Municipal Freedom of Information and Protection of Privacy Act

Bills that amended this Act0

No published amendment links yet for this Act.

Sections158

• 1Purposes

  1 The purposes of this Act are, (a) to provide a right of access to information under the control of institutions in accordance with the principles that, (i) information should be available to the public, (ii) necessary exemptions from the right of access should be limited and specific, and (iii) decisions on the disclosure of information should be reviewed independently of the institution controlling the information; and (b) to protect the privacy of individuals with respect to personal information about themselves held by institutions and to provide individuals with a right of access to that information. R.S.O. 1990, c. M.56, s. 1.

• 1.
• 2Interpretation

  2 (1) In this Act, “close relative” means a parent, child, grandparent, grandchild, brother, sister, uncle, aunt, nephew or niece, including by adoption; (“proche parent”) “head”, in respect of an institution, means the individual or body determined to be head under section 3; (“personne responsable”) “Information and Privacy Commissioner” and “Commissioner” mean the Commissioner appointed under subsection 4 (1) of the Freedom of Information and Protection of Privacy Act; (“commissaire à l’information et à la protection de la vie privée”, “commissaire”) Note: On January 1, 2027, subsection 2 (1) of the Act is amended by adding the following definition: (See: 2026, c. 2, Sched. 11, s. 1 (1)) “information practices” means the practices and procedures of an institution for actions in relation to personal information, including, (a) when, how and the purposes for which the institution collec…

• 2.
• 3Designation of head

  3 (1) The members of the council of a municipality may by by-law designate from among themselves an individual or a committee of the council to act as head of the municipality for the purposes of this Act. R.S.O. 1990, c. M.56, s. 3 (1); 2002, c. 17, Sched. F, Table. Idem (2) The members elected or appointed to the board, commission or other body that is an institution other than a municipality may designate in writing from among themselves an individual or a committee of the body to act as head of the institution for the purposes of this Act. R.S.O. 1990, c. M.56, s. 3 (2); 2002, c. 17, Sched. F, Table. If no designation (3) If no person is designated as head under this section, the head shall be, (a) the council, in the case of a municipality; and (b) the members elected or appointed to the board, commission or other body in the case of an institution other than a municipality. R.S.O. …

• 3.
• [s3]

  PART I FREEDOM OF INFORMATION

• PART I FREEDOM OF INFORMATION
• [s4]

  Access to Records

• 4Right of access

  4 (1) Every person has a right of access to a record or a part of a record in the custody or under the control of an institution unless, (a) the record or the part of the record falls within one of the exemptions under sections 6 to 15; or (b) the head is of the opinion on reasonable grounds that the request for access is frivolous or vexatious. Severability of record (2) If an institution receives a request for access to a record that contains information that falls within one of the exemptions under sections 6 to 15 and the head of the institution is not of the opinion that the request is frivolous or vexatious, the head shall disclose as much of the record as can reasonably be severed without disclosing the information that falls under one of the exemptions. 1996, c. 1, Sched. K, s. 13. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 13 - 30/01/1996

• 4.
• 4.1Measures to ensure preservation of records

  4.1 Every head of an institution shall ensure that reasonable measures respecting the records in the custody or under the control of the institution are developed, documented and put into place to preserve the records in accordance with any recordkeeping or records retention requirements, rules or policies, whether established under an Act or otherwise, that apply to the institution. 2014, c. 13, Sched. 6, s. 3. Section Amendments with date in force (d/m/y) 2014, c. 13, Sched. 6, s. 3 - 01/01/2016

• 5.
• [s7]
• 5Obligation to disclose

  5 (1) Despite any other provision of this Act, a head shall, as soon as practicable, disclose any record to the public or persons affected if the head has reasonable and probable grounds to believe that it is in the public interest to do so and that the record reveals a grave environmental, health or safety hazard to the public. Notice (2) Before disclosing a record under subsection (1), the head shall cause notice to be given to any person to whom the information in the record relates, if it is practicable to do so. Contents of notice (3) The notice shall contain, (a) a statement that the head intends to release a record or a part of a record that may affect the interests of the person; (b) a description of the contents of the record or part that relate to the person; and (c) a statement that if the person makes representations forthwith to the head as to why the record or part should n…

• [s8]

  Exemptions

• 6.
• 6Draft by-laws, etc.

