996 2006, c. 34, Sched. C, s. 18 - 31/12/2016 2017, c. 8, Sched. 20, s. 5 - 09/03/2018 2026, c. 2, Sched. 11, s. 19 - 01/01/2027 Offences 48 (1) No person shall, (a) wilfully disclose personal information in contravention of this Act; Note: On January 1, 2027, clause 48 (1) (a) of the Act is amended by striking out “disclose” and substituting “collect, use or disclose”. (See: 2026, c. 2, Sched. 11, s. 20 (1)) (b) Repealed: 2026, c. 2, Sched. 11, s. 20 (2). (c) make a request under this Act for access to or correction of personal information under false pretences; (c.1) alter, conceal or destroy a record, or cause any other person to do so, with the intention of denying a right under this Act to access the record or the information contained in the record; (d) wilfully obstruct the Commissioner in the performance of his or her functions under this Act; (e) wilfully make a false statement to mislead or attempt to mislead the Commissioner in the performance of his or her functions under this Act; or (f) wilfully fail to comply with an order of the Commissioner. R.S.O. 1990, c. M.56, s. 48 (1); 2014, c. 13, Sched. 6, s. 4 (1); 2026, c. 2, Sched. 11, s. 20 (2). Penalty (2) Every person who contravenes subsection (1) is guilty of an offence and on conviction is liable to a fine not exceeding $5,000. R.S.O. 1990, c. M.56, s. 48 (2). Consent of Attorney General (3) A prosecution shall not be commenced under clause (1) (c.1), (d), (e) or (f) without the consent of the Attorney General. R.S.O. 1990, c. M.56, s. 48 (3); 2014, c. 13, Sched. 6, s. 4 (2). Extended limitation for prosecution (4) A prosecution for an offence under clause (1) (c.1) shall not be commenced more than two years after the day evidence of the offence was discovered. 2014, c. 13, Sched. 6, s. 4 (3). Protection of information (5) In a prosecution for an offence under this section, the court may take precautions to avoid the disclosure by the court or any person of any of the following information, including, where appropriate, conducting hearings or parts of hearings in private or sealing all or part of the court files: 1. Information that may be subject to an exemption from disclosure under sections 6 to 14. 2. Information to which this Act may not apply under section 52. 3. Information that may be subject to a confidentiality provision in any other Act. 2014, c. 13, Sched. 6, s. 4 (4). Section Amendments with date in force (d/m/y) 2014, c. 13, Sched. 6, s. 4 (1-4) - 01/01/2016 2026, c. 2, Sched. 11, s. 20 (1) - 01/01/2027; 2026, c. 2, Sched. 11, s. 20 (2) - 01/07/2026 Delegation, civil proceedings Delegation of head’s powers 49 (1) A head may in writing delegate a power or duty granted or vested in the head to an officer or officers of the institution or another institution subject to such limitations, restrictions, conditions and requirements as the head may set out in the delegation. R.S.O. 1990, c. M.56, s. 49 (1); 2006, c. 34, Sched. C, s. 19. Protection from civil proceeding (2) No action or other proceeding lies against a head, or against a person acting on behalf or under the direction of the head, for damages resulting from the disclosure or non-disclosure in good faith of a record or any part of a record under this Act, or from the failure to give a notice required under this Act if reasonable care is taken to give the required notice. R.S.O. 1990, c. M.56, s. 49 (2). Vicarious liability of institutions preserved (3) Subsection (2) does not relieve an institution from liability in respect of a tort committed by a head or a person mentioned in subsection (2) to which it would otherwise be subject and the institution is liable for any such tort in a like manner as if subsection (2) had not been enacted. R.S.O. 1990, c. M.56, s. 49 (3). Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 19 - 01/04/2007 Informal access Oral requests 50 (1) If a head may give access to information under this Act, nothing in this Act prevents the head from giving access to that information in response to an oral request or in the absence of a request. Pre-existing access preserved (2) This Act shall not be applied to preclude access to information that is not personal information and to which access by the public was available by statute, custom or practice immediately before the 1st day of January, 1991. R.S.O. 1990, c. M.56, s. 50. Information otherwise available 51 (1) This Act does not impose any limitation on the information otherwise available by law to a party to litigation. Powers of courts and tribunals (2) This Act does not affect the power of a court or a tribunal to compel a witness to testify or compel the production of a document. R.S.O. 1990, c. M.56, s. 51. Application of Act 52 (1) This Act applies to any record in the custody or under the control of an institution regardless of whether it was recorded before or after the 1st day of January, 1991. R.S.O. 1990, c. M.56, s. 52 (12). Non-application of Act (2) This Act does not apply to records placed in the archives of an institution by or on behalf of a person or organization other than the institution. R.S.O. 1990, c. M.56, s. 52 (2). Same (2.1) This Act does not apply to a record relating to a prosecution if all proceedings in respect of the prosecution have not been completed. 2006, c. 34, Sched. C, s. 20. Same (3) Subject to subsection (4), this Act does not apply to records collected, prepared, maintained or used by or on behalf of an institution in relation to any of the following: 1. Proceedings or anticipated proceedings before a court, tribunal or other entity relating to labour relations or to the employment of a person by the institution. 2. Negotiations or anticipated negotiations relating to labour relations or to the employment of a person by the institution between the institution and a person, bargaining agent or party to a proceeding or an anticipated proceeding. 3. Meetings, consultations, discussions or communications about labour relations or employment-related matters in which the institution has an interest. 1995, c. 1, s. 83. Exception (4) This Act applies to the following records: 1. An agreement between an institution and a trade union. 