FIPPA Amendments


The following amendments to FIPPA are made by The Freedom of Information and Protection of Privacy Amendment Act, S.M 2021 c. 43, and came into force on January 1, 2022

The Freedom of Information and Protection of Privacy Act
Section Category Explanation
Definitions
1(1) Definition - Head Clarifies that the head of an incorporated government agency is the chief executive officer or the individual who performs a similar function.
1(1) Definition - Personal Information Minor clarification to the definition of personal information.
Access to Information
6(1) Requests for Access for Personal Health Information Section was re-worded, but no changes to the interpretation.
6(1.1) Requests for Access for Personal Health Information Clarification that when a request for access is made under FIPPA to a record that contains the applicant's personal health information, that the request must also be considered as a request made under The Personal Health Information Act (PHIA) with respect to the personal health information. The access decision to the personal health information must be made in accordance with PHIA.
6.1 Requests for Access for Personal Health Information Section was re-numbered from 6(2) to 6.1.
8(2) How to Make a Request for Access Removes the requirement for a request for access to be on the prescribed application form, but requires requests for access to be made in writing.
8(3) How to Make a Request for Access Clarification that an applicant may make an oral request for access in specific circumstances despite the requirement for a request to be made in writing.
11(1)/(2) Time Limit for Responding Increases the time limit for responding to a request for access from 30 days to 45 days.
12(1)(c)(iii) Required Contact Information A public body can provide any contact information of an employee of a public body that can answer questions about a refusal of access.
12.1 Request for Clarification Section 12.1 represents a new process for requesting clarification when it is necessary to process a request for access. The new provisions under this section includes how the request for clarification must be given, how it affects the time limit for responding and how to abandon a request when no clarification is received.
13 Disregarding Requests Changes to when a public body may disregard a request for access.

Clarification has been added to explicitly enable a public body to take into consideration the number of requests made by an applicant or whether the request relates to other requests that have been made by applicants who are associated.
15(1)(a) Extensions Extensions can no longer be taken for clarification. There is a new process for requesting clarification under 12.1.
15(1)(b) Extensions A public body may take an extension when it is unreasonable for a public body to respond within 45 days due to the number of requests submitted by an applicant or applicants who are associated.
15(1)(c) Extensions Clarification that a public body may take an extension to obtain legal advice.
15(1)(e) Extensions A public body may take an extension with applicant consent.
15(1)(f) Extensions A public body may take an extension in exceptional circumstances.
16(1) Transfers Increase time limit for transferring a request from 7 days to 10 days.
16(2) Transfers The time limit for responding to a request that has been transferred is increased from 30 days to 45 days.

Removal of unnecessary reference to third party notification.
17(2)(h.1)/ 17(4.1) Exceptions to Disclosure A new clause to protect the identity of a third party who provides information in confidence to the applicant's employer about the applicant. If access is refused under 17(2)(h.1), the public body is required under section 17(4.1) to provide the applicant a summary of the information unless a summary cannot be created without revealing the identity of the third party.
17(4)(e) Exceptions to Disclosure Travel expenses is replaced with all employment expenses.
17(4)(h) Exceptions to Disclosure Increased from 10 years to 25 years when disclosing personal information of a deceased individual is no longer an unreasonable invasion of their privacy.

