Freedom of Information and Protection of Privacy Act, R.S.O. 1990, c. F.31

CONTENTS 1. Purposes 1.1 Limited application re Assembly 2. Definitions PART I ADMINISTRATION 3. Responsible minister 4. Information and Privacy Commissioner 5. Term of office 6. Removal or suspension 7. Salary and benefits 7.1 Designation by Commissioner 7.2 Temporary Commissioner 7.3 Subsequent appointment not prohibited 7.4 Restrictions re other work, etc. 7.5 Oath of office 7.6 Nature of office 7.7 Protection from liability 8. Staff 9. Financial PART II FREEDOM OF INFORMATION Access to Records 10. Right of access 10.1 Measures to ensure preservation of records 11. Obligation to disclose Exemptions 12. Cabinet records 13. Advice to government 14. Law enforcement 14.1 Civil Remedies Act, 2001 14.2 Prohibiting Profiting from Recounting Crimes Act, 2002 15. Relations with other governments 15.1 Relations with Aboriginal communities 16. Defence 17. Third party information 18. Economic and other interests of Ontario 18.1 Information with respect to closed meetings 19. Solicitor-client privilege 20. Danger to safety or health 21. Personal privacy 21.1 Species at risk 22. Information soon to be published 23. Exemptions not to apply Access Procedure 24. Request 24.1 Plan for staged access to records 24.2 Requester’s response to plan 25. Request to be forwarded 26. Notice by head 27. Extension of time 27.1 Frivolous request 28. Notice to affected person 29. Contents of notice of refusal 30. Copy of record Information to be Published or Available 31. Publication of information re institutions 32. Operation of institutions 33. Institution documents 34. Annual report of head 35. Documents made available 36. Information from heads 36.1 Extra-ministerial data integration units PART III PROTECTION OF INDIVIDUAL PRIVACY Collection and Retention of Personal Information 37. Application of Part 38. Personal information 39. Manner of collection 40. Retention and protection of personal information 40.1 Breach of privacy safeguards Use and Disclosure of Personal Information 41. Use of personal information 42. Where disclosure permitted 43. Consistent purpose Right of Individual to Whom Personal Information Relates to Access and Correction 47. Rights of access and correction 48. Requests and manner of access 49. Exemptions 49.0.1 Commissioner’s review of information practices PART III.1 DATA INTEGRATION 49.1 Definitions 49.1.1 Application of Act to extra-ministerial data integration units 49.2 Purpose for the collection of personal information 49.3 General rules re personal information 49.4 Collection of personal information 49.5 Restrictions on collection 49.6 Linking and de-identification 49.7 Limits on use of personal information 49.8 Limits on use of de-identified information 49.9 Disclosure of personal information 49.10 Notice of collection 49.11 Security and retention 49.12 Commissioner’s review of practices 49.13 Annual report 49.14 Data standards 49.14.1 Commissioner’s comments and recommendations 49.15 Regulations PART IV APPEAL 50. Right to appeal 51. Mediator to try to effect settlement 52. Inquiry 53. Burden of proof 54. Order 55. Confidentiality 56. Delegation by Commissioner PART V GENERAL 57. Fees 57.1 Whistleblowing 58. Annual report of Commissioner 59. Powers and duties of Commissioner 60. Regulations 61. Offences 62. Delegation, civil proceedings 63. Informal access 64. Information otherwise available 65. Application of Act 65.1 Service provider organizations 65.2 Public consultation before making regulations 65.3 Non-application re: certain corporations 66. Exercise of rights of deceased, etc., persons 67. Conflict with other Act 69. Application 70. Crown bound Purposes 1 The purposes of this Act are, (a) to provide a right of access to information under the control of institutions in accordance with the principles that, (i) information should be available to the public, (ii) necessary exemptions from the right of access should be limited and specific, and (iii) decisions on the disclosure of government information should be reviewed independently of government; and (b) to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information. R.S.O. 1990, c. F.31, s. 1. Limited application re Assembly 1.1 (1) This Act applies to the Assembly, but only in respect of records of reviewable expenses of the Opposition leaders and the persons employed in their offices and in respect of the personal information contained in those records. 2002, c. 34, Sched. B, s. 2. Same (2) Sections 11, 31, 32, 33, 34 and 36 do not apply with respect to the Assembly. 2002, c. 34, Sched. B, s. 2; 2026, c. 2, Sched. 7, s. 1. Definitions (3) In this section, “Opposition leader” has the same meaning as in section 1 of the Cabinet Ministers’ and Opposition Leaders’ Expenses Review and Accountability Act, 2002; (“chef d’un parti de l’opposition”) “reviewable expense” means a reviewable expense as described in section 3 of the Cabinet Ministers’ and Opposition Leaders’ Expenses Review and Accountability Act, 2002. (“dépense sujette à examen”) 2002, c. 34, Sched. B, s. 2. Section Amendments with date in force (d/m/y) 2002, c. 34, Sched. B, s. 2 - 01/01/2003 2014, c. 13, Sched. 4, s. 8 - see Table of Public Statute Provisions Repealed Under Section 10.1 of the Legislation Act, 2006 - 31/12/2024 2026, c. 2, Sched. 7, s. 1 - 01/07/2026 Definitions 2 (1) In this Act, “close relative” means a parent, child, grandparent, grandchild, brother, sister, uncle, aunt, nephew or niece, including by adoption; (“proche parent”) “ecclesiastical records” means the operational, administrative and theological records, including records relating to the practice of faith, of a church or other religious organization; (“documents ecclésiastiques”) “educational institution” means an institution that is a college of applied arts and technology or a university; (“établissement d’enseignement”) “head”, in respect of an institution, means, (0.a) in the case of the Assembly, the Speaker, (a) in the case of a ministry, the minister of the Crown who presides over the ministry, (a.1) in the case of a public hospital, the chair of the board of the hospital, (a.2) in the case of a private hospital, the superintendent, (a.3) in the case of the University of Ottawa Heart Institute/Institut de cardiologie de l’Université d’Ottawa, the Chair of the board, and (b) in the case of any other institution, the person designated as head of that institution in the regulations; (“personne responsable”) “hospital” means, (a) a public hospital, (b) a private hospital, and (c) the University of Ottawa Heart Institute/Institut de cardiologie de l’Université d’Ottawa; (“hôpital”) “Information and Privacy Commissioner” and “Commissioner” mean the Commissioner appointed under subsection 4 (2); (“commissaire à l’information et à la protection de la vie privée”, “commissaire”) “information practices” means the practices and procedures of an institution for actions in relation to personal information, including, (a) when, how and the purposes for which the institution collects, uses, modifies, discloses, retains or disposes of personal information, and (b) the administrative, technical and physical safeguards and practices that the institution maintains with respect to protecting the information; (“pratiques relatives aux renseignements”) “institution” means, (0.a) the Assembly, (a) a ministry of the Government of Ontario, (a.1) a service provider organization within the meaning of section 17.1 of the Ministry of Government Services Act, (a.2) a hospital, and (b) any agency, board, commission, corporation or other body designated as an institution in the regulations; (“institution”) “law enforcement” means, (a) policing, (b) investigations or inspections that lead or could lead to proceedings in a court or tribunal if a penalty or sanction could be imposed in those proceedings, or (c) the conduct of proceedings referred to in clause (b); (“exécution de la loi”) “personal information” means recorded information about an identifiable individual, including, (a) information relating to the race, national or ethnic origin, colour, religion, age, sex, sexual orientation or marital or family status of the individual, (b) information relating to the education or the medical, psychiatric, psychological, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved, (c) any identifying number, symbol or other particular assigned to the individual, (d) the address, telephone number, fingerprints or blood type of the individual, (e) the personal opinions or views of the individual except where they relate to another individual, (f) correspondence sent to an institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to that correspondence that would reveal the contents of the original correspondence, (g) the views or opinions of another individual about the individual, and (h) the individual’s name where it appears with other personal information relating to the individual or where the disclosure of the name would reveal other personal information about the individual; (“renseignements personnels”) “private hospital” means a private hospital within the meaning of the Private Hospitals Act; (“hôpital privé”) “public hospital” means a hospital within the meaning of the Public Hospitals Act; (“hôpital public”) “recognized party” has the same meaning as in subsection 62 (5) of the Legislative Assembly Act; (“parti reconnu”) “record” means any record of information however recorded, whether in printed form, on film, by electronic means or otherwise, and includes, (a) data, in any form, and any record made, recorded, transmitted or stored in digital form or in other intangible form by electronic, magnetic, optical or any other means, and (b) subject to the regulations, any record that is capable of being produced from a machine readable record under the control of an institution by means of computer hardware and software or any other information storage equipment and technical expertise normally used by the institution; (“document”) “regulations” means the regulations made under this Act; (“règlements”) “responsible minister” means the minister of the Crown who is designated by order of the Lieutenant Governor in Council under section 3; (“ministre responsable”) “spouse” means, (a) a spouse as defined in section 1 of the Family Law Act, or (b) either of two persons who live together in a conjugal relationship outside marriage. (“conjoint”) R.S.O. 1990, c. F.31, s. 2 (1); 2002, c. 34, Sched. B, s. 3; 2005, c. 28, Sched. F, s. 1 (1, 3); 2006, c. 19, Sched. N, s. 1 (1); 2006, c. 34, Sched. C, s. 1; 2006, c. 34, Sched. F, s. 1 (1); 2010, c. 25, s. 24 (1-5); 2016, c. 23, s. 49 (1); 2018, c. 17, Sched. 19, s. 1; 2021, c. 4, Sched. 11, s. 11; 2024, c. 24, Sched. 2, s. 1; 2026, c. 2, Sched. 7, s. 2 (1, 2). Personal information (2) Personal information does not include information about an individual who has been dead for more than thirty years. R.S.O. 1990, c. F.31, s. 2 (2). Business identity information, etc. (3) Personal information does not include the name, title, contact information or designation of an individual that identifies the individual in a business, professional or official capacity. 2006, c. 34, Sched. C, s. 2. Same (4) For greater certainty, subsection (3) applies even if an individual carries out business, professional or official responsibilities from their dwelling and the contact information for the individual relates to that dwelling. 2006, c. 34, Sched. C, s. 2. Business days (5) For the purposes of this Act, a business day is any day that is not a Saturday or a holiday. 2026, c. 2, Sched. 7, s. 2 (3). Section Amendments with date in force (d/m/y) 2002, c. 34, Sched. B, s. 3 (1, 2) - 01/01/2003 2005, c. 28, Sched. F, s. 1 (1) - 10/06/2006; 2005, c. 28, Sched. F, s. 1 (3) - 22/06/2006 2006, c. 19, Sched. N, s. 1 (1) - 22/06/2006; 2006, c. 34, Sched. C, s. 1 (1, 2), 2 - 01/04/2007; 2006, c. 34, Sched. F, s. 1 (1) - 01/04/2007 2010, c. 25, s. 24 (1-5) - 01/01/2012 2016, c. 23, s. 49 (1) - 01/01/2017 2017, c. 25, Sched. 9, s. 94 (1-4) - no effect - see 2023, c. 4, Sched. 1, s. 67 - 18/05/2023 2018, c. 17, Sched. 19, s. 1 (1, 2) - 06/12/2018 2021, c. 4, Sched. 11, s. 11 - 19/04/2021 2024, c. 24, Sched. 2, s. 1 - 01/07/2025 2026, c. 2, Sched. 7, s. 2 (1-3) - 01/07/2026 PART I ADMINISTRATION Responsible minister 3 The Lieutenant Governor in Council may by order designate a minister of the Crown to be the responsible minister for the purposes of this Act. R.S.O. 1990, c. F.31, s. 3. Information and Privacy Commissioner 4 (1) There shall be an Information and Privacy Commissioner who is an officer of the Assembly. 2018, c. 17, Sched. 19, s. 2. Appointment (2) The Assembly shall, by order, appoint the Information and Privacy Commissioner. 2018, c. 17, Sched. 19, s. 2. Selection by panel (3) Unless decided otherwise by unanimous consent of the Assembly, an order shall be made under subsection (2) only if the person to be appointed has been selected by unanimous agreement of a panel composed of one member of the Assembly from each recognized party, chaired by the Speaker who is a non-voting member. 2018, c. 17, Sched. 19, s. 2. Powers and duties (3.1) The Commissioner may exercise the powers and shall perform the duties prescribed by this or any other Act. 2018, c. 17, Sched. 19, s. 2. Assistant Commissioners (4) From the officers of the Commissioner’s staff, the Commissioner shall appoint one or two Assistant Commissioners and may appoint an Assistant Commissioner for Personal Health Information. 2004, c. 3, Sched. A, s. 81 (1). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 81 (1) - 01/11/2004 2018, c. 17, Sched. 19, s. 2 - 06/12/2018 Term of office 5 (1) The Commissioner shall hold office for a term of five years and may be reappointed for one further term of five years. 2018, c. 17, Sched. 19, s. 3. Selection by panel (2) Subsection 4 (3) applies with respect to a reappointment under subsection (1) of this section. 2018, c. 17, Sched. 19, s. 3. Continuation in office (3) By order of the Assembly, the Commissioner may continue to hold office after expiry of his or her term of office until a temporary Commissioner is appointed under section 7.2 or until a successor is appointed. 2018, c. 17, Sched. 19, s. 3. Transition (4) The Commissioner in office immediately before the day the Restoring Trust, Transparency and Accountability Act, 2018 receives Royal Assent is deemed to be in the first term of his or her appointment and shall continue to hold office for the remainder of the term. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 1996, c. 6, s. 2 - 25/04/1996 2006, c. 35, Sched. C, s. 47 (1) - 20/08/2007 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Removal or suspension 6 (1) The Assembly may, by order passed by a vote of at least two thirds of the members of the Assembly, remove or suspend the Commissioner from office for cause. 2018, c. 17, Sched. 19, s. 3. Suspension if Assembly not in session (2) If the Assembly is not in session, the Board of Internal Economy may on unanimous agreement suspend the Commissioner for cause. 2018, c. 17, Sched. 19, s. 3. Duration of suspension (3) A suspension under subsection (1) continues until revoked by order of the Assembly or until the Commissioner is removed from office pursuant to subsection (1). 2018, c. 17, Sched. 19, s. 3. Same (4) Unless the Board of Internal Economy revokes the suspension before the next sitting of the Assembly, a suspension under subsection (2) continues until revoked by order of the Assembly or until the Commissioner is removed from office pursuant to subsection (1). 2018, c. 17, Sched. 19, s. 3. Same (5) Despite subsection (4), no suspension imposed under subsection (2) continues past the 20th sessional day of the next sitting of the Assembly. 2018, c. 17, Sched. 19, s. 3. Report to Assembly (6) The Board of Internal Economy shall report to the Assembly any action taken under subsections (2) and (4) at the earliest opportunity of the next sitting of the Assembly. 2018, c. 17, Sched. 19, s. 3. Meaning of “not in session” (7) For the purposes of this section and sections 7.2 and 7.4, the Assembly is not in session when it is, (a) prorogued; or (b) adjourned for an indefinite period or to a day that is more than seven days after the date on which the Assembly was adjourned. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 1996, c. 6, s. 3 - 25/04/1996 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Salary and benefits 7 (1) The Board of Internal Economy shall determine the salary and benefits of the Commissioner. 2018, c. 17, Sched. 19, s. 3. Pension plan (2) Subject to subsections (3) and (4), the Commissioner is a member of the Public Service Pension Plan. 2018, c. 17, Sched. 19, s. 3. Notice re pension plan (3) Within 60 days after his or her appointment takes effect, the Commissioner may notify the Speaker in writing that he or she elects not to be a member of the Public Service Pension Plan. 2018, c. 17, Sched. 19, s. 3. Same (4) If the Commissioner gives notice of their election to the Speaker in accordance with subsection (3), the election is irrevocable and is deemed to have taken effect when the appointment took effect. 2018, c. 17, Sched. 19, s. 3. Expenses (5) Subject to the approval of the Board of Internal Economy, the Commissioner is entitled to be reimbursed for reasonable expenses that he or she incurs in respect of anything done under this Act. 2018, c. 17, Sched. 19, s. 3. Transition (6) The salary and expenses of the Commissioner in office immediately before the day the Restoring Trust, Transparency and Accountability Act, 2018 receives Royal Assent continue to be determined in accordance with subsections 6 (1) to (3) of this Act, as they read immediately before that day, for the remainder of the Commissioner’s term of office. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Designation by Commissioner 7.1 (1) The Commissioner shall designate an individual from among the employees of the office of the Commissioner who shall have the powers and duties of the Commissioner if the Commissioner is absent or unable to fulfil the duties of his or her office or if the office becomes vacant. 2018, c. 17, Sched. 19, s. 3. Designation in writing (2) A designation under subsection (1) shall be in writing to the Speaker. 2018, c. 17, Sched. 19, s. 3. Powers and duties (3) The individual designated under subsection (1) shall have the powers and duties of the Commissioner unless a temporary Commissioner is appointed under section 7.2. 2018, c. 17, Sched. 19, s. 3. Salary (4) The Board of Internal Economy may increase the salary of an individual who assumes the powers and duties of the Commissioner under subsection (1) in such circumstances as the Board considers appropriate. 2018, c. 17, Sched. 19, s. 3. Removal or suspension (5) Section 6 applies in respect of an individual who assumes the powers and duties of the Commissioner under subsection (1). 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Temporary Commissioner 7.2 (1) If the Commissioner is unable to fulfil the duties of his or her office or the office becomes vacant, the Assembly may, by order, appoint a temporary Commissioner. 2018, c. 17, Sched. 19, s. 3. Same, conditions (2) An order shall be made under subsection (1) only if, (a) the Commissioner, (i) has not made a designation under subsection 7.1 (1), or (ii) has made a designation under subsection 7.1 (1), but, (A) the Commissioner has been removed or suspended under section 6, or (B) the person designated is unable or unwilling to act or has been removed or suspended under section 6; and (b) unless decided otherwise by unanimous consent of the Assembly, the person to be appointed has been selected by unanimous agreement of a panel composed of one member of the Assembly from each recognized party, chaired by the Speaker who is a non-voting member. 2018, c. 17, Sched. 19, s. 3. Appointment if Assembly not in session (3) If, while the Assembly is not in session, the Commissioner is unable to fulfil the duties of his or her office or the office becomes vacant, the Board of Internal Economy may appoint a temporary Commissioner. 2018, c. 17, Sched. 19, s. 3. Same (4) Clause (2) (a) applies with respect to an appointment under subsection (3). 2018, c. 17, Sched. 19, s. 3. Powers, salary and benefits (5) A temporary Commissioner shall have the powers and duties of the Commissioner and shall be paid a salary and benefits determined by the Board of Internal Economy and, subject to the approval of the Board, be reimbursed for reasonable expenses that he or she incurs in respect of anything done under this Act. 2018, c. 17, Sched. 19, s. 3. Duration of office (6) A temporary Commissioner shall hold office until, (a) the Commissioner is able to fulfil the duties of the office, where the appointment resulted from the Commissioner being unable to do so; (b) where the appointment resulted from a suspension of the Commissioner, the suspension is revoked by order of the Assembly, by the Board of Internal Economy under subsection 6 (4) or by operation of subsection 6 (5); (c) the Assembly appoints a different temporary Commissioner under subsection (1); or (d) the Assembly appoints a Commissioner under section 4. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Subsequent appointment not prohibited 7.3 A person who continues his or her first term as Commissioner under subsection 5 (3) or who is appointed as an Assistant Commissioner or temporary Commissioner is not prohibited from a subsequent appointment as Commissioner under section 4 and, in the case of such an appointment, the previous time in office does not count toward the term of office set out in subsection 5 (1). 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Restrictions re other work, etc. 7.4 (1) The Commissioner shall not be a member of the Assembly and shall not, without prior approval by the Assembly, or by the Board of Internal Economy when the Assembly is not in session, hold any other office or employment. 2018, c. 17, Sched. 19, s. 3. Exception (2) Despite subsection (1), the Commissioner may hold more than one office to which he or she has been appointed by the Assembly or the Board of Internal Economy. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Oath of office 7.5 (1) Before beginning the duties of his or her office, the Commissioner shall take an oath or affirmation that he or she will faithfully and impartially exercise the functions of the office. 2018, c. 17, Sched. 19, s. 3. Same (2) The Speaker or the Clerk of the Assembly shall administer the oath or affirmation. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Nature of office 7.6 (1) The Commissioner holds office for a fixed term. 2018, c. 17, Sched. 19, s. 3. Notice not required (2) No notice to the Commissioner is required before the expiry of the Commissioner’s term of office. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Protection from liability 7.7 (1) No cause of action arises, no proceeding may be brought and no remedy is available or damages, costs or compensation payable in connection with any amendment made by Schedule 19 to the Restoring Trust, Transparency and Accountability Act, 2018 to this Act or anything done or not done in accordance with those amendments. 