Ontario's privacy law updated: data integration oversight shifts from Privacy Commissioner to Chief Digital and Data Officer

Plain-language summary · AI-assisted · not legal advice

Several changes to Ontario's Freedom of Information and Protection of Privacy Act are now in force, consolidating amendments that had previously been flagged as future changes. Responsibility for establishing data standards used by government data integration units has moved from the Privacy Commissioner to the Chief Digital and Data Officer. The mandatory periodic review requirement that required the Commissioner to review multi-sector data integration unit practices at least every three years has been removed; the Commissioner's review power is now discretionary rather than mandatory. The step-by-step process for linking and de-identifying personal information collected by data integration units has been reordered, and the condition requiring data standards approval before collection could begin has been simplified. The Chief Digital and Data Officer must now produce an annual report on data integration activities and provide it to the Commissioner, and the Commissioner retains the ability to make comments and recommendations on privacy implications of data standards. Organizations operating as or working with government data integration units should review how these structural changes affect their compliance obligations.

Who this affects: government data integration units · Ontario ministries handling personal data · Privacy Commissioner of Ontario · Chief Digital and Data Officer · organizations designated as extra-ministerial data integration units