2. An agreement between an institution and one or more employees which ends a proceeding before a court, tribunal or other entity relating to labour relations or to employment-related matters. 3. An agreement between an institution and one or more employees resulting from negotiations about employment-related matters between the institution and the employee or employees. 4. An expense account submitted by an employee of an institution to that institution for the purpose of seeking reimbursement for expenses incurred by the employee in his or her employment. 1995, c. 1, s. 83. Non-application of Act (5) This Act does not apply to identifying information in a record relating to medical assistance in dying. 2017, c. 7, s. 4. Interpretation (6) In subsection (5), “identifying information” means information, (a) that relates to medical assistance in dying, and (b) that identifies an individual or facility, or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual or facility; (“renseignements identificatoires”) “medical assistance in dying” means medical assistance in dying within the meaning of section 241.1 of the Criminal Code (Canada). (“aide médicale à mourir”) 2017, c. 7, s. 4. Non-application of Act, Enhancing Digital Security and Trust Act, 2024 (7) This Act does not apply to the following records prepared or collected under the Enhancing Digital Security and Trust Act, 2024: 1. Records containing the names of employees designated as primary points of contact for ensuring cyber security within each public sector entity and their alternates. 2. Assessments or evaluations of a public sector entity’s status or progress with respect to cyber security or summaries of such assessments or evaluations. 3. Records containing the names of software applications that have been purchased or otherwise acquired by school boards, that are owned or operated by third parties and that are authorized to access a student’s personal information. 4. Any other records the disclosure of which could reasonably be expected to compromise cyber security for a public sector entity. 2026, c. 2, Sched. 11, s. 21. Interpretation (8) Terms used in subsection (7) that are defined in the Enhancing Digital Security and Trust Act, 2024 have the same meaning as in that Act. 2026, c. 2, Sched. 11, s. 21. Section Amendments with date in force (d/m/y) 1995, c. 1, s. 83 - 10/11/1995 2006, c. 34, Sched. C, s. 20 - 01/04/2007 2017, c. 7, s. 4 - 10/05/2017 2026, c. 2, Sched. 11, s. 21 - 01/07/2026 Non-application re: Hydro One Inc. 52.1 (1) This Act does not apply to Hydro One Inc. and its subsidiaries on and after the date on which the Building Ontario Up Act (Budget Measures), 2015 received Royal Assent. 2015, c. 20, Sched. 28, s. 1. Transition, Minister’s report (2) The publication of information required by section 24 on or after the date described in subsection (1) must not include information about Hydro One Inc. and its subsidiaries. 2015, c. 20, Sched. 28, s. 1. Transition, request for continuing access (3) If a person had made a request under subsection 17 (3) for continuing access to a record of Hydro One Inc. or a subsidiary before the date described in subsection (1), and if the specified period for which access is requested expires after April 23, 2015, the specified period is deemed to have expired on April 23, 2015. 2015, c. 20, Sched. 28, s. 1. Repeal (4) Subsection (3) and this subsection are repealed on a day to be named by proclamation of the Lieutenant Governor. 2015, c. 20, Sched. 28, s. 1. Transition (5) Despite subsection (1), for a period of six months after the date described in that subsection, (a) the Commissioner may continue to exercise all of his or her powers under section 41 (inquiry) and clause 46 (b) (certain orders) in relation to Hydro One Inc. and its subsidiaries with respect to matters that occurred and records that were created before that date; and (b) Hydro One Inc. and its subsidiaries continue to have the duties of an institution under this Act in relation to the exercise of the Commissioner’s powers mentioned in clause (a). 2015, c. 20, Sched. 28, s. 1. Continuing authority to issue orders, etc. (6) The powers and duties of the Commissioner to issue orders under section 41 and clause 46 (b) with respect to matters mentioned in subsection (5) continue for an additional six months after the expiry of the six-month period described in that subsection. 2015, c. 20, Sched. 28, s. 1. Orders binding (7) An order issued within the time described in subsection (6) is binding on Hydro One Inc. or its subsidiaries, as the case may be. 2015, c. 20, Sched. 28, s. 1. Repeal (8) Subsections (5), (6) and (7) and this subsection are repealed on a day to be named by proclamation of the Lieutenant Governor. 2015, c. 20, Sched. 28, s. 1. Section Amendments with date in force (d/m/y) 2015, c. 20, Sched. 28, s. 1 - 04/06/2015 Other Acts 53 (1) This Act prevails over a confidentiality provision in any other Act unless the other Act or this Act specifically provides otherwise. R.S.O. 1990, c. M.56, s. 53 (1). Idem (2) The following confidentiality provisions prevail over this Act: 1. Subsection 88 (6) of the Municipal Elections Act, 1996. 2. Subsection 53 (1) of the Assessment Act. R.S.O. 1990, c. M.56, s. 53 (2); 1996, c. 32, s. 77. Section Amendments with date in force (d/m/y) 1996, c. 32, s. 77 - 19/12/1996 Exercise of rights of deceased, etc., persons 54 Any right or power conferred on an individual by this Act may be exercised, (a) if the individual is deceased, by the individual’s personal representative if exercise of the right or power relates to the administration of the individual’s estate; (b) by the individual’s attorney under a continuing power of attorney, the individual’s attorney under a power of attorney for personal care, the individual’s guardian of the person, or the individual’s guardian of property; and (c) if the individual is less than sixteen years of age, by a person who has lawful custody of the individual. R.S.O. 1990, c. M.56, s. 54; 1992, c. 32, s. 23; 1996, c. 2, s. 73. Section Amendments with date in force (d/m/y) 1992, c. 32, s. 23 - 03/04/1995 1996, c. 2, s. 73 - 29/03/1996 55 Repealed: 2006, c. 34, Sched. C, s. 21. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 21 - 01/04/2007 ______________