2018, c. 17, Sched. 19, s. 3. Same (2) Subsection (1) applies whether the cause of action on which a proceeding is based arose before or after the day that subsection comes into force. 2018, c. 17, Sched. 19, s. 3. Proceedings set aside (3) Any proceeding referred to in subsection (1) commenced before the day that subsection comes into force is deemed to have been dismissed, without costs, on that day. 2018, c. 17, Sched. 19, s. 3. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 3 - 06/12/2018 Staff 8 (1) Subject to the approval of the Board of Internal Economy, the Commissioner may employ mediators and any other officers and employees the Commissioner considers necessary for the efficient operation of the office and may determine their salary and remuneration and terms and conditions of employment. R.S.O. 1990, c. F.31, s. 8 (1); 2018, c. 17, Sched. 19, s. 4. Benefits (2) The benefits determined under Part III of the Public Service of Ontario Act, 2006 with respect to the following matters for public servants employed under that Part to work in a ministry, other than in a minister’s office, who are not within a bargaining unit apply to the employees of the office of the Commissioner: 1. Cumulative vacation and sick leave credits for regular attendance and payments in respect of such credits. 2. Plans for group life insurance, medical-surgical insurance or long-term income protection. 3. The granting of leaves of absence. 2006, c. 35, Sched. C, s. 47 (2). Same (2.1) For the purposes of subsection (2), if a benefit applicable to an employee of the office of the Commissioner is contingent on the exercise of a discretionary power or the performance of a discretionary function, the power may be exercised or the function may be performed by the Commissioner or any person authorized in writing by the Commissioner. 2006, c. 35, Sched. C, s. 47 (2). Public Service Pension Plan (3) The Commissioner shall be deemed to have been designated by the Lieutenant Governor in Council under the Public Service Pension Act as a commission whose permanent and probationary staff are required to be members of the Public Service Pension Plan. R.S.O. 1990, c. F.31, s. 8 (3). Section Amendments with date in force (d/m/y) 2006, c. 35, Sched. C, s. 47 (2) - 20/08/2007 2018, c. 17, Sched. 19, s. 4 - 06/12/2018 Financial Premises and supplies 9 (1) The Commissioner may lease any premises and acquire any equipment and supplies necessary for the efficient operation of the office of the Commissioner. R.S.O. 1990, c. F.31, s. 9 (1). Audit (2) The accounts and financial transactions of the office of the Commissioner shall be audited annually by the Auditor General. R.S.O. 1990, c. F.31, s. 9 (2); 2004, c. 17, s. 32. Section Amendments with date in force (d/m/y) 2004, c. 17, s. 32 - 30/11/2004 PART II FREEDOM OF INFORMATION Access to Records Right of access 10 (1) Subject to subsections (1.1) and 69 (2), every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless, (a) the record or the part of the record falls within one of the exemptions under sections 12 to 22; or (b) the head is of the opinion on reasonable grounds that the request for access is frivolous or vexatious. 1996, c. 1, Sched. K, s. 1; 2010, c. 25, s. 24 (6); 2019, c. 7, Sched. 31, s. 1 (1). Part III.1 records (1.1) Subsection (1) does not apply to personal information collected under Part III.1 (Data Integration) or to records produced from that information under that Part that are not de-identified. 2019, c. 7, Sched. 31, s. 1 (2). Severability of record (2) If an institution receives a request for access to a record that contains information that falls within one of the exemptions under sections 12 to 22 and the head of the institution is not of the opinion that the request is frivolous or vexatious, the head shall disclose as much of the record as can reasonably be severed without disclosing the information that falls under one of the exemptions. 1996, c. 1, Sched. K, s. 1. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 1 - 30/01/1996 2010, c. 25, s. 24 (6) - 01/01/2012 2019, c. 7, Sched. 31, s. 1 (1, 2) - 04/11/2019 Measures to ensure preservation of records 10.1 Every head of an institution shall ensure that reasonable measures respecting the records in the custody or under the control of the institution are developed, documented and put into place to preserve the records in accordance with any recordkeeping or records retention requirements, rules or policies, whether established under an Act or otherwise, that apply to the institution. 2014, c. 13, Sched. 6, s. 1. Section Amendments with date in force (d/m/y) 2014, c. 13, Sched. 6, s. 1 - 01/01/2016 Obligation to disclose 11 (1) Despite any other provision of this Act, a head shall, as soon as practicable, disclose any record to the public or persons affected if the head has reasonable and probable grounds to believe that it is in the public interest to do so and that the record reveals a grave environmental, health or safety hazard to the public. R.S.O. 1990, c. F.31, s. 11 (1). Notice (2) Before disclosing a record under subsection (1), the head shall cause notice to be given to any person to whom the information in the record relates, if it is practicable to do so. R.S.O. 1990, c. F.31, s. 11 (2). Contents of notice (3) The notice shall contain, (a) a statement that the head intends to release a record or a part of a record that may affect the interests of the person; (b) a description of the contents of the record or part that relate to the person; and (c) a statement that if the person makes representations forthwith to the head as to why the record or part thereof should not be disclosed, those representations will be considered by the head. R.S.O. 1990, c. F.31, s. 11 (3). Representations (4) A person who is given notice under subsection (2) may make representations forthwith to the head concerning why the record or part should not be disclosed. R.S.O. 1990, c. F.31, s. 11 (4). Exemptions Cabinet records 12 (1) A head shall refuse to disclose a record where the disclosure would reveal the substance of deliberations of the Executive Council or its committees, including, (a) an agenda, minute or other record of the deliberations or decisions of the Executive Council or its committees; (b) a record containing policy options or recommendations submitted, or prepared for submission, to the Executive Council or its committees; (c) a record that does not contain policy options or recommendations referred to in clause (b) and that does contain background explanations or analyses of problems submitted, or prepared for submission, to the Executive Council or its committees for their consideration in making decisions, before those decisions are made and implemented; (d) a record used for or reflecting consultation among ministers of the Crown on matters relating to the making of government decisions or the formulation of government policy; (e) a record prepared to brief a minister of the Crown in relation to matters that are before or are proposed to be brought before the Executive Council or its committees, or are the subject of consultations among ministers relating to government decisions or the formulation of government policy; and (f) draft legislation or regulations. R.S.O. 1990, c. F.31, s. 12 (1). Exception (2) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record where, (a) the record is more than twenty years old; or (b) the Executive Council for which, or in respect of which, the record has been prepared consents to access being given. R.S.O. 1990, c. F.31, s. 12 (2). Advice to government 13 (1) A head may refuse to disclose a record where the disclosure would reveal advice or recommendations of a public servant, any other person employed in the service of an institution or a consultant retained by an institution. R.S.O. 1990, c. F.31, s. 13 (1). Exception (2) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record that contains, (a) factual material; (b) a statistical survey; (c) a report by a valuator, whether or not the valuator is an officer of the institution; (d) an environmental impact statement or similar record; (e) a report of a test carried out on a product for the purpose of government equipment testing or a consumer test report; (f) a report or study on the performance or efficiency of an institution, whether the report or study is of a general nature or is in respect of a particular program or policy; (g) a feasibility study or other technical study, including a cost estimate, relating to a government policy or project; (h) a report containing the results of field research undertaken before the formulation of a policy proposal; (i) a final plan or proposal to change a program of an institution, or for the establishment of a new program, including a budgetary estimate for the program, whether or not the plan or proposal is subject to approval, unless the plan or proposal is to be submitted to the Executive Council or its committees; (j) a report of an interdepartmental committee task force or similar body, or of a committee or task force within an institution, which has been established for the purpose of preparing a report on a particular topic, unless the report is to be submitted to the Executive Council or its committees; (k) a report of a committee, council or other body which is attached to an institution and which has been established for the purpose of undertaking inquiries and making reports or recommendations to the institution; (l) the reasons for a final decision, order or ruling of an officer of the institution made during or at the conclusion of the exercise of discretionary power conferred by or under an enactment or scheme administered by the institution, whether or not the enactment or scheme allows an appeal to be taken against the decision, order or ruling, whether or not the reasons, (i) are contained in an internal memorandum of the institution or in a letter addressed by an officer or employee of the institution to a named person, or (ii) were given by the officer who made the decision, order or ruling or were incorporated by reference into the decision, order or ruling. R.S.O. 1990, c. F.31, s. 13 (2). Idem (3) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record where the record is more than twenty years old or where the head has publicly cited the record as the basis for making a decision or formulating a policy. R.S.O. 1990, c. F.31, s. 13 (3); 2016, c. 5, Sched. 10, s. 1. Section Amendments with date in force (d/m/y) 2016, c. 5, Sched. 10, s. 1 - 19/04/2016 Law enforcement 14 (1) A head may refuse to disclose a record where the disclosure could reasonably be expected to, (a) interfere with a law enforcement matter; (b) interfere with an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result; (c) reveal investigative techniques and procedures currently in use or likely to be used in law enforcement; (d) disclose the identity of a confidential source of information in respect of a law enforcement matter, or disclose information furnished only by the confidential source; (e) endanger the life or physical safety of a law enforcement officer or any other person; (f) deprive a person of the right to a fair trial or impartial adjudication; (g) interfere with the gathering of or reveal law enforcement intelligence information respecting organizations or persons; (h) reveal a record which has been confiscated from a person by a peace officer in accordance with an Act or regulation; (i) endanger the security of a building or the security of a vehicle carrying items, or of a system or procedure established for the protection of items, for which protection is reasonably required; (j) facilitate the escape from custody of a person who is under lawful detention; (k) jeopardize the security of a centre for lawful detention; or (l) facilitate the commission of an unlawful act or hamper the control of crime. R.S.O. 1990, c. F.31, s. 14 (1); 2002, c. 18, Sched. K, s. 1 (1); 2019, c. 7, Sched. 31, s. 2. Idem (2) A head may refuse to disclose a record, (a) that is a report prepared in the course of law enforcement, inspections or investigations by an agency which has the function of enforcing and regulating compliance with a law; (b) that is a law enforcement record where the disclosure would constitute an offence under an Act of Parliament; (c) that is a law enforcement record where the disclosure could reasonably be expected to expose the author of the record or any person who has been quoted or paraphrased in the record to civil liability; or (d) that contains information about the history, supervision or release of a person under the control or supervision of a correctional authority. R.S.O. 1990, c. F.31, s. 14 (2); 2002, c. 18, Sched. K, s. 1 (2). Refusal to confirm or deny existence of record (3) A head may refuse to confirm or deny the existence of a record to which subsection (1) or (2) apply. R.S.O. 1990, c. F.31, s. 14 (3). Exception (4) Despite clause (2) (a), a head shall disclose a record that is a report prepared in the course of routine inspections by an agency where that agency is authorized to enforce and regulate compliance with a particular statute of Ontario. R.S.O. 1990, c. F.31, s. 14 (4). Idem (5) Subsections (1) and (2) do not apply to a record on the degree of success achieved in a law enforcement program including statistical analyses unless disclosure of such a record may prejudice, interfere with or adversely affect any of the matters referred to in those subsections. R.S.O. 1990, c. F.31, s. 14 (5). Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 1 (1) - 26/11/2002 2019, c. 7, Sched. 31, s. 2 - 04/11/2019 Civil Remedies Act, 2001 14.1 A head may refuse to disclose a record and may refuse to confirm or deny the existence of a record if disclosure of the record could reasonably be expected to interfere with the ability of the Attorney General to determine whether a proceeding should be commenced under the Civil Remedies Act, 2001, conduct a proceeding under that Act or enforce an order made under that Act. 2001, c. 28, s. 22 (1); 2002, c. 18, Sched. K, s. 2; 2007, c. 13, s. 43 (1). Section Amendments with date in force (d/m/y) 2001, c. 28, s. 22 (1) - 12/04/2002 2002, c. 18, Sched. K, s. 2 - 26/11/2002 2007, c. 13, s. 43 (1) - 04/06/2007 Prohibiting Profiting from Recounting Crimes Act, 2002 14.2 A head may refuse to disclose a record and may refuse to confirm or deny the existence of a record if disclosure of the record could reasonably be expected to interfere with the ability of the Attorney General to determine whether a proceeding should be commenced under the Prohibiting Profiting from Recounting Crimes Act, 2002, conduct a proceeding under that Act or enforce an order made under that Act. 2002, c. 2, ss. 15 (1), 19 (4); 2002, c. 18, Sched. K, s. 3. Section Amendments with date in force (d/m/y) 2002, c. 2, s. 15 (1) - 01/07/2003; 2002, c. 18, Sched. K, s. 3 - 26/11/2002 Relations with other governments 15 A head may refuse to disclose a record where the disclosure could reasonably be expected to, (a) prejudice the conduct of intergovernmental relations by the Government of Ontario or an institution; (b) reveal information received in confidence from another government or its agencies by an institution; or (c) reveal information received in confidence from an international organization of states or a body thereof by an institution, and shall not disclose any such record without the prior approval of the Executive Council. R.S.O. 1990, c. F.31, s. 15; 2002, c. 18, Sched. K, s. 4; 2024, c. 24, Sched. 2, s. 2. Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 4 - 26/11/2002 2024, c. 24, Sched. 2, s. 2 (1, 2) - 29/01/2025 Relations with Aboriginal communities 15.1 (1) A head may refuse to disclose a record where the disclosure could reasonably be expected to, (a) prejudice the conduct of relations between an Aboriginal community and the Government of Ontario or an institution; or (b) reveal information received in confidence from an Aboriginal community by an institution. 2017, c. 8, Sched. 13, s. 1. Definition (2) In this section, “Aboriginal community” means, (a) a band within the meaning of the Indian Act (Canada), (b) an Aboriginal organization or community that is negotiating or has negotiated with the Government of Canada or the Government of Ontario on matters relating to, (i) Aboriginal or treaty rights under section 35 of the Constitution Act, 1982, or (ii) a treaty, land claim or self-government agreement, and (c) any other Aboriginal organization or community prescribed by the regulations. 2017, c. 8, Sched. 13, s. 1. Section Amendments with date in force (d/m/y) 2017, c. 8, Sched. 13, s. 1 - 09/03/2018 Defence 16 A head may refuse to disclose a record where the disclosure could reasonably be expected to prejudice the defence of Canada or of any foreign state allied or associated with Canada or be injurious to the detection, prevention or suppression of espionage, sabotage or terrorism and shall not disclose any such record without the prior approval of the Executive Council. R.S.O. 1990, c. F.31, s. 16; 2002, c. 18, Sched. K, s. 5. Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 5 - 26/11/2002 Third party information 17 (1) A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, where the disclosure could reasonably be expected to, (a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization; (b) result in similar information no longer being supplied to the institution where it is in the public interest that similar information continue to be so supplied; (c) result in undue loss or gain to any person, group, committee or financial institution or agency; or (d) reveal information supplied to or the report of a conciliation officer, mediator, labour relations officer or other person appointed to resolve a labour relations dispute. R.S.O. 1990, c. F.31, s. 17 (1); 2002, c. 18, Sched. K, s. 6; 2017, c. 8, Sched. 13, s. 2. Tax information (2) A head shall refuse to disclose a record that reveals information that was obtained on a tax return or gathered for the purpose of determining tax liability or collecting a tax. R.S.O. 1990, c. F.31, s. 17 (2). Consent to disclosure (3) A head may disclose a record described in subsection (1) or (2) if the person to whom the information relates consents to the disclosure. R.S.O. 1990, c. F.31, s. 17 (3). Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 6 - 26/11/2002 2017, c. 8, Sched. 13, s. 2 - 17/05/2017 Economic and other interests of Ontario 18 (1) A head may refuse to disclose a record that contains, (a) trade secrets or financial, commercial, scientific or technical information that belongs to the Government of Ontario or an institution and has monetary value or potential monetary value; (b) information obtained through research by an employee of an institution where the disclosure could reasonably be expected to deprive the employee of priority of publication; (c) information where the disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution; (d) information where the disclosure could reasonably be expected to be injurious to the financial interests of the Government of Ontario or the ability of the Government of Ontario to manage the economy of Ontario; (e) positions, plans, procedures, criteria or instructions to be applied to any negotiations carried on or to be carried on by or on behalf of an institution or the Government of Ontario; (f) plans relating to the management of personnel or the administration of an institution that have not yet been put into operation or made public; (g) information including the proposed plans, policies or projects of an institution where the disclosure could reasonably be expected to result in premature disclosure of a pending policy decision or undue financial benefit or loss to a person; (h) information relating to specific tests or testing procedures or techniques that are to be used for an educational purpose, if disclosure could reasonably be expected to prejudice the use or results of the tests or testing procedures or techniques; (i) submissions in respect of a matter under the Municipal Boundary Negotiations Act commenced before its repeal by the Municipal Act, 2001, by a party municipality or other body before the matter is resolved; (j) information provided in confidence to, or records prepared with the expectation of confidentiality by, a hospital committee to assess or evaluate the quality of health care and directly related programs and services provided by a hospital, if the assessment or evaluation is for the purpose of improving that care and the programs and services. R.S.O. 1990, c. F.31, s. 18 (1); 2002, c. 17, Sched. F, Table; 2002, c. 18, Sched. K, s. 7; 2005, c. 28, Sched. F, s. 2; 2011, c. 9, Sched. 15, s. 1. Exception (2) A head shall not refuse under subsection (1) to disclose a record that contains the results of product or environmental testing carried out by or for an institution, unless, (a) the testing was done as a service to a person, a group of persons or an organization other than an institution and for a fee; or (b) the testing was conducted as preliminary or experimental tests for the purpose of developing methods of testing. R.S.O. 1990, c. F.31, s. 18 (2). Section Amendments with date in force (d/m/y) 2002, c. 17, Sched. F, Table - 01/01/2003; 2002, c. 18, Sched. K, s. 7 (1-4) - 26/11/2002 2005, c. 28, Sched. F, s. 2 - 10/06/2006 2011, c. 9, Sched. 15, s. 1 - 01/01/2012 Information with respect to closed meetings 18.1 (1) A head may refuse to disclose a record that reveals the substance of deliberations of a meeting of the governing body or a committee of the governing body of an educational institution or a hospital if a statute authorizes holding the meeting in the absence of the public and the subject-matter of the meeting, (a) is a draft of a by-law, resolution or legislation; or (b) is litigation or possible litigation. 2005, c. 28, Sched. F, s. 3; 2010, c. 25, s. 24 (7). Exception (2) Despite subsection (1), the head shall not refuse to disclose a record under subsection (1) if, (a) the information is not held confidentially; (b) the subject-matter of the deliberations has been considered in a meeting open to the public; or (c) the record is more than 20 years old. 2005, c. 28, Sched. F, s. 3. Application of Act (3) The exemption in subsection (1) is in addition to any other exemptions in this Act. 2005, c. 28, Sched. F, s. 3. Section Amendments with date in force (d/m/y) 2005, c. 28, Sched. F, s. 3 - 10/06/2006 2010, c. 25, s. 24 (7) - 01/01/2012 Solicitor-client privilege 19 A head may refuse to disclose a record, (a) that is subject to solicitor-client privilege; (b) that was prepared by or for Crown counsel for use in giving legal advice or in contemplation of or for use in litigation; or (c) that was prepared by or for counsel employed or retained by an educational institution or a hospital for use in giving legal advice or in contemplation of or for use in litigation. 2005, c. 28, Sched. F, s. 4; 2010, c. 25, s.