  6 (1) A head may refuse to disclose a record, (a) that contains a draft of a by-law or a draft of a private bill; or (b) that reveals the substance of deliberations of a meeting of a council, board, commission or other body or a committee of one of them if a statute authorizes holding that meeting in the absence of the public. Exception (2) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record if, (a) in the case of a record under clause (1) (a), the draft has been considered in a meeting open to the public; (b) in the case of a record under clause (1) (b), the subject-matter of the deliberations has been considered in a meeting open to the public; or (c) the record is more than twenty years old. R.S.O. 1990, c. M.56, s. 6.

• 7.
• 7Advice or recommendations

  7 (1) A head may refuse to disclose a record if the disclosure would reveal advice or recommendations of an officer or employee of an institution or a consultant retained by an institution. Exceptions (2) Despite subsection (1), a head shall not refuse under subsection (1) to disclose a record that contains, (a) factual material; (b) a statistical survey; (c) a report by a valuator; (d) an environmental impact statement or similar record; (e) a report or study on the performance or efficiency of an institution; (f) a feasibility study or other technical study, including a cost estimate, relating to a policy or project of an institution; (g) a report containing the results of field research undertaken before the formulation of a policy proposal; (h) a final plan or proposal to change a program of an institution, or for the establishment of a new program, including a budgetary estimate for…

• 8.
• 8Law enforcement

  8 (1) A head may refuse to disclose a record if the disclosure could reasonably be expected to, (a) interfere with a law enforcement matter; (b) interfere with an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result; (c) reveal investigative techniques and procedures currently in use or likely to be used in law enforcement; (d) disclose the identity of a confidential source of information in respect of a law enforcement matter, or disclose information furnished only by the confidential source; (e) endanger the life or physical safety of a law enforcement officer or any other person; (f) deprive a person of the right to a fair trial or impartial adjudication; (g) interfere with the gathering of or reveal law enforcement intelligence information respecting organizations or persons; (h) reveal a record which has …

• 8.1Civil Remedies Act, 2001

  8.1 A head may refuse to disclose a record and may refuse to confirm or deny the existence of a record if disclosure of the record could reasonably be expected to interfere with the ability of the Attorney General to determine whether a proceeding should be commenced under the Civil Remedies Act, 2001, conduct a proceeding under that Act or enforce an order made under that Act. 2001, c. 28, s. 23 (1); 2002, c. 18, Sched. K, s. 15; 2007, c. 13, s. 45 (1). Section Amendments with date in force (d/m/y) 2001, c. 28, s. 23 (1) - 12/04/2002 2002, c. 18, Sched. K, s. 15 - 26/11/2002 2007, c. 13, s. 45 (1) - 04/06/2007

• 8.2Prohibiting Profiting from Recounting Crimes Act, 2002

  8.2 A head may refuse to disclose a record and may refuse to confirm or deny the existence of a record if disclosure of the record could reasonably be expected to interfere with the ability of the Attorney General to determine whether a proceeding should be commenced under the Prohibiting Profiting from Recounting Crimes Act, 2002, conduct a proceeding under that Act or enforce an order made under that Act. 2002, c. 2, ss. 16 (1), 19 (8); 2002, c. 18, Sched. K, s. 16. Section Amendments with date in force (d/m/y) 2002, c. 2, s. 16 (1) - 01/07/2003; 2002, c. 18, Sched. K, s. 16 - 26/11/2002