This amendment is to ensure consistency between this section and personal information that may be disclosed under section 44(1)(z).
17(4)(h.1) Exceptions to Disclosure It is not an unreasonable invasion of a deceased individual's privacy to disclose their personal information to a relative or close personal relation if it is for compassionate reasons.
20(3) Exceptions to Disclosure Section 20 cannot be used as an exception to disclosure after 20 years.
27 Exceptions to Disclosure Section expanded to include all types of legal privilege.
29.1 Exceptions to Disclosure New exception to disclosure to protect labour relations information of a public body as an employer.
29.2 Exceptions to Disclosure New exception to disclosure to protect information relating to workplace investigations.
32(1) Exceptions to Disclosure Number of days a public body may refuse access to information that will be available to the public is reduced from 90 days to 60 days.
32(1.1) Exceptions to Disclosure A public body may refuse access to information that will be made available to the public through section 76.2.
32(2) Exceptions to Disclosure The number of days a public body must reconsider a request as a new request if the information is not made available to the public that was refused under section 32 is reduced from 90 days to 60 days.
34(1.1) Third Party Intervention Clarification that a public body must consider any response received within 20 days by a third party when notice is given under section 33(1) prior to making their access decision.
34(3.1) Third Party Intervention Clarification that when a third party notified under 33(1) consents to the disclosure of the information that the public body must inform the applicant that access is granted and how access will be given.
34(4) Third Party Intervention Requires a third party to notify the public body if they made a complaint with the Manitoba Ombudsman within 21 days if a public body notifies the third party of their decision to provide access without their consent.
34(5) Third Party Intervention The time limit the applicant may make a complaint is increased from 21 days to 60 days when a public body decides not to give access to information after providing a third party notice under 33(1).
Protection of Privacy
37(2) Required Contact Information Minor amendment to allow a public body to provide any contact information of an employee of a public body that can answer questions on a direct collection notice.
39 Correction Requests Changes to the process for when an individual requests a correction to their personal information, including, removing the requirement for an individual to first submit a request for access for the information, allowing an individual to submit a statement of disagreement if the public body refuses to make a correction and authorizing circumstances when a public body may disregard correction requests.
41 Security Arrangements Clarification on the types of reasonable safeguards - administrative, technical and physical - required for protecting personal information.
41.1 Breach Notification New provision requiring a public body to notify the Ombudsman and an affected individual when a privacy breach occurs and there is a real risk of significant harm to an individual.
41.2 Disclosure of Unauthorized Activity New provision that enables an employee of a public body employee to confidentially disclose any suspected contraventions under Part 3 (Protection of Privacy) of the act to the Ombudsman without it being an offence.
42(4) Applicant Anonymity Clarification that an applicant's personal information cannot be used or disclosed unless it is necessary in order to process the request for access.
44(1)(w) Language Update For consistency, officer of the Legislature is changed to officer of the Legislative Assembly.
44(1)(z) Personal Information Disclosures Expansion of the circumstances when a public body may disclose personal information of a deceased individual.
Powers and Duties of the Ombudsman
49(k) Ombudsman Powers and Duties Authorizes the Ombudsman to exchange information with any Canadian jurisdiction's Information and Privacy Commissioner for the purpose of coordinating activities and handling complaints involving the jurisdictions.
50(1)
50(2)
52
53(1)
54		 Ombudsman Powers and Duties For clarification, "or audit" was added.
55(3.1) Ombudsman Powers and Duties Authorizes the Ombudsman to disclose information to prevent or lessen a risk of serious harm to the health or safety of an individual.
Complaints
59(1) Complaints Removes the right to make a complaint about a refusal to make a correction under section 39. This right is now in 59(3.1).
59(3) Complaints Expanded to include an individual may make a complaint to the Ombudsman if their personal information has not been protected in a secure manner.
59(3.1) Complaints New standalone provision to enable an individual to make a complaint to the Ombudsman relating to a request for correction.
59(4) Complaints For consistency with changes to 44(1)(z), any individual may make a complaint to the Ombudsman if a public body refuses to disclose personal information of a deceased individual.
60(1) Complaint Form The requirement to submit a complaint on a form prescribed by regulation has been repealed. The Ombudsman will create a new complaint form.
60(2) Complaint Time Limits Clarification that the complaints referenced in this subsection must be delivered to the Ombudsman within 60 days of the decision.
60(2.1) Complaint Time Limits Clarification that complaints by third parties notified under section 33(1) must be made to the Ombudsman within 21 days of the decision to provide access.
66(6)(a) Compliance with Recommendations For consistency, section 59(3.1) was added to when a head accepts the recommendations of the Ombudsman, the head must comply with the recommendations.
66.5(3) Ombudsman Powers and Duties Ombudsman has the right to be a party in any review conducted by the Access and Privacy Adjudicator.
67(2) Ombudsman Powers and Duties Clarification relating to when an appeal may be made when an Ombudsman's report contains recommendations.
Mandatory Disclosures, Fees, Offences and General Provisions