24 (8). Section Amendments with date in force (d/m/y) 2005, c. 28, Sched. F, s. 4 - 10/06/2006 2010, c. 25, s. 24 (8) - 01/01/2012 Danger to safety or health 20 A head may refuse to disclose a record where the disclosure could reasonably be expected to seriously threaten the safety or health of an individual. R.S.O. 1990, c. F.31, s. 20; 2002, c. 18, Sched. K, s. 8. Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 8 - 26/11/2002 Personal privacy 21 (1) A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except, (a) upon the prior written request or consent of the individual, if the record is one to which the individual is entitled to have access; (b) in compelling circumstances affecting the health or safety of an individual, if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates; (c) personal information collected and maintained specifically for the purpose of creating a record available to the general public; (d) under an Act of Ontario or Canada that expressly authorizes the disclosure; (e) for a research purpose if, (i) the disclosure is consistent with the conditions or reasonable expectations of disclosure under which the personal information was provided, collected or obtained, (ii) the research purpose for which the disclosure is to be made cannot be reasonably accomplished unless the information is provided in individually identifiable form, and (iii) the person who is to receive the record has agreed to comply with the conditions relating to security and confidentiality prescribed by the regulations; or (f) if the disclosure does not constitute an unjustified invasion of personal privacy. R.S.O. 1990, c. F.31, s. 21 (1). Criteria re invasion of privacy (2) A head, in determining whether a disclosure of personal information constitutes an unjustified invasion of personal privacy, shall consider all the relevant circumstances, including whether, (a) the disclosure is desirable for the purpose of subjecting the activities of the Government of Ontario and its agencies to public scrutiny; (b) access to the personal information may promote public health and safety; (c) access to the personal information will promote informed choice in the purchase of goods and services; (d) the personal information is relevant to a fair determination of rights affecting the person who made the request; (e) the individual to whom the information relates will be exposed unfairly to pecuniary or other harm; (f) the personal information is highly sensitive; (g) the personal information is unlikely to be accurate or reliable; (h) the personal information has been supplied by the individual to whom the information relates in confidence; and (i) the disclosure may unfairly damage the reputation of any person referred to in the record. R.S.O. 1990, c. F.31, s. 21 (2). Presumed invasion of privacy (3) A disclosure of personal information is presumed to constitute an unjustified invasion of personal privacy where the personal information, (a) relates to a medical, psychiatric or psychological history, diagnosis, condition, treatment or evaluation; (b) was compiled and is identifiable as part of an investigation into a possible violation of law, except to the extent that disclosure is necessary to prosecute the violation or to continue the investigation; (c) relates to eligibility for social service or welfare benefits or to the determination of benefit levels; (d) relates to employment or educational history; (e) was obtained on a tax return or gathered for the purpose of collecting a tax; (f) describes an individual’s finances, income, assets, liabilities, net worth, bank balances, financial history or activities, or creditworthiness; (g) consists of personal recommendations or evaluations, character references or personnel evaluations; or (h) indicates the individual’s racial or ethnic origin, sexual orientation or religious or political beliefs or associations. R.S.O. 1990, c. F.31, s. 21 (3). Limitation (4) Despite subsection (3), a disclosure does not constitute an unjustified invasion of personal privacy if it, (a) discloses the classification, salary range and benefits, or employment responsibilities of an individual who is or was an officer or employee of an institution or a member of the staff of a minister; (b) discloses financial or other details of a contract for personal services between an individual and an institution; (c) discloses details of a licence or permit or a similar discretionary financial benefit conferred on an individual by an institution or a head under circumstances where, (i) the individual represents 1 per cent or more of all persons and organizations in Ontario receiving a similar benefit, and (ii) the value of the benefit to the individual represents 1 per cent or more of the total value of similar benefits provided to other persons and organizations in Ontario; or (d) discloses personal information about a deceased individual to the spouse or a close relative of the deceased individual, and the head is satisfied that, in the circumstances, the disclosure is desirable for compassionate reasons. R.S.O. 1990, c. F.31, s. 21 (4); 2006, c. 19, Sched. N, s. 1 (2). Refusal to confirm or deny existence of record (5) A head may refuse to confirm or deny the existence of a record if disclosure of the record would constitute an unjustified invasion of personal privacy. R.S.O. 1990, c. F.31, s. 21 (5). Section Amendments with date in force (d/m/y) 2006, c. 19, Sched. N, s. 1 (2) - 22/06/2006 Species at risk 21.1 A head may refuse to disclose a record where the disclosure could reasonably be expected to lead to a contravention of section 15 or 16 of the Species Conservation Act, 2025. 2025, c. 11, Sched. 11, s. 3. Section Amendments with date in force (d/m/y) 1997, c. 41, s. 118 (1) - 01/01/1999 2002, c. 18, Sched. K, s. 9 - 26/11/2002 2007, c. 6, s. 61 - 30/06/2008 2025, c. 11, Sched. 11, s. 3 - 30/03/2026 Information soon to be published 22 A head may refuse to disclose a record where, (a) the record or the information contained in the record has been published or is currently available to the public; or (b) the head believes on reasonable grounds that the record or the information contained in the record will be published by an institution within 90 days after the request is made or within such further period of time as may be necessary for printing or translating the material for the purpose of printing it. R.S.O. 1990, c. F.31, s. 22. Exemptions not to apply 23 An exemption from disclosure of a record under sections 13, 15, 15.1, 17, 18, 20, 21 and 21.1 does not apply where a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption. R.S.O. 1990, c. F.31, s. 23; 1997, c. 41, s. 118 (2); 2017, c. 8, Sched. 13, s. 3. Section Amendments with date in force (d/m/y) 1997, c. 41, s. 118 (2) - 01/01/1999 2017, c. 8, Sched. 13, s. 3 - 09/03/2018 Access Procedure Request 24 (1) A person seeking access to a record shall, (a) make a request in writing to the institution that the person believes has custody or control of the record, and specify that the request is being made under this Act; (b) provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record; and (c) at the time of making the request, pay the fee prescribed by the regulations for that purpose. 1996, c. 1, Sched. K, s. 2; 2017, c. 2, Sched. 12, s. 4 (1). Frivolous request (1.1) If the head of the institution is of the opinion on reasonable grounds that the request is frivolous or vexatious, subsections (2) to (5) do not apply to the request. 1996, c. 1, Sched. K, s. 2. Assistance with request (2) An institution shall make reasonable efforts to assist a person with formulating a request so as to comply with subsection (1) and shall, for that purpose, (a) respond, as soon as possible in the circumstances, to any inquiries from the person about formulating such a request; and (b) if a request is made that does not sufficiently describe the record sought, inform the person of the defect and offer assistance in reformulating the request. 2026, c. 2, Sched. 7, s. 3 (1). Request for continuing access to record (3) The person who made the request may indicate in the request that it shall, if granted, continue to have effect for a specified period of up to two years. R.S.O. 1990, c. F.31, s. 24 (3); 2026, c. 2, Sched. 7, s. 3 (2). Institution to provide schedule (4) When a request that is to continue to have effect is granted, the institution shall provide the person who made the request with, (a) a schedule showing dates in the specified period on which the request shall be deemed to have been received again, and explaining why those dates were chosen; and (b) a statement that the applicant may ask the Commissioner to review the schedule. R.S.O. 1990, c. F.31, s. 24 (4); 2026, c. 2, Sched. 7, s. 3 (2). Act applies as if new requests were being made (5) This Act applies as if a new request were being made on each of the dates shown in the schedule. R.S.O. 1990, c. F.31, s. 24 (5). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 2 - 30/01/1996 2017, c. 2, Sched. 12, s. 4 (1) - 22/03/2017 2026, c. 2, Sched. 7, s. 3 (1, 2) - 01/07/2026 Plan for staged access to records 24.1 (1) The head of an institution may, before the expiry of the time limit set out in section 26 or, where there has been an extension of a time limit under subsection 27 (1) or (1.1), within that extended time limit, respond to a request for records by proposing a plan for providing access to the records in stages if, (a) the time required to search for responsive records would unreasonably interfere with the regular duties of employees of the institution; (b) the scope of the request is overly broad because of the period of time it covers; (c) the preparation of responsive records for disclosure would unreasonably interfere with the operations of the institution due to their volume; or (d) the person who made the request has submitted other requests to the institution and the person’s requests would, collectively, unreasonably interfere with the operations of the institution. 2026, c. 2, Sched. 7, s. 4. Nature of access plan (2) The plan respecting access to records referred to in subsection (1) shall, (a) divide the request into separate categories of records and set out the areas of the institution to be searched for those records; and (b) establish a schedule that sets out, (i) whether or not access to records, or parts of those records, will be given or an indication of when such decisions respecting access to records will be made, and (ii) when access to the records, or parts of those records, is to be given or, if necessary, when the records, or parts of those records, are to be produced. 2026, c. 2, Sched. 7, s. 4. Written notice (3) The head shall give written notice of the decision to establish a plan respecting access to records referred to in subsection (1) that sets out the plan as well as a statement that the person who made the request may appeal the decision to the Commissioner within 30 business days after the notice was given. 2026, c. 2, Sched. 7, s. 4. Same, amendment to plan (4) If the head amends a plan respecting access to records referred to in subsection (1), the head shall give written notice of the decision to amend the plan that sets out the amended plan as well as, if the plan is being amended for the first time, a statement that the person who made the request may appeal the decision to the Commissioner within 30 business days after the notice was given. 2026, c. 2, Sched. 7, s. 4. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 4 - 01/07/2026 Requester’s response to plan 24.2 (1) Where the head of an institution proposes a plan for providing access to records in stages under section 24.1 or proposes amendments to such a plan, the person who requested the records shall, within 30 business days after receiving the plan and any proposed amendments to the plan, respond in writing to the head or, in the case of a decision to propose a plan for providing access to records in stages under section 24.1 or a decision to amend such a plan for the first time, appeal the decision to the Commissioner. 2026, c. 2, Sched. 7, s. 4. Content of response (2) When responding in writing to the head under subsection (1), the person shall, (a) indicate their acceptance of the plan; (b) propose amendments to the plan; or (c) modify the scope of their request. 2026, c. 2, Sched. 7, s. 4. Effect on time limit (3) At the end of the day on which a proposed plan for providing access to records in stages under section 24.1 is sent by the institution, the time limit within which notice is required to be given under section 26 stops running and resumes running on the day on which the response under subsection (1) is received by the head or, if that day is not a business day, on the next business day following that day. 2026, c. 2, Sched. 7, s. 4. Lack of response (4) The person who made the request is deemed to have abandoned the request if, (a) the person has not responded to the head in writing within the time frame established under subsection (1) or the person’s response to the head made within that time frame does not comply with subsection (2); and (b) in the case of a decision to propose a plan for providing access to records in stages under section 24.1 or a decision to amend such a plan for the first time, the person has not appealed the decision to the Commissioner. 2026, c. 2, Sched. 7, s. 4. Implementation of plan (5) The head of an institution may implement a plan for providing access to records in stages if the person who requested the records responds to the head under subsection (1) by indicating that the person accepts the plan. 2026, c. 2, Sched. 7, s. 4. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 4 - 01/07/2026 Request to be forwarded 25 (1) Where an institution receives a request for access to a record that the institution does not have in its custody or under its control, the head shall make all necessary inquiries to determine whether another institution has custody or control of the record, and where the head determines that another institution has custody or control of the record, the head shall within 15 business days after the request is received, (a) forward the request to the other institution; and (b) give written notice to the person who made the request that it has been forwarded to the other institution. R.S.O. 1990, c. F.31, s. 25 (1); 2026, c. 2, Sched. 7, s. 5 (1). Transfer of request (2) Where an institution receives a request for access to a record and the head considers that another institution has a greater interest in the record, the head may transfer the request and, if necessary, the record to the other institution, within 15 business days after the request is received, in which case the head transferring the request shall give written notice of the transfer to the person who made the request. R.S.O. 1990, c. F.31, s. 25 (2); 2026, c. 2, Sched. 7, s. 5 (1). Greater interest (3) For the purpose of subsection (2), another institution has a greater interest in a record than the institution that receives the request for access if, (a) the record was originally produced in or for the other institution; or (b) in the case of a record not originally produced in or for an institution, the other institution was the first institution to receive the record or a copy thereof. R.S.O. 1990, c. F.31, s. 25 (3). When transferred request deemed made (4) Where a request is forwarded or transferred under subsection (1) or (2), the request shall be deemed to have been made to the institution to which it is forwarded or transferred on the day the institution to which the request was originally made received it. R.S.O. 1990, c. F.31, s. 25 (4). Institution (5) In this section, “institution” includes an institution as defined in section 2 of the Municipal Freedom of Information and Protection of Privacy Act. R.S.O. 1990, c. F.31, s. 25 (5). Transition, business days (6) This section, as it read immediately before the day section 5 of Schedule 7 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply to requests for access to a record received by an institution before that day. 2026, c. 2, Sched. 7, s. 5 (2). Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 5 (1, 2) - 01/07/2026 Notice by head 26 (1) Where a person requests access to a record, the head of the institution to which the request is made or if a request is forwarded or transferred under section 25, the head of the institution to which it is forwarded or transferred, shall, subject to sections 27, 28 and 57, within 45 business days after the request is received, (a) give written notice to the person who made the request as to whether or not access to the record or a part thereof will be given; and (b) if access is to be given, give the person who made the request access to the record or part thereof, and where necessary for the purpose cause the record to be produced. R.S.O. 1990, c. F.31, s. 26; 1996, c. 1, Sched. K, s. 3; 2026, c. 2, Sched. 7, s. 6 (1). Same (2) A request is only received for the purposes of subsection (1) once the person who made the request has complied with subsection 24 (1). 2026, c. 2, Sched. 7, s. 6 (2). Transition, business days (3) This section, as it read immediately before the day section 6 of Schedule 7 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply to requests for access to a record made or forwarded to the head of the institution before that day. 2026, c. 2, Sched. 7, s. 6 (2). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 3 - 30/01/1996 2026, c. 2, Sched. 7, s. 6 (1, 2) - 01/07/2026 Extension of time 27 (1) A head may extend the time limit set out in section 26 for a period of time that is reasonable in the circumstances, where, (a) the request is for a large number of records or necessitates a search through a large number of records and meeting the time limit would unreasonably interfere with the operations of the institution; or (b) consultations with a person outside the institution are necessary to comply with the request and cannot reasonably be completed within the time limit. R.S.O. 1990, c. F.31, s. 27 (1). Same, second extension (1.1) If the time limit has been extended under subsection (1), the head may extend the time limit one additional time in any of the following circumstances: 1. The person who made the request consents to the extension. 2. The number of records identified as being responsive to the request is significantly more than the number of records initially identified. 3. One of the following circumstances arises, provided that it was not reasonably foreseeable when the time limit was extended under subsection (1) that the circumstance would arise: i. Employees knowledgeable in the subject matter of the request are unable to assist with responding to the request. ii. Additional consultations become necessary to respond to the request. 2026, c. 2, Sched. 7, s. 7 (1). Notice of extension (2) Where a head extends the time limit under subsection (1) or (1.1), the head shall give the person who made the request written notice of the extension setting out, (a) the length of the extension; (b) the reason for the extension; and (c) that the person who made the request may ask the Commissioner to review the extension. R.S.O. 1990, c. F.31, s. 27 (2); 2026, c. 2, Sched. 7, s. 7 (2). Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 7 (1, 2) - 01/07/2026 Frivolous request 27.1 (1) A head who refuses to give access to a record or a part of a record because the head is of the opinion that the request for access is frivolous or vexatious, shall state in the notice given under section 26, (a) that the request is refused because the head is of the opinion that the request is frivolous or vexatious; (b) the reasons for which the head is of the opinion that the request is frivolous or vexatious; and (c) that the person who made the request may appeal to the Commissioner under subsection 50 (1) for a review of the decision. 1996, c. 1, Sched. K, s. 4. Non-application (2) Sections 28 and 29 do not apply to a head who gives a notice for the purpose of subsection (1). 1996, c. 1, Sched. K, s. 4. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 4 - 30/01/1996 Notice to affected person 28 (1) Before a head grants a request for access to a record, (a) that the head has reason to believe might contain information referred to in subsection 17 (1) that affects the interest of a person other than the person requesting information; or (b) that is personal information that the head has reason to believe might constitute an unjustified invasion of personal privacy for the purposes of clause 21 (1) (f), the head shall give written notice in accordance with subsection (2) to the person to whom the information relates. R.S.O. 1990, c. F.31, s. 28 (1). Contents of notice (2) The notice shall contain, (a) a statement that the head intends to release a record or part thereof that may affect the interests of the person; (b) a description of the contents of the record or part thereof that relate to the person; and (c) a statement that the person may, subject to subsection (5.1), within 20 business days after the notice is given, make representations to the head as to why the record or part thereof should not be disclosed. R.S.O. 1990, c. F.31, s. 28 (2); 2016, c. 5, Sched. 10, s. 2 (1); 2026, c. 2, Sched. 7, s. 8 (1). Description (2.1) If the request covers more than one record, the description mentioned in clause (2) (b) may consist of a summary of the categories of the records requested if it provides sufficient detail to identify them. 1996, c. 1, Sched. K, s. 5. Time for notice (3) The notice referred to in subsection (1) shall be given within 30 business days after the request for access is received or, where there has been an extension of a time limit under subsection 27 (1), within that extended time limit. R.S.O. 1990, c. F.31, s. 28 (3); 2026, c. 2, Sched. 7, s. 8 (1). Notice of delay (4) Where a head gives notice to a person under subsection (1), the head shall also give the person who made the request written notice of delay, setting out, (a) that the record or part thereof may affect the interests of another party; (b) that the other party is being given an opportunity to make representations concerning disclosure; and (c) that the head will, within 10 business days after the expiry of the time period for making representations under subsection (5), decide whether or not to disclose the record. R.S.O. 1990, c. F.31, s. 28 (4); 2016, c. 5, Sched. 10, s. 2 (2); 2026, c. 2, Sched. 7, s. 8 (1). Representation re disclosure (5) Where a notice is given under subsection (1), the person to whom the information relates may, subject to subsection (5.1), within 20 business days after the notice is given, make representations to the head as to why the record or the part thereof should not be disclosed. R.S.O. 1990, c. F.31, s. 28 (5); 2016, c. 5, Sched. 10, s. 2 (3); 2026, c. 2, Sched. 7, s. 8 (1). Extension of time (5.1) If the time limit specified in subsection (5) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the person, the head may extend the time limit for a period of time that is reasonably required in the circumstances to accommodate the person for the purpose of making representations under that subsection. 2016, c. 5, Sched. 10, s. 2 (4). Representation in writing (6) Representations under subsection (5) shall be made in writing unless the head permits them to be made orally. R.S.O. 1990, c. F.31, s. 28 (6). Decision re disclosure (7) The head shall decide whether or not to disclose the record or part and give written notice of the decision to the person to whom the information relates and the person who made the request within 10 business days after the expiry of the time period for making representations under subsection (5). 2016, c. 5, Sched. 10, s. 2 (5); 2026, c. 2, Sched. 7, s. 8 (1). Notice of head’s decision to disclose (8) A head who decides to disclose a record or part under subsection (7) shall state in the notice that, (a) the person to whom the information relates may appeal the decision to the Commissioner within 30 business days after the notice of decision is given, subject to subsection (8.1); and (b) the person who made the request will be given access to the record or part unless an appeal of the decision is commenced within the time period specified in clause (a). 2016, c. 5, Sched. 10, s. 2 (5); 2026, c. 2, Sched. 7, s. 8 (1). Extension of time (8.1) If the time limit specified in clause (8) (a) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the person, the head may extend the time limit for a period of time that is reasonably required in the circumstances to accommodate the person for the purpose of appealing the decision under that clause. 2016, c. 5, Sched. 10, s. 2 (5). Access to be given unless affected person appeals (9) Where, under subsection (7), the head decides to disclose the record or a part thereof, the head shall give the person who made the request access to the record or part thereof within 30 business days after notice is given under subsection (7), unless the person to whom the information relates appeals the decision to the Commissioner in accordance with clause (8) (a). R.S.O. 1990, c. F.31, s. 28 (9); 2016, c. 5, Sched. 10, s. 2 (6); 2026, c. 2, Sched. 7, s. 8 (1). Personal information about deceased (10) In the case of a request by the spouse or a close relative of a deceased individual for disclosure of personal information about the deceased individual, the person making the request shall give the head all information that the person has regarding whether the deceased individual has a personal representative and how to contact the personal representative. 2006, c. 19, Sched. N, s. 1 (3). Deemed references (11) If, under subsection (10), the head is informed that the deceased individual has a personal representative and is given sufficient information as to how to contact the personal representative, and if the head has reason to believe that disclosure of personal information about the deceased individual might constitute an unjustified invasion of personal privacy unless, in the circumstances, the disclosure is desirable for compassionate reasons, subsections (1) to (9) apply with the following modifications: 1. The expression “the person to whom the information relates” in subsections (1), (5), (7), (8) and (9) shall be deemed to be the expression “the personal representative”. 2. The expression “the person” in clauses (2) (a) and (b) shall be deemed to be the expression “the deceased individual” and the expression “the person” in clause (2) (c) shall be deemed to be the expression “the personal representative”. 2006, c. 19, Sched. N, s. 1 (3). Transition, business days (12) This section, as it read immediately before the day section 8 of Schedule 7 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply to requests for access to a record received by an institution before that day. 2026, c. 2, Sched. 7, s. 8 (2). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 5 - 30/01/1996 2006, c. 19, Sched. N, s. 1 (3) - 22/06/2006 2016, c. 5, Sched. 10, s. 2 (1-6) - 19/04/2016 2026, c. 2, Sched. 7, s. 8 (1, 2) - 01/07/2026 Contents of notice of refusal 29 (1) Notice of refusal to give access to a record or a part thereof under section 26 shall set out, (a) where there is no such record, (i) that there is no such record, and (ii) that the person who made the request may appeal to the Commissioner the question of whether such a record exists; or (b) where there is such a record, (i) the specific provision of this Act under which access is refused, (ii) the reason the provision applies to the record, (iii) the name and position of the person responsible for making the decision, and (iv) that the person who made the request may appeal to the Commissioner for a review of the decision. R.S.O. 1990, c. F.31, s. 29 (1). Same (2) Where a head refuses to confirm or deny the existence of a record as provided in subsection 14 (3) (law enforcement), section 14.1 (Civil Remedies Act, 2001), section 14.2 (Prohibiting Profiting from Recounting Crimes Act, 2002) or subsection 21 (5) (unjustified invasion of personal privacy), the head shall state in the notice given under section 26, (a) that the head refuses to confirm or deny the existence of the record; (b) the provision of this Act on which the refusal is based; (c) the name and office of the person responsible for making the decision; and (d) that the person who made the request may appeal to the Commissioner for a review of the decision. R.S.O. 1990, c. F.31, s. 29 (2); 2001, c. 28, s. 22 (2); 2002, c. 2, ss. 15 (2), 19 (5); 2007, c. 13, s. 43 (2). Idem (3) Where a head refuses to disclose a record or part thereof under subsection 28 (7), the head shall state in the notice given under subsection 28 (7), (a) the specific provision of this Act under which access is refused; (b) the reason the provision named in clause (a) applies to the record; (c) the name and office of the person responsible for making the decision to refuse access; and (d) that the person who made the request may appeal to the Commissioner for a review of the decision. R.S.O. 1990, c. F.31, s. 29 (3). Description (3.1) If a request for access covers more than one record, the statement in a notice under this section of a reason mentioned in subclause (1) (b) (ii) or clause (3) (b) may refer to a summary of the categories of the records requested if it provides sufficient detail to identify them. 1996, c. 1, Sched. K, s. 6. Deemed refusal (4) A head who fails to give the notice required under section 26 or subsection 28 (7) concerning a record shall be deemed to have given notice of refusal to give access to the record on the last day of the period during which notice should have been given. R.S.O. 1990, c. F.31, s. 29 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, s. 1 (1), Sched. K, s. 6 - 30/01/1996 2001, c. 28, s. 22 (2) - 12/04/2002 2002, c. 2, s. 15 (2) - 01/07/2003; 2002, c. 2, s. 19 (5) - 01/07/2003 2007, c. 13, s. 43 (2) - 04/06/2007 Copy of record 30 (1) Subject to subsection (2), a person who is given access to a record or a part thereof under this Act shall be given a copy thereof unless it would not be reasonably practicable to reproduce the record or part thereof by reason of its length or nature, in which case the person shall be given an opportunity to examine the record or part thereof in accordance with the regulations. R.S.O. 1990, c. F.31, s. 30 (1). Access to original record (2) Where a person requests the opportunity to examine a record or a part thereof and it is reasonably practicable to give the person that opportunity, the head shall allow the person to examine the record or part thereof in accordance with the regulations. R.S.O. 1990, c. F.31, s. 30 (2). Copy of part (3) Where a person examines a record or a part thereof and wishes to have portions of it copied, the person shall be given a copy of those portions unless it would not be reasonably practicable to reproduce them by reason of their length or nature. R.S.O. 1990, c. F.31, s. 30 (3). Information to be Published or Available Publication of information re institutions 31 The responsible minister shall cause to be published annually a compilation listing all institutions and, in respect of each institution, setting out, (a) where a request for a record should be made; (b) the name and office of the head of the institution; (c) where the material referred to in sections 32, 33 and 34 has been made available; and (d) whether the institution has a library or reading room which is available for public use, and if so, its address. R.S.O. 1990, c. F.31, s. 31; 2026, c. 2, Sched. 