• 9.
• 10.
• 9Relations with governments

  9 (1) A head shall refuse to disclose a record if the disclosure could reasonably be expected to reveal information the institution has received in confidence from, (a) the Government of Canada; (b) the Government of Ontario or the government of a province or territory in Canada; (c) the government of a foreign country or state; (d) an agency of a government referred to in clause (a), (b) or (c); or (e) an international organization of states or a body of such an organization. R.S.O. 1990, c. M.56, s. 9 (1); 2002, c. 18, Sched. K, s. 17. Idem (2) A head shall disclose a record to which subsection (1) applies if the government, agency or organization from which the information was received consents to the disclosure. R.S.O. 1990, c. M.56, s. 9 (2). Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 17 - 26/11/2002

• 11.
• 9.1Relations with Aboriginal communities

  9.1 (1) A head may refuse to disclose a record where the disclosure could reasonably be expected to, (a) prejudice the conduct of relations between an Aboriginal community and the Government of Ontario or an institution; or (b) reveal information received in confidence from an Aboriginal community by an institution. 2017, c. 8, Sched. 20, s. 1. Definitions (2) In this section, “Aboriginal community” means, (a) a band within the meaning of the Indian Act (Canada), (b) an Aboriginal organization or community that is negotiating or has negotiated with the Government of Canada or the Government of Ontario on matters relating to, (i) Aboriginal or treaty rights under section 35 of the Constitution Act, 1982, or (ii) a treaty, land claim or self-government agreement, and (c) any other Aboriginal organization or community prescribed by the regulations; (“communauté autochtone”) “institution” in…

• 10Third party information

  10 (1) A head shall refuse to disclose a record that reveals a trade secret or scientific, technical, commercial, financial or labour relations information, supplied in confidence implicitly or explicitly, if the disclosure could reasonably be expected to, (a) prejudice significantly the competitive position or interfere significantly with the contractual or other negotiations of a person, group of persons, or organization; (b) result in similar information no longer being supplied to the institution where it is in the public interest that similar information continue to be so supplied; (c) result in undue loss or gain to any person, group, committee or financial institution or agency; or (d) reveal information supplied to or the report of a conciliation officer, mediator, labour relations officer or other person appointed to resolve a labour relations dispute. R.S.O. 1990, c. M.56, s. 1…

• 12.
• 11Economic and other interests

  11 A head may refuse to disclose a record that contains, (a) trade secrets or financial, commercial, scientific or technical information that belongs to an institution and has monetary value or potential monetary value; (b) information obtained through research by an employee of an institution if the disclosure could reasonably be expected to deprive the employee of priority of publication; (c) information whose disclosure could reasonably be expected to prejudice the economic interests of an institution or the competitive position of an institution; (d) information whose disclosure could reasonably be expected to be injurious to the financial interests of an institution; (e) positions, plans, procedures, criteria or instructions to be applied to any negotiations carried on or to be carried on by or on behalf of an institution; (f) plans relating to the management of personnel or the adm…

• 13.
• 12Solicitor-client privilege

  12 A head may refuse to disclose a record that is subject to solicitor-client privilege or that was prepared by or for counsel employed or retained by an institution for use in giving legal advice or in contemplation of or for use in litigation. R.S.O. 1990, c. M.56, s. 12.

• 14.
• 13Danger to safety or health

  13 A head may refuse to disclose a record whose disclosure could reasonably be expected to seriously threaten the safety or health of an individual. R.S.O. 1990, c. M.56, s. 13; 2002, c. 18, Sched. K, s. 20. Section Amendments with date in force (d/m/y) 2002, c. 18, Sched. K, s. 20 - 26/11/2002

• 15.
• 14Personal privacy

  14 (1) A head shall refuse to disclose personal information to any person other than the individual to whom the information relates except, (a) upon the prior written request or consent of the individual, if the record is one to which the individual is entitled to have access; (b) in compelling circumstances affecting the health or safety of an individual, if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates; (c) personal information collected and maintained specifically for the purpose of creating a record available to the general public; (d) under an Act of Ontario or Canada that expressly authorizes the disclosure; (e) for a research purpose if, (i) the disclosure is consistent with the conditions or reasonable expectations of disclosure under which the personal information was provided, collected or obtained, (i…