75.1(1) Mandated Disclosures Within 14 days of a request being received, specific public bodies as listed must publish a non-identifying summary of requests for access received. The summary cannot include the applicant's name or any other information that is subject to an exception to disclosure. This section does not apply to requests for an applicant's own personal information.
76(1.1) Mandated Disclosures Clarification that the head of a public body should, if practicable, make categories of records over 100 years old available without a request for access.
76.2(1) Mandated Disclosures Required disclosures by Executive Council that must be made available to the public within specific time frames.
76.2(2) Mandated Disclosures Required disclosures by the Government of Manitoba relating to ministers that must be made available to the public within specific time frames.
76.3(1) Mandated Disclosures Records that must be made available to the public without a request for access by government agencies, health care bodies and educational bodies. Currently this provision only applies to a government agency that is subject to The Crown Corporations Governance and Accountability Act.
76.3(2) Mandated Disclosures Records that must be made available to the public without a request for access by government departments.
76.3(3) Mandated Disclosures The minister responsible for the act may issue a written directive to make records available to the public without a request for access to any public body subject to 76.3(1) and (2).
76(4) Mandated Disclosures The minister responsible may require a public body to provide a copy of a record that the public body is required to disclose or publish under any enactment and the minister responsible must publish the record on a website once it is received.
79(c) Exercising the Rights of Another Person This section was re-worded in the French version only and there is no change to the interpretation of the clause.
82(1) Fees Clarification that all fees a public body may charge are in the Access and Privacy Regulation.
82(6) Fees Clarification that fees cannot exceed actual costs.
82(7) Fees Public bodies must provide written notification to an applicant if the request is abandoned when an applicant neither pays the estimated fee nor contacts the public body to modify their request in order to change the amount of the fees after 30 days from when the cost of estimates was issued.
85(1) Offences Offences under the act have been expanded to include: unauthorized collection and use of personal information; unauthorized access to personal information (snooping); failing to comply with mandatory breach notification requirements; erasing, concealing, altering or falsifying a record with the intent to evade a request for access; helping or counseling someone to commit an offence under the act.
85(2)
85(3)		 Offences Time limit for prosecution under the act has been extended from 2 years from the date the offence occurred to 2 years from the date a certificate is issued by the Ombudsman to indicate there is sufficient evidence to justify a prosecution. This change will apply to offences committed before or after this change is enacted.
86(1)
86(2)		 No Adverse Employment Action An individual is not guilty of an offence and is not subject to any adverse employment action when, in good faith, they notify the Ombudsman of any contraventions under Part 3 (Protection of Privacy) of the act.
87 Lieutenant Governor Power to Make Regulations Broadens the Lieutenant Governor's ability to make regulations as a result of changes to the act.
Review of the Act
98(1) Review of the Act A review of the act must commence within 5 years of this section coming into force.
Access and Privacy Regulation
Section Category Explanation
All Language Update All instances of "shall" have been changed to "must" to reflect current legislative drafting practices.
All Language Update All instances of "application" have been changed to "request for access" as a result of changes to subsection 8(2) of the act which eliminated the prescribed Application for Access form.
1 Definitions Minor clarification to ensure consistency with section 81 of the act, that "access and privacy officer" means any person to whom the head delegates any power or duty.
1.2 Definitions Added definition of applicants who are associated for the purposes of clause 13(1.1)(b), disregarding a request, and subclause 15(1)(b)(ii), extending the time limit for responding, of the act.
2 Role of Access and Privacy Coordinator Minor clarification that any person can be appointed by a public body as the "access and privacy coordinator".
3 Requests for Access Updated language to reflect changes to subsection 8(2) of the act which eliminated the prescribed Application for Access form.
3.1/3.2/3.3 Notification of Privacy Breach A requirement for the head of a public body to notify individuals and the Ombudsman of a privacy breach that poses a real risk of significant harm to the individuals was added to the act. The provisions in the act refer public bodies to the regulations for:

A. factors to determine that a breach could reasonably be expected to create a real risk of significant harm to individuals;
B. the form, manner and information to be included in the notice when notice is given directly to individuals; and
C. the circumstances when notice does not need to be provided directly to individuals and the form, manner and information to be included in the indirect notice.
10 Complaint Form Repealed because subsection 60(1) of the act was amended to eliminate a prescribed complaint form.
11/12.2 Designation of Public Bodies This amendment provides clarification that the health care bodies listed in Schedules B and E are for the purposes of designating them as a public body under the act, and not for the purposes of mandatory disclosures under clause 75.1(1)(e) and subsection 76.3(1).
Schedule A Form 1 Application for Access Form Form is repealed as subsection 8(2) of the act was amended to eliminate a prescribed application form.
Schedule A Form 2 Estimate of Costs Form Minor clarifications and language updates on the Estimate of Costs form.
Schedule A Form 3 Complaint Form Form is repealed as subsection 60(1) of the act was amended to eliminate a prescribed complaint form.

back to top