7, s. 9. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 9 - 01/07/2026 Operation of institutions 32 The responsible minister shall cause to be published annually an indexed compilation containing, (a) a description of the organization and responsibilities of each institution including details of the programs and functions of each division or branch of each institution; (b) a list of the general classes or types of records prepared by or in the custody or control of each institution; (c) the title, business telephone number and business address of the head of each institution; and (d) any amendment of information referred to in clause (a), (b) or (c) that has been made available in accordance with this section. R.S.O. 1990, c. F.31, s. 32. Institution documents 33 (1) A head shall make available, in the manner described in section 35, (a) manuals, directives or guidelines prepared by the institution, issued to its officers and containing interpretations of the provisions of any enactment or scheme administered by the institution where the interpretations are to be applied by, or are to be guidelines for, any officer who determines, (i) an application by a person for a right, privilege or benefit which is conferred by the enactment or scheme, (ii) whether to suspend, revoke or impose new conditions on a right, privilege or benefit already granted to a person under the enactment or scheme, or (iii) whether to impose an obligation or liability on a person under the enactment or scheme; or (b) instructions to, and guidelines for, officers of the institution on the procedures to be followed, the methods to be employed or the objectives to be pursued in their administration or enforcement of the provisions of any enactment or scheme administered by the institution that affects the public. R.S.O. 1990, c. F.31, s. 33 (1). Deletions (2) A head may delete from a document made available under subsection (1) any record or part of a record which the head would be entitled to refuse to disclose where the head includes in the document, (a) a statement of the fact that a deletion has been made; (b) a brief statement of the nature of the record which has been deleted; and (c) a reference to the provision of this Act or the Personal Health Information Protection Act, 2004 on which the head relies. R.S.O. 1990, c. F.31, s. 33 (2); 2004, c. 3, Sched. A, s. 81 (2). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 81 (2) - 01/11/2004 Annual report of head 34 (1) A head shall provide to the Commissioner an annual report with respect to the previous calendar year in accordance with this section. 2024, c. 24, Sched. 2, s. 3 (1). Contents of report (2) A report made under subsection (1) shall specify, (a) the number of requests under this Act or the Personal Health Information Protection Act, 2004 for access to records made to the institution or to a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; (b) the number of refusals by the head to disclose a record under this Act, the provisions of this Act under which disclosure was refused and the number of occasions on which each provision was invoked; (c) the number of refusals under the Personal Health Information Protection Act, 2004 by a health information custodian, within the meaning of that Act, that is the institution or that is acting as part of the institution, of a request for access to a record, the provisions of that Act under which disclosure was refused and the number of occasions on which each provision was invoked; (c.1) the number of thefts, losses or unauthorized uses or disclosures of personal information recorded under subsection 40.1 (8); (d) the number of uses or purposes for which personal information is disclosed where the use or purpose is not included in any written public statement provided under subsection 16 (1) of the Personal Health Information Protection Act, 2004 by a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; (e) the amount of fees collected under section 57 of this Act by the institution and under subsection 54 (10) of the Personal Health Information Protection Act, 2004 by the institution or a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; and (f) any other information indicating an effort by the institution or by a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution to put into practice the purposes of this Act or the purposes of the Personal Health Information Protection Act, 2004. 2006, c. 19, Sched. N, s. 1 (4); 2024, c. 24, Sched. 2, s. 3 (2); 2026, c. 2, Sched. 7, s. 10. Separate information (3) The information required by each of clauses (2) (a), (d), (e) and (f) shall be provided separately for, (a) each separate health information custodian that is the institution or that is acting as part of the institution; and (b) the institution other than in its capacity as a health information custodian and other than in its capacity as an institution containing a health information custodian. 2006, c. 19, Sched. N, s. 1 (4). Same (4) The information required by clause (2) (c) shall be provided separately for each separate health information custodian that is the institution or that is acting as part of the institution. 2006, c. 19, Sched. N, s. 1 (4). Form of report etc. (5) The annual report shall be provided no later than the date specified by the Commissioner, if any, and shall be in the form and manner as may be specified by the Commissioner. 2024, c. 24, Sched. 2, s. 3 (3). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 81 (3) - 01/11/2004 2006, c. 19, Sched. N, s. 1 (4) - 22/06/2006 2024, c. 24, Sched. 2, s. 3 (1, 3) - 29/01/2025; 2024, c. 24, Sched. 2, s. 3 (2) - 01/07/2025 2026, c. 2, Sched. 7, s. 10 - 01/07/2026 Documents made available 35 (1) The responsible minister shall cause the materials described in sections 31 and 32 to be made generally available for inspection and copying by the public and shall cause them to be made available to the public on the Internet or in the reading room, library or office designated by each institution for this purpose. 2006, c. 34, Sched. C, s. 3; 2026, c. 2, Sched. 7, s. 11. Same (2) Every head shall cause the materials described in sections 33 and 34 to be made available to the public on the Internet or in the reading room, library or office designated by each institution for this purpose. 2006, c. 34, Sched. C, s. 3. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 3 - 01/04/2007 2026, c. 2, Sched. 7, s. 11 - 01/07/2026 Information from heads 36 (1) Every head shall provide to the responsible minister the information needed by the responsible minister to prepare the materials described in sections 31 and 32. 2006, c. 34, Sched. C, s. 4; 2026, c. 2, Sched. 7, s. 12. Annual review (2) Every head shall conduct an annual review to ensure that all the information the head is required to provide under subsection (1) is provided and that all such information is accurate, complete and up to date. 2006, c. 34, Sched. C, s. 4. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 4 - 01/04/2007 2026, c. 2, Sched. 7, s. 12 - 01/07/2026 Extra-ministerial data integration units 36.1 (1) Where an extra-ministerial data integration unit under Part III.1 is not an institution, or part of an institution, the senior officer of the extra-ministerial data integration unit shall cause to be published annually information respecting, (a) where a request for a record should be made; (b) the name, title, business telephone number and business address of the senior officer; (c) a description of the unit’s programs and functions as they relate to Part III.1; (d) an indication of the general types of records that are prepared by or are otherwise in the custody or under the control of the unit in relation to Part III.1; and (e) an indication of any changes to the information previously published under this section. 2023, c. 4, Sched. 3, s. 1. (2) The senior officer shall also cause the information to be provided to the responsible minister upon its publication. 2023, c. 4, Sched. 3, s. 1. Section Amendments with date in force (d/m/y) 2023, c. 4, Sched. 3, s. 1 - 24/07/2023 PART III PROTECTION OF INDIVIDUAL PRIVACY Collection and Retention of Personal Information Application of Part 37 (1) This Part does not apply to personal information that is maintained for the purpose of creating a record that is available to the general public. R.S.O. 1990, c. F.31, s. 37. Same (2) With the exception of sections 47 to 49, this Part does not apply to personal information that is collected by a member of a multi-sector data integration unit or a ministry data integration unit under Part III.1. 2019, c. 7, Sched. 31, s. 3; 2020, c. 5, Sched. 2, s. 1 (1). Note: On a day to be named by proclamation of the Lieutenant Governor, section 37 of the Act is amended by adding the following subsection: (See: 2020, c. 5, Sched. 2, s. 1 (2)) Right of access, extra-ministerial data integration unit (3) Where an extra-ministerial data integration unit is not an institution, sections 47 to 49 apply, with any modifications prescribed by the regulations, to personal information that is collected by a member of the extra-ministerial data integration unit under Part III.1 as if the extra-ministerial data integration unit were an institution and, for that purpose, the senior officer of the unit shall be considered the head. 2020, c. 5, Sched. 2, s. 1 (2). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 3 - 04/11/2019 2020, c. 5, Sched. 2, s. 1 (1) - 25/03/2020; 2020, c. 5, Sched. 2, s. 1 (2) - not in force Personal information 38 (1) In this section and in section 39 and subsection 40 (5), “personal information” includes information that is not recorded and that is otherwise defined as “personal information” under this Act. R.S.O. 1990, c. F.31, s. 38 (1); 2024, c. 24, Sched. 2, s. 4 (1). Collection of personal information (2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. R.S.O. 1990, c. F.31, s. 38 (2). Privacy impact assessment (3) Unless the regulations provide otherwise, before collecting personal information, the head of an institution shall ensure that a written assessment is prepared that contains the following information respecting any personal information that the institution intends to collect: 1. The purpose for which the personal information is intended to be collected, used and disclosed, as applicable, and an explanation of why the personal information is necessary to achieve the purpose. 2. The legal authority for the intended collection, use and disclosure of the personal information. 3. The types of personal information that is intended to be collected and, for each type of personal information collected, an indication of how the type of personal information is intended to be used or disclosed. 4. The sources of the personal information that is intended be collected. 5. The position titles of the officers, employees, consultants or agents of the institution who will have access to the personal information. 6. Any limitations or restrictions imposed on the collection, use or disclosure of the personal information. 7. The period of time that the personal information would be retained by the institution, in accordance with subsection 40 (1). 8. An explanation of the administrative, technical and physical safeguards and practices that would be used to protect the personal information in accordance with subsection 40 (5) and a summary of any risks to individuals in the event of a theft, loss or unauthorized use or disclosure of the personal information. 9. The steps to be taken by the institution, i. to prevent or reduce the likelihood of a theft, loss or unauthorized use or disclosure of personal information from occurring, and ii. to mitigate the risks to individuals in the event of such an occurrence. 10. Such other information as may be prescribed. 2024, c. 24, Sched. 2, s. 4 (2). Risk mitigation (4) The head of an institution shall ensure that the steps mentioned in paragraph 9 of subsection (3) are implemented, (a) before collecting the personal information mentioned in that subsection; or (b) if it is not possible to implement the steps before collecting the personal information, within a reasonable time after collecting the information. 2024, c. 24, Sched. 2, s. 4 (2). Requirement to update (5) Unless the regulations provide otherwise, before making any significant change to the purpose for which personal information mentioned in subsection (3) is used or disclosed, the head of an institution shall, (a) update the assessment prepared under subsection (3) to reflect the proposed change and to set out the proposed intended use or disclosure; and (b) implement any additional steps identified under paragraph 9 of subsection (3). 2024, c. 24, Sched. 2, s. 4 (2). Copy to Commissioner (6) The head of an institution shall, on request, provide the Commissioner with access to, or a copy of, an assessment prepared under subsection (3) or updated under subsection (5). 2024, c. 24, Sched. 2, s. 4 (2). Section Amendments with date in force (d/m/y) 2024, c. 24, Sched. 2, s. 4 (1, 2) - 01/07/2025 Manner of collection 39 (1) Personal information shall only be collected by an institution directly from the individual to whom the information relates unless, (a) the individual authorizes another manner of collection; (b) the personal information may be disclosed to the institution concerned under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act; (c) the Commissioner has authorized the manner of collection under clause 59 (c); (d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act; (e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service; (f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or tribunal; (g) the information is collected for the purpose of law enforcement; or (h) another manner of collection is authorized by or under a statute. R.S.O. 1990, c. F.31, s. 39 (1). Notice to individual (2) Where personal information is collected on behalf of an institution, the head shall, unless notice is waived by the responsible minister, inform the individual to whom the information relates of, (a) the legal authority for the collection; (b) the principal purpose or purposes for which the personal information is intended to be used; and (c) the title, business address and business telephone number of a public official who can answer the individual’s questions about the collection. R.S.O. 1990, c. F.31, s. 39 (2).

Exception (3) Subsection (2) does not apply where the head may refuse to disclose the personal information under subsection 14 (1) or (2) (law enforcement), section 14.1 (Civil Remedies Act, 2001) or section 14.2 (Prohibiting Profiting from Recounting Crimes Act, 2002). 2002, c. 2, s. 19 (6); 2007, c. 13, s. 43 (3). Section Amendments with date in force (d/m/y) 2002, c. 2, s. 19 (6) - 01/07/2003 2007, c. 13, s. 43 (3) - 4/06/2007 Retention and protection of personal information 40 (1) Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information. R.S.O. 1990, c. F.31, s. 40 (1). Standard of accuracy (2) The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date. R.S.O. 1990, c. F.31, s. 40 (2). Exception (3) Subsection (2) does not apply to personal information collected for law enforcement purposes. R.S.O. 1990, c. F.31, s. 40 (3). Disposal of personal information (4) A head shall dispose of personal information under the control of the institution in accordance with the regulations. R.S.O. 1990, c. F.31, s. 40 (4). Privacy safeguards (5) The head of an institution shall take steps that are reasonable in the circumstances to ensure that personal information in the custody or under the control of the institution is protected against theft, loss and unauthorized use or disclosure and to ensure that the records containing the personal information are protected against unauthorized copying, modification or disposal. 2024, c. 24, Sched. 2, s. 5. Section Amendments with date in force (d/m/y) 2024, c. 24, Sched. 2, s. 5 - 01/07/2025 Breach of privacy safeguards 40.1 (1) The head of an institution shall report to the Commissioner any theft, loss or unauthorized use or disclosure of personal information in the custody or under the control of the institution if it is reasonable in the circumstances to believe that there is real risk that a significant harm to an individual would result or if any other prescribed circumstances exist. 2024, c. 24, Sched. 2, s. 6. Report requirements (2) The report mentioned in subsection (1) must contain the prescribed information and must be made in the prescribed form and manner as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure has occurred. 2024, c. 24, Sched. 2, s. 6. Notification to individual (3) Unless otherwise prohibited by law, the head of an institution shall notify an individual of any theft, loss or unauthorized use or disclosure of the individual’s personal information that is in the custody or under the control of the institution if it is reasonable in the circumstances to believe that there is a real risk of significant harm to the individual or if any other prescribed circumstances exist. 2024, c. 24, Sched. 2, s. 6. Contents of notification (4) The notification mentioned in subsection (3) must contain a statement that the individual is entitled to make a complaint to the Commissioner and any other prescribed information and must be made in the prescribed form and manner as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure of personal information has occurred. 2024, c. 24, Sched. 2, s. 6. Complaints — time limit (5) A complaint mentioned in subsection (4) must be made in writing and filed with the Commissioner within one year after the subject-matter of the complaint first came to the attention of the complainant or should reasonably have come to the attention of the complainant, whichever is the shorter. 2024, c. 24, Sched. 2, s. 6. Extension of time limit (6) Despite subsection (5), a complaint may be filed with the Commissioner after the time limit set out in that subsection if, (a) the Commissioner is satisfied that the significance of the matter warrants a time extension and that the time extension would not result in any prejudice to any person; or (b) the time limit set out in subsection (5) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the complainant and the Commissioner is satisfied that the time extension is reasonably required in the circumstances to accommodate the complainant for the purpose of making the complaint. 2024, c. 24, Sched. 2, s. 6. Real risk of significant harm — factors (7) The factors that are relevant to determining whether a theft, loss or unauthorized use or disclosure of personal information creates a real risk of significant harm to an individual include, (a) the sensitivity of the personal information; (b) the probability that the personal information has been, is being or will be misused; (c) the availability of steps that the individual could take to, (i) reduce the risk of the harm occurring, or (ii) mitigate the harm should it occur; (d) any direction, recommendation or guidance provided by the Commissioner pertaining to what constitutes a real risk of significant harm; and (e) any other prescribed factor. 2024, c. 24, Sched. 2, s. 6. Records (8) The head of an institution shall, in accordance with any prescribed requirements, keep and maintain a record of every theft, loss or unauthorized use or disclosure of personal information reported under subsection (1). 2024, c. 24, Sched. 2, s. 6. Provision to Commissioner (9) The head of an institution shall, on request, provide the Commissioner with access to, or a copy of, the record. 2024, c. 24, Sched. 2, s. 6. Definition (10) In this section, “significant harm” includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property. 2024, c. 24, Sched. 2, s. 6. Regulations (11) The Lieutenant Governor in Council may make regulations respecting anything in this section that is referred to as being prescribed. 2024, c. 24, Sched. 2, s. 6. Section Amendments with date in force (d/m/y) 2024, c. 24, Sched. 2, s. 6 - 01/07/2025 Use and Disclosure of Personal Information Use of personal information 41 (1) An institution shall not use personal information in its custody or under its control except, (a) where the person to whom the information relates has identified that information in particular and consented to its use; (b) for the purpose for which it was obtained or compiled or for a consistent purpose; (c) for a purpose for which the information may be disclosed to the institution under section 42 or under section 32 of the Municipal Freedom of Information and Protection of Privacy Act; or (d) subject to subsection (2), an educational institution may use personal information in its alumni records and a hospital may use personal information in its records for the purpose of its own fundraising activities, if the personal information is reasonably necessary for the fundraising activities. R.S.O. 1990, c. F.31, s. 41; 2005, c. 28, Sched. F, s. 5 (1); 2010, c. 25, s. 24 (9). Notice on using personal information for fundraising (2) In order for an educational institution to use personal information in its alumni records or for a hospital to use personal information in its records, either for its own fundraising activities or for the fundraising activities of an associated foundation, the educational institution or hospital shall, (a) give notice to the individual to whom the personal information relates when the individual is first contacted for the purpose of soliciting funds for fundraising of his or her right to request that the information cease to be used for fundraising purposes; (b) periodically and in the course of soliciting funds for fundraising, give notice to the individual to whom the personal information relates of his or her right to request that the information cease to be used for fundraising purposes; and (c) periodically and in a manner that is likely to come to the attention of individuals who may be solicited for fundraising, publish a notice of the individual’s right to request that the individual’s personal information cease to be used for fundraising purposes. 2005, c. 28, Sched. F, s. 5 (2); 2010, c. 25, s. 24 (10). Discontinuing use of personal information (3) An educational institution or a hospital shall, when requested to do so by an individual, cease to use the individual’s personal information under clause (1) (d). 2005, c. 28, Sched. F, s. 5 (2); 2010, c. 25, s. 24 (11). Section Amendments with date in force (d/m/y) 2005, c. 28, Sched. F, s. 5 (1, 2) - 10/06/2006 2010, c. 25, s. 24 (9-11) - 01/01/2012 Where disclosure permitted 42 (1) An institution shall not disclose personal information in its custody or under its control except, (a) in accordance with Part II; (b) where the person to whom the information relates has identified that information in particular and consented to its disclosure; (c) for the purpose for which it was obtained or compiled or for a consistent purpose; (d) where disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and where disclosure is necessary and proper in the discharge of the institution’s functions; Note: On September 15, 2026, subsection 42 (1) of the Act is amended by adding the following clause: (See: 2026, c. 2, Sched. 7, s. 13 (1)) (d.1) to an employee in an institution that is a ministry of the Government of Ontario if, (i) the employee had, immediately before being employed in the institution, been employed in another ministry of the Government of Ontario or is temporarily assigned to the institution from another ministry of the Government of Ontario, (ii) the personal information is stored in an online account associated with the employee’s email address to which the employee had access as part of their functions in the other ministry of the Government of Ontario, (iii) the disclosure occurs as a result of the employee’s continued access to the account, and (iv) if the responsible minister has established guidelines with respect to the disclosure of personal information under this clause, the guidelines have been complied with; (e) where permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada; (f) where disclosure is by a law enforcement institution, (i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, or (ii) to another law enforcement agency in Canada; (g) to an institution or a law enforcement agency in Canada if, (i) the disclosure is to aid in an investigation undertaken by the institution or the agency with a view to a law enforcement proceeding, or (ii) there is a reasonable basis to believe that an offence may have been committed and the disclosure is to enable the institution or the agency to determine whether to conduct such an investigation; (h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates; (i) in compassionate circumstances, to facilitate contact with the spouse, a close relative or a friend of an individual who is injured, ill or deceased; (j) to a member of the Legislative Assembly who has been authorized by a constituent to whom the information relates to make an inquiry on the constituent’s behalf or, where the constituent is incapacitated, has been authorized by the spouse, a close relative or the legal representative of the constituent; (k) to a member of the bargaining agent who has been authorized by an employee to whom the information relates to make an inquiry on the employee’s behalf or, where the employee is incapacitated, has been authorized by the spouse, a close relative or the legal representative of the employee; (l) to the responsible minister; (m) to the Information and Privacy Commissioner; (n) to the Government of Canada in order to facilitate the auditing of shared cost programs; or (o) subject to subsection (2), an educational institution may disclose personal information in its alumni records, and a hospital may disclose personal information in its records, for the purpose of its own fundraising activities or the fundraising activities of an associated foundation if, (i) the educational institution and the person to whom the information is disclosed, or the hospital and the person to whom the information is disclosed, have entered into a written agreement that satisfies the requirements of subsection (3), and (ii) the personal information is reasonably necessary for the fundraising activities. R.S.O. 1990, c. F.31, s. 42; 2005, c. 28, Sched. F, s. 6 (1); 2006, c. 19, Sched. N, s. 1 (5-7); 2006, c. 34, Sched. C, s. 5; 2010, c. 25, s. 24 (12); 2019, c. 7, Sched. 31, s. 4. Notice on disclosing personal information for fundraising (2) In order for an educational institution to disclose personal information in its alumni records or for a hospital to disclose personal information in its records, either for the purpose of its own fundraising activities or the fundraising activities of an associated foundation, the educational institution or hospital shall ensure that, (a) notice is given to the individual to whom the personal information relates when the individual is first contacted for the purpose of soliciting funds for fundraising of his or her right to request that the information cease to be disclosed for fundraising purposes; (b) periodically and in the course of soliciting funds for fundraising, notice is given to the individual to whom the personal information relates of his or her right to request that the information cease to be disclosed for fundraising purposes; and (c) periodically and in a manner that is likely to come to the attention of individuals who may be solicited for fundraising, notice is published in respect of the individual’s right to request that the individual’s personal information cease to be disclosed for fundraising purposes. 2005, c. 28, Sched. F, s. 6 (2); 2010, c. 25, s. 24 (13). Fundraising agreement (3) An agreement between an educational institution and another person for the disclosure of personal information in the educational institution’s alumni records for fundraising activities, or an agreement between a hospital and another person for the disclosure of personal information in the hospital’s records for fundraising activities, must, (a) require that the notice requirements in subsection (2) are met; (b) require that the personal information disclosed under clause (1) (o) be disclosed to the individual to whom the information relates upon his or her request; and (c) require that the person to whom the information is disclosed shall cease to use the personal information of any individual who requests that the information not be used. 2005, c. 28, Sched. F, s. 6 (2); 2010, c. 25, s. 24 (14). Note: On September 15, 2026, section 42 of the Act is amended by adding the following subsections: (See: 2026, c. 2, Sched. 7, s. 13 (2)) Non-application of the Legislation Act, 2006 to guidelines (4) Part III (Regulations) of the Legislation Act, 2006 does not apply to the guidelines mentioned in subclause 42 (1) (d.1) (iv). 2026, c. 2, Sched. 7, s. 13 (2). Publicly available (5) If the responsible minister establishes guidelines for the purposes of clause 42 (1) (d.1), the responsible minister shall make the guidelines available on a Government of Ontario website in English and in French. 2026, c. 2, Sched. 