• 16.
• [s21]
• 15Information soon to be published

  15 A head may refuse to disclose a record if, (a) the record or the information contained in the record has been published or is currently available to the public; or (b) the head believes on reasonable grounds that the record or the information contained in the record will be published by an institution within ninety days after the request is made or within such further period of time as may be necessary for printing or translating the material for the purpose of printing it. R.S.O. 1990, c. M.56, s. 15.

• [s22]
• 16Exemptions not to apply

  16 An exemption from disclosure of a record under sections 7, 9, 9.1, 10, 11, 13 and 14 does not apply if a compelling public interest in the disclosure of the record clearly outweighs the purpose of the exemption. R.S.O. 1990, c. M.56, s. 16; 2017, c. 8, Sched. 20, s. 3. Section Amendments with date in force (d/m/y) 2017, c. 8, Sched. 20, s. 3 - 09/03/2018

• 17.
• [s23]

  Access Procedure

• 18.
• 17Request

  17 (1) A person seeking access to a record shall, (a) make a request in writing to the institution that the person believes has custody or control of the record, and specify that the request is being made under this Act; (b) provide sufficient detail to enable an experienced employee of the institution, upon a reasonable effort, to identify the record; and (c) at the time of making the request, pay the fee prescribed by the regulations for that purpose. 1996, c. 1, Sched. K, s. 14; 2017, c. 2, Sched. 12, s. 6 (1). Frivolous request (1.1) If the head of the institution is of the opinion on reasonable grounds that the request is frivolous or vexatious, subsections (2) to (5) do not apply to the request. 1996, c. 1, Sched. K, s. 14; 2006, c. 34, Sched. C, s. 14 (1). Sufficiency of detail (2) If the request does not sufficiently describe the record sought, the institution shall inform the ap…

• 19.
• 17.1Plan for staged access to records

  17.1 (1) The head of an institution may, before the expiry of the time limit set out in section 19 or, where there has been an extension of a time limit under subsection 20 (1) or (1.1), within that extended time limit, respond to a request for records by proposing a plan for providing access to the records in stages if, (a) the time required to search for responsive records would unreasonably interfere with the regular duties of employees of the institution; (b) the scope of the request is overly broad because of the period of time it covers; (c) the preparation of responsive records for disclosure would unreasonably interfere with the operations of the institution due to their volume; or (d) the person who made the request has submitted other requests to the institution and the person’s requests would, collectively, unreasonably interfere with the operations of the institution. 2026, c…

• 20.
• 17.2Requester’s response to plan

  17.2 (1) Where the head of an institution proposes a plan for providing access to records in stages under section 17.1 or proposes amendments to such a plan, the person who requested the records shall, within 30 business days after receiving the plan and any proposed amendments to the plan, respond in writing to the head or, in the case of a decision to propose a plan for providing access to records in stages under section 17.1 or a decision to amend such a plan for the first time, appeal the decision to the Commissioner. 2026, c. 2, Sched. 11, s. 3. Content of response (2) When responding in writing to the head under subsection (1), the person shall, (a) indicate their acceptance of the plan; (b) propose amendments to the plan; or (c) modify the scope of their request. 2026, c. 2, Sched. 11, s. 3. Effect on time limit (3) At the end of the day on which a proposed plan for providing acce…

• 18Involvement of other institutions

  18 (1) In this section, “institution” includes an institution as defined in section 2 of the Freedom of Information and Protection of Privacy Act. Request to be forwarded (2) The head of an institution that receives a request for access to a record that the institution does not have in its custody or under its control shall make reasonable inquiries to determine whether another institution has custody or control of the record, and, if the head determines that another institution has custody or control of the record, the head shall within fifteen days after the request is received, (a) forward the request to the other institution; and (b) give written notice to the person who made the request that it has been forwarded to the other institution. Transfer of request (3) If an institution receives a request for access to a record and the head considers that another institution has a greater …