7, s. 13 (2). Section Amendments with date in force (d/m/y) 2005, c. 28, Sched. F, s. 6 (1, 2) - 10/06/2006 2006, c. 19, Sched. N, s. 1 (5-7) - 22/06/2006; 2006, c. 34, Sched. C, s. 5 (1, 2) - 01/04/2007 2010, c. 25, s. 24 (12-14) - 01/01/2012 2019, c. 7, Sched. 31, s. 4 (1-3) - 04/11/2019 2026, c. 2, Sched. 7, s. 13 (1, 2) - 15/09/2026 Consistent purpose 43 Where personal information has been collected directly from the individual to whom the information relates, the purpose of a use or disclosure of that information is a consistent purpose under clauses 41 (1) (b) and 42 (1) (c) only if the individual might reasonably have expected such a use or disclosure. R.S.O. 1990, c. F.31, s. 43; 2006, c. 34, Sched. C, s. 6. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 6 - 01/04/2007 44 Repealed: 2026, c. 2, Sched. 7, s. 14. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 14 - 01/07/2026 45 Repealed: 2026, c. 2, Sched. 7, s. 14. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 14 - 01/07/2026 46 Repealed: 2026, c. 2, Sched. 7, s. 14. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 14 - 01/07/2026 Right of Individual to Whom Personal Information Relates to Access and Correction Rights of access and correction Right of access to personal information 47 (1) Every individual has a right of access to any personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to render it reasonably retrievable by the institution. 2026, c. 2, Sched. 7, s. 15. Right of correction (2) Every individual who is given access under subsection (1) to personal information is entitled to, (a) request correction of the personal information where the individual believes there is an error or omission therein; (b) require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made; and (c) require that any person or body to whom the personal information has been disclosed within the year before the time a correction is requested or a statement of disagreement is required be notified of the correction or statement of disagreement. R.S.O. 1990, c. F.31, s. 47 (2). Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 15 - 01/07/2026 Requests and manner of access Request 48 (1) An individual seeking access to personal information about the individual shall, (a) make a request in writing to the institution that the individual believes has custody or control of the personal information, and specify that the request is being made under this Act; (b) identify the location of the personal information; and (c) at the time of making the request, pay the fee prescribed by the regulations for that purpose. 1996, c. 1, Sched. K, s. 7; 2017, c. 2, Sched. 12, s. 4 (2); 2026, c. 2, Sched. 7, s. 16. Access procedures (2) Subsections 10 (2), 24 (1.1) and (2) and sections 25, 26, 27, 27.1, 28 and 29 apply with necessary modifications to a request made under subsection (1). 1996, c. 1, Sched. K, s. 7. Exception, s. 25 (2.1) Despite subsection (2), subsection 25 (2) does not apply to a request for personal information that was collected under Part III.1. 2019, c. 7, Sched. 31, s. 5. Manner of access (3) Subject to the regulations, where an individual is to be given access to personal information requested under subsection (1), the head shall, (a) permit the individual to examine the personal information; or (b) provide the individual with a copy thereof. R.S.O. 1990, c. F.31, s. 48 (3). Comprehensible form (4) Where access to personal information is to be given, the head shall ensure that the personal information is provided to the individual in a comprehensible form and in a manner which indicates the general terms and conditions under which the personal information is stored and used. R.S.O. 1990, c. F.31, s. 48 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 7 - 30/01/1996 2017, c. 2, Sched. 12, s. 4 (2) - 22/03/2017 2019, c. 7, Sched. 31, s. 5 - 04/11/2019 2026, c. 2, Sched. 7, s. 16 - 01/07/2026 Exemptions 49 A head may refuse to disclose to the individual to whom the information relates personal information, (a) where section 12, 13, 14, 14.1, 14.2, 15, 15.1, 16, 17, 18, 19, 20 or 22 would apply to the disclosure of that personal information; (b) where the disclosure would constitute an unjustified invasion of another individual’s personal privacy; (c) that is evaluative or opinion material compiled solely for the purpose of determining suitability, eligibility or qualifications for the awarding of government contracts and other benefits where the disclosure would reveal the identity of a source who furnished information to the institution in circumstances where it may reasonably have been assumed that the identity of the source would be held in confidence; (c.1) if the information is supplied explicitly or implicitly in confidence and is evaluative or opinion material compiled solely for the purpose of, (i) assessing the teaching materials or research of an employee of an educational institution or a hospital or of a person associated with an educational institution or a hospital, (ii) determining suitability, eligibility or qualifications for admission to an academic program of an educational institution or a hospital, or (iii) determining suitability for an honour or award to recognize outstanding achievement or distinguished service; (d) that is medical information where the disclosure could reasonably be expected to prejudice the mental or physical health of the individual; (e) that is a correctional record where the disclosure could reasonably be expected to reveal information supplied in confidence; or (f) that is a research or statistical record. R.S.O. 1990, c. F.31, s. 49; 2001, c. 28, s. 22 (4); 2002, c. 2, ss. 15 (4), 19 (7); 2002, c. 18, Sched. K, s. 10; 2005, c. 28, Sched. F, s. 7; 2010, c. 25, s. 24 (15); 2017, c. 8, Sched. 13, s. 4. Section Amendments with date in force (d/m/y) 2002, c. 2, s. 19 (7) - 01/07/2003; 2002, c. 18, Sched. K, s. 10 (1, 2) - 26/11/2002 2005, c. 28, Sched. F, s. 7 - 10/06/2006 2010, c. 25, s. 24 (15) - 01/01/2012 2017, c. 8, Sched. 13, s. 4 - 09/03/2018 Commissioner’s review of information practices 49.0.1 (1) The Commissioner may conduct a review of the information practices of an institution if the Commissioner has received a complaint under subsection 40.1 (4) or has other reason to believe that the requirements of this Part are not being complied with. 2024, c. 24, Sched. 2, s. 7. Informal dispute resolution (2) Before conducting a review, the Commissioner may try to resolve the matter through mediation, conciliation or any other informal means of dispute resolution that the Commissioner considers appropriate. 2024, c. 24, Sched. 2, s. 7. No review (3) The Commissioner may decide not to conduct a review for whatever reason the Commissioner considers proper, including if satisfied that, (a) the institution has responded adequately to the complaint; (b) the complaint has been or could be more appropriately dealt with, initially or completely, by means of a procedure, other than a complaint under this Act; (c) there is insufficient evidence to warrant a review; (d) the complaint is trivial, frivolous or vexatious or is made in bad faith; (e) the subject matter of the complaint is already the object of an ongoing review under this section; or (f) the subject matter of the complaint has already been the subject of a review by the Commissioner. 2024, c. 24, Sched. 2, s. 7. Conduct of review (4) In conducting a review referred to in subsection (1), the Commissioner shall review the institution’s information practices to determine whether, (a) there has been unauthorized collection, use, modification, disclosure, access to or retention of personal information collected under this Part; and (b) the requirements under this Part, including requirements with respect to notice, retention, security and secure disposal, have been met. 2024, c. 24, Sched. 2, s. 7. Duty to assist (5) The head and all officers, employees, consultants and agents of an institution shall co-operate with and assist the Commissioner in the conduct of a review, including using any data storage processing or retrieval device or system to produce a record required by the Commissioner in readable form. 2024, c. 24, Sched. 2, s. 7. Powers of Commissioner (6) The Commissioner may require the production of such information and records that are relevant to the subject matter of the review and that are in the custody or under the control of an institution. 2024, c. 24, Sched. 2, s. 7. Orders (7) If, after giving an opportunity to be heard to the head of the institution, the Commissioner determines that an information practice contravenes this Part, the Commissioner may order the head to do any of the following: 1. Discontinue the information practice. 2. Change the information practice as specified by the Commissioner. 3. Return, transfer or destroy personal information collected or retained under the information practice. 4. Implement a different information practice as specified by the Commissioner. 5. Make a recommendation in respect of how the information practice could be improved. 2024, c. 24, Sched. 2, s. 7. Limit on certain orders (8) The Commissioner may order under subsection (5) no more than what is reasonably necessary to achieve compliance with this Part. 2024, c. 24, Sched. 2, s. 7. Procedure (9) The Statutory Powers Procedure Act does not apply to a review conducted under this section. 2024, c. 24, Sched. 2, s. 7. Section Amendments with date in force (d/m/y) 2024, c. 24, Sched. 2, s. 7 - 01/07/2025 Part III.1 Data Integration Definitions 49.1 (1) In this Part, Note: On September 15, 2026, subsection 49.1 (1) of the Act is amended by adding the following definition: (See: 2026, c. 2, Sched. 7, s. 17 (1)) “Chief Digital and Data Officer” means the Chief Digital and Data Officer appointed under subsection 3 (1) of the Simpler, Faster, Better Services Act, 2019; (“directeur du numérique et des données”) “data standards” means the data standards approved by the Commissioner under subsection 49.14 (1); (“normes relatives aux données”) Note: On September 15, 2026, the definition of “data standards” in subsection 49.1 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 17 (2)) “data standards” means the data standards established by the Chief Digital and Data Officer under subsection 49.14 (1); (“normes relatives aux données”) “extra-ministerial data integration unit” means a person or entity, or an administrative division of a person or entity, that is designated as an extra-ministerial data integration unit in the regulations; (“service extraministériel d’intégration des données”) “inter-ministerial data integration unit” means an administrative division of a ministry that is designated as an inter-ministerial data integration unit in the regulations; (“service interministériel d’intégration des données”) “member” means, (a) in relation to an inter-ministerial data integration unit or a ministry data integration unit, an officer, employee or agent of the ministry in which the unit is located who works as part of the unit, and (b) in relation to an extra-ministerial data integration unit, an officer, employee or agent of the person or entity who works as part of the unit; (“membre”) “ministry data integration unit” means an administrative division of a ministry that is designated as a ministry data integration unit in the regulations. (“service ministériel d’intégration des données”) “multi-sector data integration unit” means, (a) an inter-ministerial data integration unit, or (b) an extra-ministerial data integration unit. (“service multisectoriel d’intégration des données”) “senior officer” means, in respect of an extra-ministerial data integration unit, the administrative head of the person or entity or another officer of the person or entity designated in the regulations as the senior officer. (“cadre dirigeant”) 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 2; 2023, c. 4, Sched. 3, s. 2. Meaning of de-identification (2) A reference in this Part to de-identifying a record or personal information means to remove the following information: 1. Information that identifies an individual. 2. Information that could be used, either alone or with other information, to identify an individual based on what is reasonably foreseeable in the circumstances. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 2 (1, 2) - 25/03/2020 2023, c. 4, Sched. 3, s. 2 (1, 2) - 24/07/2023 2026, c. 2, Sched. 7, s. 17 (1, 2) - 15/09/2026 Application of Act to extra-ministerial data integration units 49.1.1 (1) Where an extra-ministerial data integration unit is not an institution, or part of an institution, the extra-ministerial data integration unit is deemed to also be an institution under this Act, but only in respect of personal information that is collected by a member of the extra-ministerial data integration unit under this Part, and, for that purpose, its senior officer is deemed to be the head of the institution. 2023, c. 4, Sched. 3, s. 3. Modifications (2) The application of this Act to an extra-ministerial data integration unit and its senior officer under subsection (1) is subject to the following modifications: 1. Sections 31, 32 and 33 do not apply with respect to the extra-ministerial data integration unit. 2. Section 62 shall be read without reference to subsection 62 (3). 3. Any other modifications prescribed by the regulations. 2023, c. 4, Sched. 3, s. 3. Section Amendments with date in force (d/m/y) 2023, c. 4, Sched. 3, s. 3 - 24/07/2023 Purpose for the collection of personal information 49.2 The purpose of the collection of personal information under this Part is to compile information, including statistical information, to enable analysis in relation to, (a) the management or allocation of resources; (b) the planning for the delivery of programs and services provided or funded by the Government of Ontario, including services provided or funded in whole or in part or directly or indirectly; and (c) the evaluation of those programs and services. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 General rules re personal information 49.3 (1) A member of a multi-sector data integration unit or a ministry data integration unit shall not collect personal information under this Part or use or disclose that information if other information will serve the purpose of the collection, use or disclosure. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 3. Extent of information (2) A member of a multi-sector data integration unit or a ministry data integration unit shall not collect, use or disclose more personal information under this Part than is reasonably necessary to meet the purpose of the collection, use or disclosure. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 3. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 3 - 25/03/2020 Collection of personal information 49.4 (1) Subject to the restrictions in section 49.5, a member of a multi-sector data integration unit may indirectly collect personal information if the following conditions are met: 1. The personal information is being collected for the purpose set out in section 49.2. 2. In the case of an inter-ministerial data integration unit, the personal information is to be collected from, i. an institution, including another inter-ministerial data integration unit or a ministry data integration unit, or an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, ii. an extra-ministerial data integration unit, or iii. a person or entity prescribed by the regulations. 2.1 In the case of an extra-ministerial data integration unit, the personal information is to be collected from, i. an institution, including a ministry data integration unit or an inter-ministerial data integration unit, or an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act; ii. if the extra-ministerial data integration unit, or the person or entity in which it is located, is also a prescribed entity mentioned in subsection 45 (1) of the Personal Health Information Protection Act, 2004, an officer, employee or agent who is responsible for personal health information collected under that subsection, iii. another extra-ministerial data integration unit, or iv. a person or entity prescribed by the regulations, but only if the regulations authorize a member to collect the type of personal information. 3. A notice has been published on a website that relates to the personal information and that meets the requirements of section 49.10. 4. The minister of the ministry in which the inter-ministerial data integration unit is located or the senior officer of the extra-ministerial data integration unit, as the case may be, or a person designated by the minister or the senior officer, has determined, after considering the privacy interests of individuals and the manner in which their personal information will be protected, that there is a public interest in collecting the personal information. 5. A member of the multi-sector data integration unit has made a determination as to whether to link the personal information after it is collected to other personal information collected by the unit under this Part and, if so, the personal information with which it will be linked. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 4 (1-4). Collection of personal information, ministry data integration unit (2) Subject to the restrictions in section 49.5, a member of a ministry data integration unit may indirectly collect personal information if the following conditions are met: 1. The personal information is being collected for the purpose set out in section 49.2. 2. The personal information is to be collected from, i. an officer, employee or agent of the ministry in which the unit is located who is not a member of the unit, ii. a person or entity that receives funding from the ministry or that administers a program or service on behalf of or in partnership with the ministry, but only if the personal information relates to the funding or to the program or service provided on behalf of or in partnership with the ministry, as the case may be, or iii. a person or entity prescribed by the regulations, but only if the regulations authorize a member to collect the type of personal information to be collected. 3. A notice has been published on a website that relates to the personal information and that meets the requirements of section 49.10. 4. The minister of the ministry in which the ministry data integration unit is located, or a person designated by the minister, has determined, after considering the privacy interests of individuals and the manner in which their personal information will be protected, that there is a public interest in collecting the personal information. 5. A member of the ministry data integration unit has made a determination as to whether to link the personal information after it is collected to other personal information collected by the unit under this Part and, if so, the personal information with which it will be linked. 2019, c. 7, Sched. 31, s. 6. Additional requirements (3) The member shall comply with any additional requirements set out in the data standards when collecting personal information under this section. 2019, c. 7, Sched. 31, s. 6. Disclosure to unit (4) An institution or a person or entity referred to in paragraph 2 or 2.1 of subsection (1) or paragraph 2 of subsection (2), as the case may be, is authorized to disclose the personal information to the member and shall, (a) take reasonable steps to ensure that the personal information provided is accurate, complete and up-to-date before disclosing the information to the member; and (b) notify the member of any concerns respecting the accuracy or completeness of the information or how up-to-date it is. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 4 (5). Conflict (5) Personal information may be collected and disclosed as provided for in this section despite a confidentiality provision in any other Act and despite subsection 67 (2), unless the regulations provide that a confidentiality provision in another Act prevails over this section. 2019, c. 7, Sched. 31, s. 6. Same (5.1) If an extra-ministerial data integration unit, or the person or entity in which the unit is located, is also a prescribed entity mentioned in subsection 45 (1) of the Personal Health Information Protection Act, 2004, despite subsection 45 (6) of that Act, an officer, employee or agent of the prescribed entity who is responsible for personal health information under subsection 45 (1) of that Act may disclose personal health information under subsection (1) of this section. 2020, c. 5, Sched. 2, s. 4 (6). Collection of excluded information (6) Despite subsections 65 (1), (5.2), (6) and (8), the regulations may authorize the collection of personal information under this Part that is excluded from the application of this Act under those subsections. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 4 (1-6) - 25/03/2020 Restrictions on collection 49.5 (1) The authority to collect personal information under section 49.4 is subject to the following restrictions: 1. A member of a multi-sector data integration unit or a ministry data integration unit may not collect personal information until, i. the data standards have been approved by the Commissioner, and ii. in the case of a member of a multi-sector data integration unit, the Commissioner has completed a review of the unit’s practices and procedures under subsection 49.12 (2) after the unit’s designation. Note: On September 15, 2026, paragraph 1 of subsection 49.5 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 18) 1. A member of a multi-sector data integration unit or a ministry data integration unit may not collect personal information unless the data standards have been established by the Chief Digital and Data Officer. 2. If the purpose of collecting personal information is only to compile statistical information, the member must be a member of the inter-ministerial data integration unit designated by the regulations for this purpose. 3. Subject to subsection (1.1), a member of an inter-ministerial data integration unit or a ministry data integration unit shall not collect personal health information from a health information custodian unless the unit is located in the Ministry of Health or Ministry of Long-Term Care, or if the unit is designated by the regulations for this purpose. 4. A member of an extra-ministerial data integration unit may only collect personal health information if, i. it is collected from an inter-ministerial data integration unit or a ministry data integration unit, ii. the extra-ministerial data integration unit is also a prescribed entity mentioned in subsection 45 (1) of the Personal Health Information Protection Act, 2004 and information has been collected under that subsection, iii. it is collected from another extra-ministerial data integration unit that is also a prescribed entity mentioned in subsection 45 (1) of the Personal Health Information Protection Act, 2004 and that has collected the personal health information under that subsection, or iv. the collection is authorized by the regulations. 5. A member of a multi-sector data integration unit or a ministry data integration unit may not collect the following types of information, including personal information: i. Information that would reveal information that was obtained in connection with the imposition or collection of a tax or duty imposed under an Act of Canada or of a province or territory, unless the unit is located in the Ministry of Finance. ii. Notes of personal information about an individual that are recorded by a health information custodian and that document the contents of conversations during a counselling session. 6. Any other restriction prescribed by the regulations. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 5 (1-3). Collection of personal health information (1.1) Paragraphs 3 and 4 of subsection (1) do not have the effect of preventing a member of a multi-sector data integration unit or a ministry data integration unit from collecting personal health information from a ministry, even if that ministry is a health information custodian in respect of some or all of its functions. 2020, c. 5, Sched. 2, s. 5 (4). Definitions (2) In this section “health information custodian” and “personal health information” have the same meanings as in the Personal Health Information Protection Act, 2004. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 5 (1-4) - 25/03/2020 2026, c. 2, Sched. 7, s. 18 - 15/09/2026 Linking and de-identification 49.6 (1) Upon collection of personal information under this Part, a member of a multi-sector data integration unit or a ministry data integration unit shall do the following as soon as reasonably possible in the circumstances: 1. Create a record containing the minimal amount of personal information necessary for the purpose of de-identifying the information and linking it to other information collected by the unit. Note: On September 15, 2026, paragraph 1 of subsection 49.6 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 19) 1. Create a record containing the minimal amount of personal information necessary for the purpose of linking it to other information. 2. De-identify the personal information. Note: On September 15, 2026, paragraph 2 of subsection 49.6 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 19) 2. Link the relevant information. 3. If the information is to be linked, link the personal information that has been de-identified under paragraph 2 to other de-identified information within the unit. Note: On September 15, 2026, paragraph 3 of subsection 49.6 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 19) 3. De-identify the personal information. 4. Promptly and securely destroy any record created under paragraph 1 that contains personal information, subject to any exemptions set out in the data standards. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 6. Note: On September 15, 2026, paragraph 4 of subsection 49.6 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 19) 4. Promptly and securely destroy, in accordance with the data standards, any record created under paragraph 1 that contains personal information. Same (2) In complying with subsection (1), the member shall comply with the requirements set out in the data standards. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 6 - 25/03/2020 2026, c. 2, Sched. 7, s. 19 - 15/09/2026 Limits on use of personal information 49.7 (1) A member of an inter-ministerial data integration unit or a ministry data integration unit may only use personal information collected under this Part, (a) to link and de-identify the information under section 49.6; and (b) to conduct an audit where there are reasonable grounds to believe that there has been inappropriate receipt of a payment, service or good, including any benefit funded in whole or in part, directly or indirectly, by the Government of Ontario. 2019, c. 7, Sched. 31, s. 6. Extra-ministerial data integration unit (1.1) A member of an extra-ministerial data integration unit may only use personal information collected under this Part to link and de-identify the information under section 49.6. 2020, c. 5, Sched. 2, s. 7 (1). Reporting on use (2) The minister of the ministry in which an inter-ministerial data integration unit or a ministry data integration unit is located and the senior officer of every extra-ministerial data integration unit shall publicly report on the use of personal information under subsection (1) in accordance with the data standards. 2020, c. 5, Sched. 2, s. 7 (2). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 7 (1, 2) - 25/03/2020 Limits on use of de-identified information 49.8 No person or entity shall use or attempt to use information that has been de-identified under this Part, either alone or with other information, to identify an individual. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 Disclosure of personal information 49.9 (1) A member of a multi-sector data integration unit or a ministry data integration unit may only disclose personal information collected under this Part if, (a) the disclosure is to another member of the multi-sector data integration unit or the ministry data integration unit, as the case may be, who need access to the information in the performance of their duties in connection with this Part; (b) the disclosure is required by law; (c) the disclosure is to an institution or a law enforcement agency in Canada and, (i) the disclosure is to aid in an investigation undertaken by the institution or the agency with a view to a law enforcement proceeding, or (ii) there is a reasonable basis to believe that an offence may have been committed and the disclosure is to enable the institution or the agency to determine whether to conduct such an investigation; (d) the disclosure is for the purpose of a proceeding or a contemplated proceeding before a court or a tribunal and the information relates to or is a matter in issue in the proceeding and, (i) in the case of a member of an inter-ministerial data integration unit or a ministry data integration unit, the ministry or the Government of Ontario is, or is expected to be, a party, (i.1) in the case of a member of an extra-ministerial data integration unit, the unit, or the person or entity in which the unit is located, as the case may be, is or is expected to be, a party, or (ii) a current or former employee, consultant or agent of the unit is, or is expected to be, a witness; (e) the disclosure is to the Commissioner; or (f) the disclosure for a research purpose is permitted by the regulations and the conditions prescribed in the regulations are met. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 8 (1-3); 2023, c. 4, Sched. 3, s. 4. Exception (2) Clause (1) (c) does not apply to an extra-ministerial data integration unit. 2020, c. 5, Sched. 2, s. 8 (4). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 8 (1-4) - 25/03/2020 2023, c. 4, Sched. 3, s. 4 - 24/07/2023 Notice of collection 49.10 The minister of the ministry in which an inter-ministerial data integration unit or a ministry data integration unit is located and the senior officer of every extra-ministerial data integration unit shall ensure that a notice is published on a website that contains the following information respecting any personal information that a member of the unit intends to collect under this Part: 1. The legal authority for the collection. 2. The types of personal information that may be collected. 3. The sources of the personal information that may be collected. 4.

The purpose for which the personal information is collected and may be used and disclosed, including the general nature of the linkages that may be made with the personal information. 5. The title and contact information of a member of the multi-sector data integration unit or the ministry data integration unit, as the case may be, who can answer questions about the collection, use and disclosure of the personal information under this Part. 6. The contact information for the Commissioner and a description of the Commissioner’s functions under section 49.12. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 9. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 9 (1, 2) - 25/03/2020 Security and retention 49.11 (1) The minister of the ministry in which an inter-ministerial data integration unit or a ministry data integration unit is located and the senior officer of every extra-ministerial data integration unit shall ensure that any personal information collected under this Part is, (a) retained, transferred and disposed of in a secure manner so as to protect the information against theft or loss or unauthorized use or disclosure; (b) retained separately from other personal information in the custody or under the control of the institution or extra-ministerial data integration unit; (c) retained for the period of time set out in the data standards or, if there is no such specified period, for at least one year after the day it was last used by a member of the unit; and (d) securely disposed of in accordance with the data standards. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (1, 2). Security requirements (2) In complying with clause (1) (a), the minister or the senior officer, as the case may be, shall comply with any requirements set out in the data standards respecting the security of the personal information. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (3). Notice of theft, loss, etc., to individual (3) Subject to the exceptions and additional requirements, if any, that are prescribed, if personal information collected under this Part that is in the custody or control of an inter-ministerial data integration unit, an extra-ministerial data integration unit or a ministry data integration unit is stolen or lost or if it is used or disclosed in a manner that is not permitted by this Part, the minister of the ministry in which the unit is located or the senior officer of the extra-ministerial data integration unit, as the case may be, shall, (a) notify the individual to whom the personal information relates at the first reasonable opportunity of the theft or loss or the unauthorized use or disclosure; and (b) include in the notice a statement that the individual is entitled to make a complaint to the Commissioner. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (4). Notice to Commissioner (4) In the case of a theft or loss or of a use or disclosure in a manner that is not permitted by this Part, the minister or the senior officer, as the case may be, shall notify the Commissioner of the theft, loss or unauthorized use or disclosure at the first reasonable opportunity. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 10 (5). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 10 (1-5) - 25/03/2020 Commissioner’s review of practices 49.12 (1) The Commissioner may conduct a review of the practices and procedures of a multi-sector data integration unit or a ministry data integration unit if the Commissioner has reason to believe that the requirements of this Part are not being complied with. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (1). Mandatory review of inter-ministerial data integration unit (2) The Commissioner shall conduct a review of the practices and procedures of a multi-sector data integration unit in order to determine if they comply with the requirements under this Part, (a) after the unit is designated; and (b) as otherwise necessary to ensure that a review of the practices and procedures is conducted at least once every three years. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (1). Note: On September 15, 2026, subsection 49.12 (2) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 20 (1)) Mandatory reviews, transition (2) The Commissioner shall cease any review of the practices and procedures of a multi-sector data integration unit under subsection (2), as it read before the day section 20 of Schedule 7 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, commenced by the Commissioner before that day. 2026, c. 2, Sched. 7, s. 20 (1). Same (2.1) The Commissioner may determine that a review of the practices and procedures of an extra-ministerial data integration unit conducted by the Commissioner under the Personal Health Information Protection Act, 2004 is satisfactory, in whole or in part, for the purposes of subsection (2) and shall notify the senior officer of the extra-ministerial data integration of this determination. 2020, c. 5, Sched. 2, s. 11 (2). Note: On September 15, 2026, subsection 49.12 (2.1) of the Act is repealed. (See: 2026, c. 2, Sched. 7, s. 20 (1)) Conduct of review (3) In conducting a review referred to in subsection (1), the Commissioner shall review the practices and procedures of the multi-sector data integration unit or the ministry data integration unit, as the case may be, to determine whether, (a) there has been unauthorized collection, retention, use, disclosure, access to or modification of personal information collected under this Part; and (b) the requirements under this Part, including requirements with respect to notice, de-identification, retention, security and secure disposal, have been met. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (3). Note: On September 15, 2026, subsection 49.12 (3) of the Act is amended by striking out “shall” and substituting “may”. (See: 2026, c. 2, Sched. 7, s. 20 (2)) Duty to assist (4) Members of the inter-ministerial data integration unit, extra-ministerial data integration unit or the ministry data integration unit and the minister of the ministry in which the unit is located or the senior officer of the extra-ministerial data integration unit shall co-operate with and assist the Commissioner in the conduct of the review. 2020, c. 5, Sched. 2, s. 11 (4). Powers of Commissioner (5) The Commissioner may require the production of such information and records that are relevant to the subject matter of the review and that are in the custody or under the control of, (a) in the case of an inter-ministerial data integration unit or a ministry data integration unit, the ministry in which the unit is located; (b) in the case of an extra-ministerial data integration unit, the unit or the person or entity in which the unit is located, as the case may be; (c) an institution, an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, a person or an entity that has disclosed personal information to the inter-ministerial data integration unit, extra-ministerial data integration unit or the ministry data integration unit, as the case may be, under this Part; or (d) an institution, an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, a person or entity to whom a member of the inter-ministerial data integration unit, extra-ministerial data integration unit or the ministry data integration unit has disclosed personal information under this Part. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (5). Same (6) A member of an inter-ministerial data integration unit or a ministry data integration unit, the minister of the ministry in which the unit is located, a member of an extra-ministerial data integration unit and its senior officer, the head of an institution referred to in clause (5) (c) or (d), the administrative head of any person or entity referred to in either of those clauses and any person referred to in either of those clauses who is an individual shall provide the Commissioner with whatever assistance is reasonably necessary for the conduct of the review, including using any data storage processing or retrieval device or system to produce a record required by the Commissioner in readable form. 2020, c. 5, Sched. 2, s. 11 (6). Orders (7) If, after giving an opportunity to be heard to the minister of the ministry in which the inter-ministerial data integration unit or the ministry data integration unit is located or the senior officer of the extra-ministerial data integration unit, as the case may be, the Commissioner determines that a practice or procedure contravenes this Part, the Commissioner may order the unit to do any of the following: 1. Discontinue the practice or procedure. 2. Change the practice or procedure as specified by the Commissioner. 3. Destroy personal information collected or retained under the practice or procedure. 4. Implement a new practice or procedure as specified by the Commissioner. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 11 (7). Limit on certain orders (8) The Commissioner may order under subsection (7) no more than what is reasonably necessary to achieve compliance with this Part. 2019, c. 7, Sched. 31, s. 6. Procedure (9) The Statutory Powers Procedure Act does not apply to a review conducted under this section. 2019, c. 7, Sched. 31, s. 6. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 11 (1-7) - 25/03/2020 2026, c. 2, Sched. 7, s. 20 (1, 2) - 15/09/2026 Annual report 49.13 (1) The minister of a ministry in which is located an inter-ministerial data integration unit or a ministry data integration unit that collects personal information under this Part during the course of a year shall ensure that an annual report for the year is published on a Government of Ontario website on or before April 1 in the following year. 2019, c. 7, Sched. 31, s. 6. Same (1.1) The senior officer of an extra-ministerial data integration unit that collects personal information under this Part during the course of a year shall ensure that an annual report for the year is published on a publicly accessible website on or before April 1 in the following year. 2020, c. 5, Sched. 2, s. 12 (1). Contents of report (2) The annual report shall, (a) describe the types of personal information that were collected and used during the year; (b) describe the purposes for which personal information was collected, used and disclosed during the year; (c) describe the nature of the linkages of personal information that have been made over the year; (d) provide a summary of the manner in which de-identified information was used and disclosed during the year; and (e) set out a description of how the practices and procedures of the multi-sector data integration unit or the ministry data integration unit, as the case may be, meet the requirements of this Part. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 12 (2). Note: On September 15, 2026, section 49.13 of the Act is amended by adding the following subsection: (See: 2026, c. 2, Sched. 7, s. 21) Chief Digital and Data Officer’s annual report (3) The Chief Digital and Data Officer shall ensure that, on or before September 1 in each year, an annual report of the activities of data integration units over the course of the previous year is prepared and provided to the Commissioner. 2026, c. 2, Sched. 7, s. 21. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 12 (1, 2) - 25/03/2020 2026, c. 2, Sched. 7, s. 21 - 15/09/2026 Data standards 49.14 (1) The responsible minister or a person designated by him or her shall, (a) prepare draft data standards providing for anything referred to in this Part as being provided for in the data standards, as well as practices and procedures for use, in connection with this Part, when, (i) collecting, using and disclosing personal information, (ii) linking and de-identifying personal information, (iii) reporting publicly on the use of personal information, (iv) securely retaining personal information, including providing for a minimum retention period for personal information, and (v) securely disposing of personal information; and (b) provide the draft data standards to the Commissioner who may approve them. 2019, c. 7, Sched. 31, s. 6. Note: On September 15, 2026, subsection 49.14 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 22 (1)) Data standards (1) The Chief Digital and Data Officer shall establish data standards providing for anything referred to in this Part as being provided for in the data standards for use in connection with this Part when, (a) collecting, using and disclosing personal information; (b) linking and de-identifying personal information; (c) reporting publicly on the use of personal information; (d) securely retaining personal information, including providing for a minimum retention period for personal information; and (e) securely disposing of personal information. 2026, c. 2, Sched. 7, s. 22 (1). Publicly available (2) The responsible minister shall make the data standards available on a Government of Ontario website in English and in French. 2019, c. 7, Sched. 31, s. 6. Note: On September 15, 2026, subsection 49.14 (2) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 7, s. 22 (1)) Publicly available (2) The Chief Digital and Data Officer shall make the data standards available on a Government of Ontario website in English and in French. 2026, c. 2, Sched. 7, s. 22 (1). Non-application of the Legislation Act, 2006, Part III (3) Part III (Regulations) of the Legislation Act, 2006 does not apply to the data standards. 2019, c. 7, Sched. 31, s. 6. Compliance with data standards (4) A member of a multi-sector data integration unit or a ministry data integration unit shall comply with the data standards. 2019, c. 7, Sched. 31, s. 6; 2020, c. 5, Sched. 2, s. 13. Note: On September 15, 2026, section 49.14 of the Act is amended by adding the following subsection: (See: 2026, c. 2, Sched. 7, s. 22 (2)) Transition, data standards (5) If, on the day section 22 of Schedule 7 to the Plan to Protect Ontario Act (Budget Measures), 2026 comes into force, the Chief Digital and Data Officer has not established data standards under subsection (1), the data standards approved by the Commissioner under that subsection, as it read immediately before that day, that were in force immediately before that day are deemed to have been established by the Chief Digital and Data Officer. 2026, c. 2, Sched. 7, s. 22 (2). Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 13 - 25/03/2020 2026, c. 2, Sched. 7, s. 22 (1, 2) - 15/09/2026 Note: On September 15, 2026, the Act is amended by adding the following section: (See: 2026, c. 2, Sched. 7, s. 23) Commissioner’s comments and recommendations 49.14.1 The Commissioner may make comments or recommendations on the privacy implications of any matter related to this Part, including any matter related to the data standards. 2026, c. 2, Sched. 7, s. 23. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 7, s. 23 - 15/09/2026 Regulations 49.15 (1) The Lieutenant Governor in Council may make regulations governing anything that this Part refers to as being provided for in the regulations. 2019, c. 7, Sched. 31, s. 6. Inter-ministerial data integration unit (2) The regulations may only designate a single inter-ministerial data integration unit whose members are also authorized to collect personal information solely for the purpose of compiling statistical information, and the unit must be located in the ministry of the minister who is responsible for the administration of the Statistics Act. 2019, c. 7, Sched. 31, s. 6. Consultation with Commissioner (3) A minister shall consult with the Commissioner before recommending a regulation to the Lieutenant Governor in Council that, (a) designates a multi-sector data integration unit; or (b) permits the disclosure of personal information for a research purpose under clause 49.9 (1) (f) or establishes any conditions for the purposes of that clause. 2020, c. 5, Sched. 2, s. 14. Section Amendments with date in force (d/m/y) 2019, c. 7, Sched. 31, s. 6 - 04/11/2019 2020, c. 5, Sched. 2, s. 14 - 25/03/2020 PART IV APPEAL Right to appeal 50 (1) A person who has made a request for, (a) access to a record under subsection 24 (1); (b) access to personal information under subsection 48 (1); or (c) correction of personal information under subsection 47 (2), or a person who is given notice of a request under subsection 28 (1) may appeal any decision of a head under this Act to the Commissioner. R.S.O. 1990, c. F.31, s. 50 (1). Note: On a day to be named by proclamation of the Lieutenant Governor, section 50 of the Act is amended by adding the following subsection: (See: 2020, c. 5, Sched. 2, s. 15) Same (1.0.1) This Part applies, with any necessary modifications, to a request for access to personal information made under subsection 48 (1) to an extra-ministerial data integration unit, as that subsection applies by application of subsection 37 (3). 2020, c. 5, Sched. 2, s. 15. Limit on right of appeal (1.0.2) Despite subsection (1), a decision of a head to amend a plan for providing access to the records in stages referred to in subsection 24.1 (1) after the plan has already been amended once by the head may not be appealed to the Commissioner. 2026, c. 2, Sched. 7, s. 24 (1). Fee (1.1) A person who appeals under subsection (1) shall pay the fee prescribed by the regulations for that purpose. 1996, c. 1, Sched. K, s. 8. Time for application (2) Subject to subsection (2.0.1), an appeal under subsection (1) shall be made within 30 business days after the notice was given of the decision appealed from by filing with the Commissioner written notice of appeal. R.S.O. 1990, c. F.31, s. 50 (2); 2016, c. 5, Sched. 10, s. 3 (1); 2026, c. 2, Sched. 7, s. 24 (2). Extension of time (2.0.1) If the time limit specified in subsection (2) presents a barrier, as defined in the Accessibility for Ontarians with Disabilities Act, 2005, to the person, the Commissioner may extend the time limit for a period of time that is reasonably required in the circumstances to accommodate the person for the purpose of making the appeal. 2016, c. 5, Sched. 10, s. 3 (2). Transition, business days (2.0.2) Subsection (2), as it read immediately before the day section 24 of Schedule 7 to the Plan to Protect Ontario Act (Budget Measures), 2026 came into force, continues to apply in respect of notices given before that day. 2026, c. 2, Sched. 7, s. 24 (3). Immediate dismissal (2.1) The Commissioner may dismiss an appeal if the notice of appeal does not present a reasonable basis for concluding that the record or the personal information to which the notice relates exists. 1996, c. 1, Sched. K, s. 8. Non-application (2.2) If the Commissioner dismisses an appeal under subsection (2.1), subsection (3) and sections 51 and 52 do not apply to the Commissioner. 1996, c. 1, Sched. K, s. 8. Notice of application for appeal (3) Upon receiving a notice of appeal, the Commissioner shall inform the head of the institution concerned of the notice of appeal and may also inform any other institution or person with an interest in the appeal, including an institution within the meaning of the Municipal Freedom of Information and Protection of Privacy Act, of the notice of appeal. 2006, c. 34, Sched. C, s. 7. Ombudsman Act not to apply (4) The Ombudsman Act does not apply in respect of a complaint for which an appeal is provided under this Act or the Municipal Freedom of Information and Protection of Privacy Act, a complaint respecting a review conducted by the Commissioner under section 49.0.1 or 49.12 or an order made by the Commissioner under either of those sections or to the Commissioner or the Commissioner’s delegate acting under this Act or the Municipal Freedom of Information and Protection of Privacy Act. R.S.O. 1990, c. F.31, s. 50 (4); 2019, c. 7, Sched. 31, s. 7; 2024, c. 24, Sched. 2, s. 8. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 8 - 30/01/1996 2006, c. 34, Sched. C, s. 7 - 01/04/2007 2016, c. 5, Sched. 10, s. 3 (1, 2) - 19/04/2016 2019, c. 7, Sched. 31, s. 7 - 04/11/2019 2020, c. 5, Sched. 2, s. 15 - not in force 2024, c. 24, Sched. 2, s. 8 - 01/07/2025 2026, c. 2, Sched. 7, s. 24 (1-3) - 01/07/2026 Mediator to try to effect settlement 51 The Commissioner may authorize a mediator to investigate the circumstances of any appeal and to try to effect a settlement of the matter under appeal. R.S.O. 1990, c. F.31, s. 51. Inquiry 52 (1) The Commissioner may conduct an inquiry to review the head’s decision if, (a) the Commissioner has not authorized a mediator to conduct an investigation under section 51; or (b) the Commissioner has authorized a mediator to conduct an investigation under section 51 but no settlement has been effected. 1996, c. 1, Sched. K, s. 9. Procedure (2) The Statutory Powers Procedure Act does not apply to an inquiry under subsection (1). R.S.O. 1990, c. F.31, s. 52 (2). Inquiry in private (3) The inquiry may be conducted in private. R.S.O. 1990, c. F.31, s. 52 (3). Powers of Commissioner (4) In an inquiry, the Commissioner may require to be produced to the Commissioner and may examine any record that is in the custody or under the control of an institution, despite Parts II and III of this Act or any other Act or privilege, and may enter and inspect any premises occupied by an institution for the purposes of the investigation. R.S.O. 1990, c. F.31, s. 52 (4). Record not retained by Commissioner (5) The Commissioner shall not retain any information obtained from a record under subsection (4). R.S.O. 1990, c. F.31, s. 52 (5). Examination on site (6) Despite subsection (4), a head may require that the examination of a record by the Commissioner be of the original at its site. R.S.O. 1990, c. F.31, s. 52 (6). Notice of entry (7) Before entering any premises under subsection (4), the Commissioner shall notify the head of the institution occupying the premises of his or her purpose. R.S.O. 1990, c. F.31, s. 52 (7). Examination under oath (8) The Commissioner may summon and examine on oath any person who, in the Commissioner’s opinion, may have information relating to the inquiry, and for that purpose the Commissioner may administer an oath. R.S.O. 1990, c. F.31, s. 52 (8). Evidence privileged (9) Anything said or any information supplied or any document or thing produced by a person in the course of an inquiry by the Commissioner under this Act is privileged in the same manner as if the inquiry were a proceeding in a court. R.S.O. 1990, c. F.31, s. 52 (9). Protection (10) Except on the trial of a person for perjury in respect of his or her sworn testimony, no statement made or answer given by that or any other person in the course of an inquiry by the Commissioner is admissible in evidence in any court or at any inquiry or in any other proceedings, and no evidence in respect of proceedings before the Commissioner shall be given against any person. R.S.O. 1990, c. F.31, s. 52 (10). Protection under Federal Act (11) A person giving a statement or answer in the course of an inquiry before the Commissioner shall be informed by the Commissioner of his or her right to object to answer any question under section 5 of the Canada Evidence Act. R.S.O. 1990, c. F.31, s. 52 (11). Prosecution (12) No person is liable to prosecution for an offence against any Act, other than this Act, by reason of his or her compliance with a requirement of the Commissioner under this section. R.S.O. 1990, c. F.31, s. 52 (12). Representations (13) The person who requested access to the record, the head of the institution concerned and any other institution or person informed of the notice of appeal under subsection 50 (3) shall be given an opportunity to make representations to the Commissioner, but no person is entitled to have access to or to comment on representations made to the Commissioner by any other person or to be present when such representations are made. 2006, c. 34, Sched. C, s. 8 (1). Right to representation (14) Each of the following may be represented by a person authorized under the Law Society Act to represent them: 1. The person who requested access to the record. 2. The head of the institution concerned. 3. Any other institution or person informed of the notice of appeal under subsection 50 (3). 2006, c. 34, Sched. C, s. 8 (5). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 9 - 30/01/1996 2006, c. 21, Sched. C, s. 110 - 1/05/2007; 2006, c. 34, Sched. C, s. 8 (1, 2) - 1/04/2007; 2006, c. 34, Sched. C, s. 8 (5) - 1/05/2007 Burden of proof 53 Where a head refuses access to a record or a part of a record, the burden of proof that the record or the part falls within one of the specified exemptions in this Act lies upon the head. R.S.O. 1990, c. F.31, s. 53. Order 54 (1) After all of the evidence for an inquiry has been received, the Commissioner shall make an order disposing of the issues raised by the appeal. R.S.O. 1990, c. F.31, s. 54 (1). Idem (2) Where the Commissioner upholds a decision of a head that the head may refuse to disclose a record or a part of a record, the Commissioner shall not order the head to disclose the record or part. R.S.O. 1990, c. F.31, s. 54 (2). Terms and conditions (3) Subject to this Act, the Commissioner’s order may contain any terms and conditions the Commissioner considers appropriate. R.S.O. 1990, c. F.31, s. 54 (3); 1996, c. 1, Sched. K, s. 10. Notice of order (4) The Commissioner shall give the appellant and the persons who received notice of the appeal under subsection 50 (3) written notice of the order. R.S.O. 1990, c. F.31, s. 54 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 10 - 30/01/1996 Confidentiality 55 (1) The Commissioner or any person acting on behalf of or under the direction of the Commissioner shall not disclose any information that comes to their knowledge in the performance of their powers, duties and functions under this or any other Act, unless the disclosure is permitted for a prescribed purpose. R.S.O. 1990, c. F.31, s. 55 (1); 2024, c. 24, Sched. 2, s. 9. Not compellable witness (2) The Commissioner or any person acting on behalf or under the direction of the Commissioner is not compellable to give evidence in a court or in a proceeding of a judicial nature concerning anything coming to their knowledge in the exercise or performance of a power, duty or function under this or any other Act. R.S.O. 1990, c. F.31, s. 55 (2). Proceedings privileged (3) No proceeding lies against the Commissioner or against any person acting on behalf or under the direction of the Commissioner for anything done, reported or said in good faith in the course of the exercise or performance or intended exercise or performance of a power, duty or function under this or any other Act. R.S.O. 1990, c. F.31, s. 55 (3). Section Amendments with date in force (d/m/y) 2024, c. 24, Sched. 2, s. 9 - 29/01/2025 Delegation by Commissioner 56 (1) The Commissioner may in writing delegate a power or duty granted to or vested in the Commissioner to an officer or officers employed by the Commissioner, except the power to delegate under this section, subject to such limitations, restrictions, conditions and requirements as the Commissioner may set out in the delegation. R.S.O. 1990, c. F.31, s. 56 (1). Exception re records under s. 12 or 14 (2) The Commissioner shall not delegate to a person other than the Deputy Commissioner or an Assistant Commissioner his or her power to require a record referred to in section 12 or 14 to be produced and examined. R.S.O. 1990, c. F.31, s. 56 (2); 2018, c. 17, Sched. 19, s. 5. Section Amendments with date in force (d/m/y) 2018, c. 17, Sched. 19, s. 5 - 06/12/2018 PART V GENERAL Fees 57 (1) A head shall require the person who makes a request for access to a record to pay fees in the amounts prescribed by the regulations for, (a) the costs of every hour of manual search required to locate a record; (b) the costs of preparing the record for disclosure; (c) computer and other costs incurred in locating, retrieving, processing and copying a record; (d) shipping costs; and (e) any other costs incurred in responding to a request for access to a record. 1996, c. 1, Sched. K, s. 11 (1). (2) Repealed: 1996, c. 1, Sched. K, s. 11 (1). Estimate of costs (3) If the head estimates that the amount required to be paid under this Act is over $25, the head shall, before giving access to a record, (a) give the person requesting access a reasonable estimate of the amount; and (b) inform the person that they may request that the head waive the payment of all or any part of the amount. 2026, c. 2, Sched. 7, s. 25. Timing of estimate (3.1) The estimate shall be given before the expiry of the time limit set out in section 26 or, where there has been an extension of a time limit under subsection 27 (1) or (1.1), within that extended time limit. 2026, c. 2, Sched. 7, s. 25. Effect on time limit (3.2) At the end of the day on which the estimate is given, the time limit within which notice is required to be given under section 26 stops running and resumes running on the day on which any fee required under this section is paid or waived or, if that day is not a business day, on the next business day following that day. 2026, c. 2, Sched. 7, s. 25. Waiver of payment (4) A head shall waive the payment of all or any part of an amount required to be paid under subsection (1) if, in the head’s opinion, it is fair and equitable to do so after considering, (a) the extent to which the actual cost of processing, collecting and copying the record varies from the amount of the payment required by subsection (1); (b) whether the payment will cause a financial hardship for the person requesting the record; (c) whether dissemination of the record will benefit public health or safety; and (d) any other matter prescribed in the regulations. R.S.O. 1990, c. F.31, s. 57 (4); 1996, c. 1, Sched. K, s. 11 (2). Review (5) A person who is required to pay a fee under subsection (1) may ask the Commissioner to review the amount of the fee or the head’s decision not to waive the fee. R.S.O. 1990, c. F.31, s. 57 (5); 1996, c. 1, Sched. K, s. 11 (3). Disposition of fees (6) The fees provided in this section shall be paid and distributed in the manner and at the times prescribed in the regulations. 1996, c. 1, Sched. K, s. 11 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 11 (1-4) - 30/01/1996 2026, c. 2, Sched. 7, s. 25 - 01/07/2026 Whistleblowing 57.1 (1) Any person who has reasonable grounds to believe that an institution, a ministry data integration unit under Part III.1 or a multi-sector data integration unit under Part III.1 has contravened or is about to contravene this Act or the regulations may notify the Commissioner of the particulars of the matter and may request that their identity be kept confidential with respect to the notification. 2024, c. 24, Sched. 2, s. 10. Confidentiality (2) The Commissioner must keep confidential the identity of a person who has notified the Commissioner under subsection (1) and to whom an assurance of confidentiality has been provided by the Commissioner. 2024, c. 24, Sched. 2, s. 10. Section Amendments with date in force (d/m/y) 2024, c. 24, Sched. 2, s. 10 - 29/01/2025 Annual report of Commissioner 58 (1) The Commissioner shall make an annual report to the Speaker of the Assembly in accordance with subsections (2) and (3). 2004, c. 3, Sched. A, s. 81 (4). Contents of report (2) A report made under subsection (1) shall provide a comprehensive review of the effectiveness of this Act and the Municipal Freedom of Information and Protection of Privacy Act in providing access to information and protection of personal privacy including, (0.a) the number of complaints received by the Commissioner in respect to the information practices of institutions and the number of reviews conducted under section 49.0.1 of this Act or under section 38.1 of the Municipal Freedom of Information and Protection of Privacy Act; (a) a summary of the nature and ultimate resolutions of appeals carried out under subsection 50 (1) of this Act and under subsection 39 (1) of the Municipal Freedom of Information and Protection of Privacy Act; (b) an assessment of the extent to which institutions are complying with this Act and the Municipal Freedom of Information and Protection of Privacy Act; and (c) the Commissioner’s recommendations with respect to the practices of particular institutions and with respect to proposed revisions to this Act, the Municipal Freedom of Information and Protection of Privacy Act and the regulations under them. R.S.O. 1990, c. F.31, s. 58 (2); 2024, c. 24, Sched. 2, s. 11; 2026, c. 2, Sched. 7, s. 26 (1). Same, personal health information (3) If the Commissioner has delegated powers or duties under the Personal Health Information Protection Act, 2004 to the Assistant Commissioner for Personal Health Information, a report made under subsection (1) shall include a report prepared in consultation with the Assistant Commissioner on the exercise of the Commissioner’s powers and duties under that Act, including, (a) information related to the number and nature of complaints received by the Commissioner under section 56 of that Act and the disposition of them; (b) information related to the number and nature of reviews conducted by the Commissioner under section 58 of that Act and the disposition of them; (c) information related to the number of times the Commissioner has made a determination under subsection 60 (13) of that Act and general information about the Commissioner’s grounds for the determination; (d) all other information prescribed by the regulations made under that Act; and (e) all other matters that the Commissioner considers appropriate. 2004, c. 3, Sched. A, s. 81 (5). Tabling (4) The Speaker shall cause the annual report to be laid before the Assembly if it is in session or shall deposit the report with the Clerk of the Assembly if the Assembly is not in session. 2004, c. 3, Sched. A, s. 81 (5). Institution (5) In this section, “institution” includes an institution as defined in section 2 of the Municipal Freedom of Information and Protection of Privacy Act. 2026, c. 2, Sched. 7, s. 26 (2). Section Amendments with date in force (d/m/y) 2004, c. 3, Sched. A, s. 81 (4, 5) - 01/11/2004 2024, c. 24, Sched. 2, s. 11 - 01/07/2025 2026, c. 2, Sched. 7, s. 26 (1, 2) - 01/07/2026 Powers and duties of Commissioner 59 (1) The Commissioner may, (a) offer comment on the privacy protection implications of proposed legislative schemes or government programs; (b) Repealed: 2024, c. 24, Sched. 2, s. 12 (1). (c) in appropriate circumstances, authorize the collection of personal information otherwise than directly from the individual; (d) engage in or commission research into matters affecting the carrying out of the purposes of this Act; (e) conduct public education programs and provide information concerning this Act and the Commissioner’s role and activities; and (f) receive representations from the public concerning the operation of this Act. R.S.O. 1990, c. F.31, s. 59; 2024, c. 24, Sched. 2, s. 12 (1). Consultations with other privacy commissioners (2) The Commissioner may, in order to ensure that personal information is protected in as consistent a manner as possible, consult with a law enforcement officer or any person who, under an Act of Canada or of another province or territory of Canada, has powers, duties and functions similar to those of the Commissioner with respect to the protection of personal information. 2024, c. 24, Sched. 2, s. 12 (2). Agreements or arrangements (3) The Commissioner may enter into agreements or arrangements with any person referred to in subsection (2) in order to, (a) coordinate the activities of their offices and the office of the Commissioner, including to provide for mechanisms for the handling of any complaint in which they are mutually interested; (b) undertake and publish research or develop and publish guidelines or other documents related to the protection of personal information; (c) develop model contracts or other documents related to the protection of personal information that is collected, used or disclosed interprovincially or internationally; and (d) develop procedures for collecting and disclosing information referred to in subsection (4). 2024, c. 24, Sched. 2, s. 12 (2). Collection or disclosure of information (4) The Commissioner may, in accordance with any procedure established under clause (3) (d), disclose information, other than information described in section 12, 14 or 19 of the Act, to any person referred to in subsection (2) of this section or may collect information from any such person, if the information, (a) could be relevant to an ongoing or potential investigation of a complaint, inquiry or audit under this Act or under an Act of Canada or of another province or territory of Canada that has objectives that are similar to this Act; or (b) could assist the Commissioner or that person in the exercise of their powers or the performance of their duties or functions with respect to the protection of personal information. 2024, c. 24, Sched. 2, s. 12 (2). Purpose and confidentiality (5) The procedures referred to in clause (3) (d) must, (a) restrict the use of the information to the purpose for which it was originally disclosed; and (b) stipulate that the information be treated in a confidential manner and not be further disclosed for other purposes without the express consent of the Commissioner. 2024, c. 24, Sched. 2, s. 12 (2). Section Amendments with date in force (d/m/y) 2024, c. 24, Sched. 2, s. 12 (1) - 01/07/2025; 2024, c. 24, Sched. 2, s. 12 (2) - 29/01/2025 Regulations 60 (1) The Lieutenant Governor in Council may make regulations, (0.a) prescribing standards for determining what constitutes reasonable grounds for a head to conclude that a request for access to a record is frivolous or vexatious; (0.a.1) prescribing Aboriginal organizations and communities for the purposes of clause (c) of the definition of “Aboriginal community” in subsection 15.1 (2); (a) respecting the procedures for access to original records under section 30; Note: On a day to be named by proclamation of the Lieutenant Governor, subsection 60 (1) of the Act is amended by adding the following clause: (See: 2020, c. 5, Sched. 2, s. 16) (a.1) prescribing modifications for the purposes of subsection 37 (3); (b) respecting the procedures for access to personal information under subsection 48 (3); (b.1) requiring the head of an institution to assist persons with disabilities in making requests for access under subsection 24 (1) or 48 (1); (c) prescribing the circumstances under which records capable of being produced from machine readable records are not included in the definition of “record” for the purposes of this Act; (c.1) governing assessments under section 38, including prescribing information to be included in an assessment and providing for circumstances in which an assessment or an update is not required to be prepared; (d) setting standards for and requiring administrative, technical and physical safeguards to ensure the security and confidentiality of records and personal information under the control of institutions; (d.1) providing for procedures to be followed by an institution if personal information is disclosed in contravention of this Act; (e) setting standards for the accuracy and completeness of personal information that is under the control of an institution; (f) prescribing time periods for the purposes of subsection 40 (1); (f.1) respecting the disposal of personal information under subsection 40 (4), including providing for different procedures for the disposal of personal information based on the sensitivity of the personal information; (g) prescribing the amount, the manner of payment and the manner of allocation of fees described in clause 24 (1) (c) or 48 (1) (c), subsection 50 (1.1) or section 57 and the times at which they are required to be paid; (g.1) prescribing additional modifications to this Act for the purposes of subsection 49.1.1 (2); (g.2) prescribing purposes for which disclosure is permitted under subsection 55 (1); (h) prescribing matters to be considered in determining whether to waive all or part of the costs required under section 57; (i) designating any agency, board, commission, corporation or other body as an institution and designating a head for each such institution; (j) prescribing conditions relating to the security and confidentiality of records used for a research purpose; (j.1) exempting one or more private hospitals from the application of this Act; (j.2) providing for transitional matters arising from the enactment of Schedule 19 to the Restoring Trust, Transparency and Accountability Act, 2018; (k) prescribing forms and providing for their use; (l) respecting any matter the Lieutenant Governor in Council considers necessary to carry out effectively the purposes of this Act. R.S.O. 1990, c. F.31, s. 60; 1996, c. 1, Sched. K, s. 12 (1, 2); 2010, c. 25, s. 24 (16); 2006, c. 34, Sched. C, s. 9; 2017, c. 8, Sched. 13, s. 5; 2018, c. 17, Sched. 19, s. 6 (1); 2023, c. 4, Sched. 3, s. 5; 2024, c. 24, Sched. 2, s. 13. Categories of fees (2) A regulation made under clause (1) (g) may prescribe a different amount, manner of payment, manner of allocation or time of payment of fees for different categories of records or persons requesting access to a record. 1996, c. 1, Sched. K, s. 12 (3). Conflict (3) If there is a conflict between a regulation made under clause (1) (j.2) and a provision of this or any other Act or a provision of another regulation made under this or any other Act, the regulation made under clause (1) (j.2) prevails. 2018, c. 17, Sched. 19, s. 6 (2). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 12 (1-3) - 30/01/1996 2006, c. 34, Sched. C, s. 9 - 31/12/2016 2010, c. 25, s. 24 (16) - 01/01/2012 2017, c. 8, Sched. 13, s. 5 - 09/03/2018; 2017, c. 25, Sched. 9, s. 94 (5) - no effect - see 2023, c. 4, Sched. 1, s. 67 - 18/05/2023 2018, c. 17, Sched. 19, s. 6 (1, 2) - 06/12/2018 2020, c. 5, Sched. 2, s. 16 - not in force 2023, c. 4, Sched. 3, s. 5 - 24/07/2023 2024, c. 24, Sched. 2, s. 13 - 29/01/2025 Offences 61 (1) No person shall, (a) wilfully collect, use or disclose personal information in contravention of this Act; (b) Repealed: 2026, c. 2, Sched. 7, s. 27. (b.1) wilfully contravene section 49.8; (c) make a request under this Act for access to or correction of personal information under false pretenses; (c.1) alter, conceal or destroy a record, or cause any other person to do so, with the intention of denying a right under this Act to access the record or the information contained in the record; (d) wilfully obstruct the Commissioner in the performance of his or her functions under this Act; (e) wilfully make a false statement to, mislead or attempt to mislead the Commissioner in the performance of his or her functions under this Act; or (f) wilfully fail to comply with an order of the Commissioner. R.S.O. 1990, c. F.31, s. 61 (1); 2014, c. 13, Sched. 6, s. 2 (1); 2019, c. 7, Sched. 31, s. 8; 2024, c. 24, Sched. 2, s. 14; 2026, c. 2, Sched. 7, s. 27. Penalty (2) Every person who contravenes subsection (1) is guilty of an offence and on conviction is liable to a fine not exceeding $5,000. R.S.O. 1990, c. F.31, s. 61 (2). Consent of Attorney General (3) A prosecution shall not be commenced under clause (1) (c.1), (d), (e) or (f) without the consent of the Attorney General. R.S.O. 1990, c. F.31, s. 61 (3); 2014, c. 13, Sched. 6, s. 2 (2). Extended limitation for prosecution (4) A prosecution for an offence under clause (1) (c.1) shall not be commenced more than two years after the day evidence of the offence was discovered. 2014, c. 13, Sched. 6, s. 2 (3). Protection of information (5) In a prosecution for an offence under this section, the court may take precautions to avoid the disclosure by the court or any person of any of the following information, including, where appropriate, conducting hearings or parts of hearings in private or sealing all or part of the court files: 1. Information that may be subject to an exemption from disclosure under sections 12 to 21.1. 2. Information to which this Act may not apply under section 65. 3. Information that may be subject to a confidentiality provision in any other Act. 2014, c. 13, Sched. 6, s. 2 (4). Section Amendments with date in force (d/m/y) 2014, c. 13, Sched. 6, s. 2 (1-4) - 01/01/2016 2019, c. 7, Sched. 31, s. 8 - 04/11/2019 2024, c. 24, Sched. 2, s. 14 - 01/07/2025 2026, c. 2, Sched. 7, s. 27 - 01/07/2026 Delegation, civil proceedings Delegation of head’s powers 62 (1) A head may in writing delegate a power or duty granted or vested in the head to an officer or officers of the institution or another institution subject to such limitations, restrictions, conditions and requirements as the head may set out in the delegation. R.S.O. 1990, c. F.31, s. 62 (1); 2006, c. 34, Sched. C, s. 10. Protection from civil proceeding (2) No action or other proceeding lies against a head, or against a person acting on behalf or under the direction of the head, for damages resulting from the disclosure or non-disclosure in good faith of a record or any part of a record under this Act, or from the failure to give a notice required under this Act if reasonable care is taken to give the required notice. R.S.O. 1990, c. F.31, s. 62 (2). Vicarious liability of Crown preserved (3) Subsection (2) does not by reason of subsection 8 (3) of the Crown Liability and Proceedings Act, 2019 relieve the Crown of liability in respect of a tort committed by a person mentioned in subsection (2) to which it would otherwise be subject, and the Crown is liable under that Act for any such tort in a like manner as if subsection (2) had not been enacted. R.S.O. 1990, c. F.31, s. 62 (3); 2019, c. 7, Sched. 17, s. 80. Vicarious liability of certain institutions preserved (4) Subsection (2) does not relieve an institution of liability in respect of a tort committed by a person mentioned in subsection (2) to which it would otherwise be subject and the institution is liable for any such tort in a like manner as if subsection (2) had not been enacted. R.S.O. 1990, c. F.31, s. 62 (4). Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 10 - 01/04/2007 2019, c. 7, Sched. 17, s. 80 - 01/07/2019 Informal access Oral requests 63 (1) Where a head may give access to information under this Act, nothing in this Act prevents the head from giving access to that information in response to an oral request or in the absence of a request. R.S.O. 1990, c. F.31, s. 63 (1). Pre-existing access preserved (2) This Act shall not be applied to preclude access to information that is not personal information and to which access by the public was available by custom or practice immediately before this Act comes into force. R.S.O. 1990, c. F.31, s. 63 (2). Information otherwise available 64 (1) This Act does not impose any limitation on the information otherwise available by law to a party to litigation. R.S.O. 1990, c. F.31, s. 64 (1).

Powers of courts and tribunals (2) This Act does not affect the power of a court or a tribunal to compel a witness to testify or compel the production of a document. R.S.O. 1990, c. F.31, s. 64 (2). Application of Act 65 (1) This Act does not apply to records placed in the archives of an educational institution or the Archives of Ontario by or on behalf of a person or organization other than, (a) an institution as defined in this Act or in the Municipal Freedom of Information and Protection of Privacy Act; or (b) a health information custodian as defined in the Personal Health Information Protection Act, 2004. 2005, c. 28, Sched. F, s. 8 (1). (2) Repealed: 2004, c. 3, Sched. A, s. 81 (7). Idem (3) This Act does not apply to notes prepared by or for a person presiding in a proceeding in a court of Ontario if those notes are prepared for that person’s personal use in connection with the proceeding. R.S.O. 1990, c. F.31, s. 65 (3). Same (3.1) This Act does not apply to personal notes, draft decisions, draft orders and communications related to draft decisions or draft orders that are created by or for a person who is acting in a quasi-judicial capacity. 2019, c. 7, Sched. 60, s. 9. Same (4) This Act does not apply to anything contained in a judge’s performance evaluation under section 51.11 of the Courts of Justice Act or to any information collected in connection with the evaluation. 1994, c. 12, s. 49. Same (5) This Act does not apply to a record of the Ontario Judicial Council, whether in the possession of the Judicial Council or of the Attorney General, if any of the following conditions apply: 1. The Judicial Council or its subcommittee has ordered that the record or information in the record not be disclosed or made public. 2. The Judicial Council has otherwise determined that the record is confidential. 3. The record was prepared in connection with a meeting or hearing of the Judicial Council that was not open to the public. 1994, c. 12, s. 49. Same (5.1) This Act does not apply to a record of a committee investigating a complaint against an associate judge under section 86.2 of the Courts of Justice Act, whether in the possession of the committee, the Chief Justice of the Superior Court of Justice, the Attorney General or any other person, if any of the following conditions apply: 1. The committee has ordered that the record or information in the record not be disclosed or made public. 2. The record was prepared in connection with the committee’s investigation of the complaint and the complaint was not dealt with in a manner that was open to the public. 1996, c. 25, s. 6; 2002, c. 18, Sched. K, s. 11; 2021, c. 4, Sched. 3, s. 22. Same (5.2) This Act does not apply to a record relating to a prosecution if all proceedings in respect of the prosecution have not been completed. 2006, c. 34, Sched. C, s. 11. Same (5.3) This Act does not apply to the ecclesiastical records of a church or religious organization that is affiliated with an educational institution or a hospital. 2010, c. 25, s. 24 (17). Same (5.4) This Act does not apply to records that relate to the operations of a hospital foundation. 2010, c. 25, s. 24 (17). Same (5.5) This Act does not apply to the administrative records of a member of a health profession listed in Schedule 1 to the Regulated Health Professions Act, 1991 that relate to the member’s personal practice. 2010, c. 25, s. 24 (17). Same (5.6) This Act does not apply to records relating to charitable donations made to a hospital. 2010, c. 25, s. 24 (17). (5.7) Repealed: 2017, c. 19, Sched. 2, s. 1 (1). Same (6) Subject to subsection (7), this Act does not apply to records collected, prepared, maintained or used by or on behalf of an institution in relation to any of the following: 1. Proceedings or anticipated proceedings before a court, tribunal or other entity relating to labour relations or to the employment of a person by the institution. 2. Negotiations or anticipated negotiations relating to labour relations or to the employment of a person by the institution between the institution and a person, bargaining agent or party to a proceeding or an anticipated proceeding. 3. Meetings, consultations, discussions or communications about labour relations or employment-related matters in which the institution has an interest. 4. Meetings, consultations, discussions or communications about the appointment or placement of any individual by a church or religious organization within an institution, or within the church or religious organization. 5. Meetings, consultations, discussions or communications about applications for hospital appointments, the appointments or privileges of persons who have hospital privileges, and anything that forms part of the personnel file of those persons. 1995, c. 1, s. 82; 2010, c. 25, s. 24 (18). Exception (7) This Act applies to the following records: 1. An agreement between an institution and a trade union. 2. An agreement between an institution and one or more employees which ends a proceeding before a court, tribunal or other entity relating to labour relations or to employment-related matters. 3. An agreement between an institution and one or more employees resulting from negotiations about employment-related matters between the institution and the employee or employees. 4. An expense account submitted by an employee of an institution to that institution for the purpose of seeking reimbursement for expenses incurred by the employee in his or her employment. 1995, c. 1, s. 82. Information relating to adoptions (8) This Act does not apply with respect to the following: 1. Notices registered under section 48.3 of the Vital Statistics Act and notices and information registered under section 48.4 of that Act. 2. Disclosure vetoes registered under section 48.5 of the Vital Statistics Act. 3. Information and records in files that are unsealed under section 48.6 of that Act. 4. Revoked: 2017, c. 14, Sched. 4, s. 14 (1). 2005, c. 25, s. 34; 2016, c. 23, s. 49 (2); 2017, c. 14, Sched. 4, s. 14 (1). Exception (8.1) This Act does not apply, (a) to a record respecting or associated with research conducted or proposed by an employee of an educational institution or by a person associated with an educational institution; (b) to a record of teaching materials collected, prepared or maintained by an employee of an educational institution or by a person associated with an educational institution for use at the educational institution; (c) to a record respecting or associated with research, including clinical trials, conducted or proposed by an employee of a hospital or by a person associated with a hospital; or (d) to a record of teaching materials collected, prepared or maintained by an employee of a hospital or by a person associated with a hospital for use at the hospital. 2005, c. 28, Sched. F, s. 8 (2); 2010, c. 25, s. 24 (19). Note: Subsection 65 (8.1) was enacted as subsection 65 (8) in source law, Statutes of Ontario, 2005, chapter 28, Schedule F, subsection 8 (2). The subsection is renumbered in this consolidation to distinguish it from existing subsection 65 (8), enacted by Statutes of Ontario, 2005, chapter 25, section 34. Exception (9) Despite subsection (8.1), the head of the educational institution or hospital shall disclose the subject-matter and amount of funding being received with respect to the research referred to in that subsection. 2005, c. 28, Sched. F, s. 8 (2); 2010, c. 25, s. 24 (20). Application of Act (10) Despite subsection (8.1), this Act does apply to evaluative or opinion material compiled in respect of teaching materials or research only to the extent that is necessary for the purpose of subclause 49 (c.1) (i). 2005, c. 28, Sched. F, s. 8 (2). Non-application of Act (11) This Act does not apply to identifying information in a record relating to medical assistance in dying. 2017, c. 7, s. 3. Interpretation (12) In subsection (11), “identifying information” means information, (a) that relates to medical assistance in dying, and (b) that identifies an individual or facility, or for which it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual or facility; (“renseignements identificatoires”) “medical assistance in dying” means medical assistance in dying within the meaning of section 241.1 of the Criminal Code (Canada). (“aide médicale à mourir”) 2017, c. 7, s. 3. Non-application of Act, provision of abortion services (13) This Act does not apply to information relating to the provision of abortion services if, (a) the information identifies an individual or facility, or it is reasonably foreseeable in the circumstances that it could be utilized, either alone or with other information, to identify an individual or facility; or (b) disclosure of the information could reasonably be expected to threaten the health or safety of an individual, or the security of a facility or other building. 2017, c. 19, Sched. 2, s. 1 (2). Same, pharmacies (14) A reference in subsection (13) to a facility includes reference to a pharmacy, hospital pharmacy or institutional pharmacy, as those terms are defined in subsection 1 (1) of the Drug and Pharmacies Regulation Act. 2017, c. 19, Sched. 2, s. 1 (2). Related statistical information (15) For greater certainty, this Act applies to statistical or other information relating to the provision of abortion services that does not meet the conditions of clause (13) (a) or (b). 2017, c. 19, Sched. 2, s. 1 (2). Adjudicative records (16) This Act does not apply to adjudicative records, within the meaning of the Tribunal Adjudicative Records Act, 2019, referred to in subsection 2 (1) of that Act. 2019, c. 7, Sched. 60, s. 9. Queen’s Park restoration records (17) This Act does not apply to records prepared by the Assembly with respect to the Queen’s Park Restoration Project until 20 years after the Queen’s Park Restoration Secretariat Act, 2023 is repealed. 2023, c. 7, Sched. 3, s. 1. Records in the custody of a minister, etc. (18) This Act does not apply to, (a) a record in the custody of a minister of the Crown or the minister’s office; or (b) a record under the control of a minister of the Crown or the minister’s office unless the record is in the custody of the rest of the institution of which the minister is the head or any other institution. 2026, c. 2, Sched. 7, s. 28 (1). Exception not affected by control of institution (19) For greater certainty, clauses (18) (a) and (b) apply with respect to a record in the custody or under the control of a minister or the minister’s office even if the record is under the control of the rest of the institution of which the minister is the head or any other institution. 2026, c. 2, Sched. 7, s. 28 (1). Parliamentary assistants, etc. (20) Subsections (18) and (19) apply, with necessary modifications, with respect to a record in the custody or under the control of a parliamentary assistant appointed to assist a minister of the Crown or the parliamentary assistant’s office. 2026, c. 2, Sched. 7, s. 28 (1). Transition (21) The following transitional rules apply with respect to records described in subsection (18), including as applicable under subsection (20): 1. For greater certainty, subsection (18) applies with respect to a record described in that subsection even if the record was created before the Plan to Protect Ontario Act (Budget Measures), 2026 received Royal Assent. 2. For greater certainty, a person who, before the day the Plan to Protect Ontario Act (Budget Measures), 2026 received Royal Assent, had a right of access under this Act to a record described in subsection (18) ceases to have such a right, even if the person made a request for access before that day. 3. An order or decision made under this Act before the day the Plan to Protect Ontario Act (Budget Measures), 2026 received Royal Assent is of no effect to the extent that it provides that this Act applies with respect to a record described in subsection (18) or to the extent that it provides access or a right of access to such a record under this Act. 4. An order or decision made before the day the Plan to Protect Ontario Act (Budget Measures), 2026 received Royal Assent in any proceeding is of no effect to the extent that it provides that this Act applies with respect to a record described in subsection (18) or to the extent that it provides access or a right of access to such a record under this Act. 2026, c. 2, Sched. 7, s. 28 (1). Non-application of Act, Enhancing Digital Security and Trust Act, 2024 (22) This Act does not apply to the following records prepared or collected under the Enhancing Digital Security and Trust Act, 2024: 1. Records containing the names of employees designated as primary points of contact for ensuring cyber security within each public sector entity and their alternates. 2. Assessments or evaluations of a public sector entity’s status or progress with respect to cyber security or summaries of such assessments or evaluations. 3. Records containing the names of software applications that have been purchased or otherwise acquired by school boards, that are owned or operated by third parties and that are authorized to access a student’s personal information. 4. Any other records the disclosure of which could reasonably be expected to compromise cyber security for a public sector entity. 2026, c. 2, Sched. 7, s. 28 (2). Interpretation (23) Terms used in subsection (22) that are defined in the Enhancing Digital Security and Trust Act, 2024 have the same meaning as in that Act. 2026, c. 2, Sched. 7, s. 28 (2). Section Amendments with date in force (d/m/y) 1994, c. 12, s. 49 - 28/02/1995; 1995, c. 1, s. 82 - 10/11/1995; 1996, c. 25, s. 6 - 31/10/1996 2002, c. 18, Sched. K, s. 11 - 26/11/2002 2004, c. 3, Sched. A, s. 81 (6, 7) - 01/11/2004 2005, c. 25, s. 34 - 31/01/2007; 2005, c. 28, Sched. F, s. 8 (1, 2) - 10/06/2006 2006, c. 34, Sched. C, s. 11 - 01/04/2007 2010, c. 25, s. 24 (17-20) - 01/01/2012 2016, c. 23, s. 49 (2) - 01/01/2017 2017, c. 7, s. 3 - 10/05/2017; 2017, c. 14, Sched. 4, s. 14 (1) - 30/04/2018 2017, c. 19, Sched. 2, s. 1 (1, 2) - 25/10/2017 2019, c. 7, Sched. 60, s. 9 - 30/06/2019 2021, c. 4, Sched. 3, s. 22 - 01/09/2021 2023, c. 7, Sched. 3, s. 1 - 31/07/2023 2026, c. 2, Sched. 7, s. 28 (1) - 01/01/1988; 2026, c. 2, Sched. 7, s. 28 (2) - 01/07/2026 Service provider organizations 65.1 (1) This section applies with respect to a service provider organization as defined in section 17.1 of the Ministry of Government Services Act. 2006, c. 34, Sched. F, s. 1 (2). Definitions (2) In this section, “customer service information” means, in relation to a service, (a) the name, sex, gender identity, preferred language and date of birth of the individual to whom the service is to be provided, (b) the address, email address and telephone number or other contact information of the individual to whom the service is to be provided and, if applicable, the person acting on behalf of that individual, and an indication of any accessibility or communication preferences, (c) the transaction or receipt number, the order status, the shipping status, the product identification number and the product expiry date provided by the service provider organization in relation to the request for the service, as applicable, (d) information relating to the payment of any fee, (e) information relating to communications between the service provider organization in relation to the request for the service and the individual to whom the service is to be provided, and, if applicable, the person acting on behalf of that individual, and (f) such other information as may be prescribed; (“renseignements liés au service à la clientèle”) “designated service” means a service designated by regulations made under subsection 17.1 (3) of the Ministry of Government Services Act as a service that the service provider organization may provide on behalf of the Government or a public body; (“service désigné”) “Government” means the Government as defined in the Ministry of Government Services Act; (“gouvernement”) “public body” means a public body as defined in section 17.1 of the Ministry of Government Services Act. (“organisme public”) 2006, c. 34, Sched. F, s. 1 (2); 2024, c. 24, Sched. 2, s. 15 (1). Authorization to collect personal information (3) A service provider organization is authorized to collect personal information for the purposes of providing a designated service. 2006, c. 34, Sched. F, s. 1 (2). Collection of customer service information (4) Without limiting the generality of subsection (3), a service provider organization is authorized to collect customer service information, with the consent of the individual to whom the information relates, for the purposes of providing a designated service. 2006, c. 34, Sched. F, s. 1 (2). Additional uses of customer service information (4.1) A service provider organization that collects customer service information under subsection (4) is authorized to retain and use the information, with the consent of the individual to whom the information relates, for the purposes of providing any designated service to the individual. 2024, c. 24, Sched. 2, s. 15 (2). Conveying information to the Government, etc. (5) If required by the regulations, a service provider organization that collects personal information on behalf of the Government or a public body in the course of providing a designated service shall convey the personal information to that Government or public body in accordance with the regulations. 2006, c. 34, Sched. F, s. 1 (2). Limitation after information conveyed (6) After the service provider organization has conveyed personal information under subsection (5), the service provider organization shall not use or further disclose the personal information except as allowed by the regulations. 2006, c. 34, Sched. F, s. 1 (2). Collection of personal information under arrangements (7) A person who provides services on behalf of a service provider organization pursuant to an arrangement under subsection 17.1 (7) of the Ministry of Government Services Act may not collect personal information in connection with providing those services unless the service provider organization and the person have entered into an agreement that governs the collection, use and disclosure of such personal information and the agreement meets the prescribed requirements, if any. 2006, c. 34, Sched. F, s. 1 (2). Audits by Commissioner (8) The Commissioner may audit a service provider organization to check that there has been no unauthorized access to or modification of personal information in the custody of the organization and the organization shall co-operate with and assist the Commissioner in the conduct of the audit. 2006, c. 34, Sched. F, s. 1 (2). Regulations (9) The Lieutenant Governor in Council may make regulations, (a) prescribing information for the purposes of clause (f) of the definition of “customer service information” in subsection (2); (b) governing the collection, use and disclosure of personal information by a service provider organization; (c) requiring the conveyance of personal information under subsection (5) to the extent and within the time period specified by the regulations; (d) allowing the use and disclosure of personal information under subsection (6); (e) prescribing requirements for agreements under subsection (7); (f) prescribing information for the purposes of clause 65.2 (2) (e). 2006, c. 34, Sched. F, s. 1 (2); 2024, c. 24, Sched. 2, s. 15 (3). Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. F, s. 1 (2) - 01/04/2007 2024, c. 24, Sched. 2, s. 15 (1-3) - 25/11/2024 Public consultation before making regulations 65.2 (1) Subject to subsection (7), the Lieutenant Governor in Council shall not make any regulation under subsection 65.1 (9) unless, (a) the Minister has published a notice of the proposed regulation in The Ontario Gazette and given notice of the proposed regulation by all other means that the Minister considers appropriate for the purpose of providing notice to the persons who may be affected by the proposed regulation; (b) the notice complies with the requirements of this section; (c) the time periods specified in the notice, during which members of the public may exercise a right described in clause (2) (b) or (c), have expired; and (d) the Minister has considered whatever comments and submissions that members of the public have made on the proposed regulation in accordance with clause (2) (b) or (c) and has reported to the Lieutenant Governor in Council on what, if any, changes to the proposed regulation the Minister considers appropriate. 2006, c. 34, Sched. F, s. 1 (2). Contents of notice (2) The notice mentioned in clause (1) (a) shall contain, (a) a description of the proposed regulation and the text of it; (b) a statement of the time period during which members of the public may submit written comments on the proposed regulation to the Minister and the manner in which and the address to which the comments must be submitted; (c) a description of whatever other rights, in addition to the right described in clause (b), that members of the public have to make submissions on the proposed regulation and the manner in which and the time period during which those rights must be exercised; (d) a statement of where and when members of the public may review written information about the proposed regulation; (e) all prescribed information; and (f) all other information that the Minister considers appropriate. 2006, c. 34, Sched. F, s. 1 (2). Time period for comments (3) The time period mentioned in clauses (2) (b) and (c) shall be at least 60 days after the Minister gives the notice mentioned in clause (1) (a) unless the Minister shortens the time period in accordance with subsection (4). 2006, c. 34, Sched. F, s. 1 (2). Shorter time period for comments (4) The Minister may shorten the time period if, in the Minister’s opinion, (a) the urgency of the situation requires it; or (b) the proposed regulation is of a minor or technical nature. 2006, c. 34, Sched. F, s. 1 (2). Discretion to make regulations (5) Upon receiving the Minister’s report mentioned in clause (1) (d), the Lieutenant Governor in Council, without further notice under subsection (1), may make the proposed regulation with the changes that the Lieutenant Governor in Council considers appropriate, whether or not those changes are mentioned in the Minister’s report. 2006, c. 34, Sched. F, s. 1 (2). No public consultation (6) The Minister may decide that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under subsection 65.1 (9) if, in the Minister’s opinion, (a) the urgency of the situation requires it; or (b) the proposed regulation is of a minor or technical nature. 2006, c. 34, Sched. F, s. 1 (2). Same (7) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under subsection 65.1 (9), (a) subsections (1) to (5) do not apply to the power of the Lieutenant Governor in Council to make the regulation; and (b) the Minister shall give notice of the decision to the public and to the Commissioner as soon as is reasonably possible after making the decision. 2006, c. 34, Sched. F, s. 1 (2). Contents of notice (8) The notice mentioned in clause (7) (b) shall include a statement of the Minister’s reasons for making the decision and all other information that the Minister considers appropriate. 2006, c. 34, Sched. F, s. 1 (2). Publication of notice (9) The Minister shall publish the notice mentioned in clause (7) (b) in The Ontario Gazette and give the notice by all other means that the Minister considers appropriate. 2006, c. 34, Sched. F, s. 1 (2). Temporary regulation (10) If the Minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under subsection 65.1 (9) because the Minister is of the opinion that the urgency of the situation requires it, the regulation shall, (a) be identified as a temporary regulation in the text of the regulation; and (b) unless it is revoked before its expiry, expire at a time specified in the regulation, which shall not be after the second anniversary of the day on which the regulation comes into force. 2006, c. 34, Sched. F, s. 1 (2). No review (11) Subject to subsection (12), neither a court, nor the Commissioner shall review any action, decision, failure to take action or failure to make a decision by the Lieutenant Governor in Council or the Minister under this section. 2006, c. 34, Sched. F, s. 1 (2). Exception (12) Any person resident in Ontario may make an application for judicial review under the Judicial Review Procedure Act on the grounds that the Minister has not taken a step required by this section. 2006, c. 34, Sched. F, s. 1 (2). Time for application (13) No person shall make an application under subsection (12) with respect to a regulation later than 21 days after the day on which, (a) the Minister publishes a notice with respect to the regulation under clause (1) (a) or subsection (9), where applicable; or (b) the regulation is filed, if it is a regulation described in subsection (10). 2006, c. 34, Sched. F, s. 1 (2). Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. F, s. 1 (2) - 01/04/2007 Non-application re: certain corporations 65.3 (1) Repealed: 2016, c. 37, Sched. 18, s. 8. Hydro One Inc. (2) This Act does not apply to Hydro One Inc. and its subsidiaries on and after the date on which the Building Ontario Up Act (Budget Measures), 2015 received Royal Assent. 2015, c. 20, Sched. 13, s. 1 (2). Same (3) The annual publication of information required by section 31 on or after the date described in subsection (2) must not include information about Hydro One Inc. and its subsidiaries. 2015, c. 20, Sched. 13, s. 1 (2). Same, transition (4) If a person has made a request under subsection 24 (3) for continuing access to a record of Hydro One Inc. or a subsidiary before the date described in subsection (2), and if the specified period for which access is requested expires after April 23, 2015, the specified period is deemed to have expired on April 23, 2015. 2015, c. 20, Sched. 13, s. 1 (2). Same, transition (5) Despite subsection (2), for a period of six months after the date described in that subsection, (a) the Commissioner may continue to exercise all of his or her powers under section 52 (inquiry) and clause 59 (b) (certain orders) in relation to Hydro One Inc. and its subsidiaries with respect to matters that occurred and records that were created before that date; and (b) Hydro One Inc. and its subsidiaries continue to have the duties of an institution under this Act in relation to the exercise of the Commissioner’s powers mentioned in clause (a). 2015, c. 20, Sched. 13, s. 1 (2). Continuing authority to issue orders, etc. (6) The powers and duties of the Commissioner to issue orders under section 54 and clause 59 (b) with respect to matters mentioned in subsection (5) continue for an additional six months after the expiry of the six-month period described in that subsection. 2015, c. 20, Sched. 13, s. 1 (2). Orders binding (7) An order issued within the time described in subsection (6) is binding on Hydro One Inc. or its subsidiaries, as the case may be. 2015, c. 20, Sched. 13, s. 1 (2). Repeal (8) Subsections (4), (5), (6) and (7) and this subsection are repealed on a day to be named by proclamation of the Lieutenant Governor. 2015, c. 20, Sched. 13, s. 1 (2). Section Amendments with date in force (d/m/y) R.S.O. 1990, c. F.31, s. 65.3 (8) - see 2015, c. 20, Sched. 13, s. 1 (2) - not in force 2015, c. 20, Sched. 13, s. 1 (1) - 19/11/15; 2015, c. 20, Sched. 13, s. 1 (2) - 04/14/15 2016, c. 37, Sched. 18, s. 8 - 08/12/2016 Exercise of rights of deceased, etc., persons 66 Any right or power conferred on an individual by this Act may be exercised, (a) where the individual is deceased, by the individual’s personal representative if exercise of the right or power relates to the administration of the individual’s estate; (b) by the individual’s attorney under a continuing power of attorney, the individual’s attorney under a power of attorney for personal care, the individual’s guardian of the person, or the individual’s guardian of property; and (c) where the individual is less than sixteen years of age, by a person who has lawful custody of the individual. R.S.O. 1990, c. F.31, s. 66; 1992, c. 32, s. 13; 1996, c. 2, s. 66. Section Amendments with date in force (d/m/y) 1992, c. 32, s. 13 - 3/04/1995; 1996, c. 2, s. 66 - 29/03/1996 Conflict with other Act 67 (1) This Act prevails over a confidentiality provision in any other Act unless subsection (2) or the other Act specifically provides otherwise. R.S.O. 1990, c. F.31, s. 67 (1). Idem (2) The following confidentiality provisions prevail over this Act: 1. Subsection 53 (1) of the Assessment Act. 2. Subsections 87 (8), (9) and (10), 98 (9) and (10), 130 (6) and 163 (6) and section 227 of the Child, Youth and Family Services Act, 2017. 3. Section 68 of the Colleges Collective Bargaining Act, 2008. 4. Section 12 and 54.1 of the Commodity Futures Act. 5. Repealed: 1993, c. 38, s. 65. 6. Subsection 137 (2) of the Courts of Justice Act. 6.1 Section 20.8 of the Financial Services Regulatory Authority of Ontario Act, 2016. 7. Subsection 119 (1) of the Labour Relations Act, 1995. 7.0.1 Sections 40 and 42 of the Legal Aid Services Act, 2020. 7.1 Section 40.1 of the Occupational Health and Safety Act. 8. Subsection 32 (4) of the Pay Equity Act. 8.1 Repealed: 2006, c. 35, Sched. C, s. 47 (3). 9. Sections 16, 17 and 121.5 of the Securities Act. 10. Subsection 4 (2) of the Statistics Act. 11. Subsection 28 (2) of the Vital Statistics Act. R.S.O. 1990, c. F.31, s. 67 (2); 1992, c. 14, s. 1; 1993, c. 38, s. 65; 1994, c. 11, s. 388; 1998, c. 26, s. 103; 2006, c. 35, Sched. C, s. 47 (3); 2008, c. 15, s. 86; 2017, c. 8, Sched. 13, s. 6; 2017, c. 14, Sched. 4, s. 14 (2-4); 2020, c. 11, Sched. 15, s. 54; 2021, c. 40, Sched. 12, s. 2; 2023, c. 21, Sched. 1, s. 11; 2023, c. 21, Sched. 10, s. 13. Section Amendments with date in force (d/m/y) 1992, c. 14, s. 1 - 25/06/1992; 1993, c. 38, s. 65 (1, 2) - 14/02/1994; 1994, c. 11, s. 388 - 11/07/1994; 1998, c. 26, s. 103 - 18/12/1998 2006, c. 35, Sched. C, s. 47 (3) - 20/08/2007 2008, c. 15, s. 86 - 08/10/2008 2017, c. 8, Sched. 13, s. 6 - 17/05/2017; 2017, c. 14, Sched. 4, s. 14 (2-4) - 30/04/2018 2020, c. 11, Sched. 15, s. 54 - 18/10/2021 2021, c. 40, Sched. 12, s. 2 - 29/04/2022 2023, c. 21, Sched. 1, s. 11 - 04/12/2023; 2023, c. 21, Sched. 10, s. 13 - 04/12/2023 68 Repealed: 2006, c. 34, Sched. C, s. 12. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 12 - 01/04/2007 Application 69 (1) This Act applies to any record in the custody or under the control of an institution regardless of whether it was recorded before or after this Act comes into force. R.S.O. 1990, c. F.31, s. 69. Hospitals (2) Despite subsection (1), this Act only applies to records in the custody or under the control of a hospital where the records came into the custody or under the control of the hospital on or after January 1, 2007. 2010, c. 25, s. 24 (21). Section Amendments with date in force (d/m/y) 2010, c. 25, s. 24 (21) - 01/01/2012 Crown bound 70 This Act binds the Crown. R.S.O. 1990, c. F.31, s. 70. ______________