• 21.
• 19Notice by head

  19 Where a person requests access to a record, the head of the institution to which the request is made or if a request is forwarded or transferred under section 18, the head of the institution to which it is forwarded or transferred, shall, subject to sections 20, 21 and 45, within thirty days after the request is received, Note: On July 1, 2026, section 19 of the Act is amended by striking out “thirty days” in the portion before clause (a) and substituting “45 business days”. (See: 2026, c. 2, Sched. 11, s. 5 (1)) (a) give written notice to the person who made the request as to whether or not access to the record or a part of it will be given; and (b) if access is to be given, give the person who made the request access to the record or part, and if necessary for the purpose cause the record to be produced. R.S.O. 1990, c. M.56, s. 19; 1996, c. 1, Sched. K, s. 15. Note: On July 1, 2026…

• 22.
• 20Extension of time

  20 (1) A head may extend the time limit set out in section 19 for a period of time that is reasonable in the circumstances, if, (a) the request is for a large number of records or necessitates a search through a large number of records and meeting the time limit would unreasonably interfere with the operations of the institution; or (b) consultations with a person outside the institution are necessary to comply with the request and cannot reasonably be completed within the time limit. Note: On July 1, 2026, section 20 of the Act is amended by adding the following subsection: (See: 2026, c. 2, Sched. 11, s. 6 (1)) Same, second extension (1.1) If the time limit has been extended under subsection (1), the head may extend the time limit one additional time in any of the following circumstances: 1. The person who made the request consents to the extension. 2. The number of records identified …

• 23.
• [s30]
• 20.1Frivolous request

  20.1 (1) A head who refuses to give access to a record or a part of a record because the head is of the opinion that the request for access is frivolous or vexatious, shall state in the notice given under section 19, (a) that the request is refused because the head is of the opinion that the request is frivolous or vexatious; (b) the reasons for which the head is of the opinion that the request is frivolous or vexatious; and (c) that the person who made the request may appeal to the Commissioner under subsection 39 (1) for a review of the decision. Non-application (2) Sections 21 and 22 do not apply to a head who gives a notice for the purpose of subsection (1). 1996, c. 1, Sched. K, s. 16. Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 16 - 30/01/1996

• [s31]
• 21Notice to affected person

  21 (1) A head shall give written notice in accordance with subsection (2) to the person to whom the information relates before granting a request for access to a record, (a) that the head has reason to believe might contain information referred to in subsection 10 (1) that affects the interest of a person other than the person requesting information; or (b) that is personal information that the head has reason to believe might constitute an unjustified invasion of personal privacy for the purposes of clause 14 (1) (f). R.S.O. 1990, c. M.56, s. 21 (1). Contents of notice (2) The notice shall contain, (a) a statement that the head intends to disclose a record or part of a record that may affect the interests of the person; (b) a description of the contents of the record or part that relate to the person; and (c) a statement that the person may subject to subsection (5.1), within twenty day…

• 24.
• [s32]
• 22Contents of notice of refusal

  22 (1) Notice of refusal to give access to a record or part under section 19 shall set out, (a) where there is no such record, (i) that there is no such record, and (ii) that the person who made the request may appeal to the Commissioner the question of whether such a record exists; or (b) where there is such a record, (i) the specific provision of this Act under which access is refused, (ii) the reason the provision applies to the record, (iii) the name and position of the person responsible for making the decision, and (iv) that the person who made the request may appeal to the Commissioner for a review of the decision. R.S.O. 1990, c. M.56, s. 22 (1). Same (2) A head who refuses to confirm or deny the existence of a record as provided in subsection 8 (3) (law enforcement), section 8.1 (Civil Remedies Act, 2001), section 8.2 (Prohibiting Profiting from Recounting Crimes Act, 2002) or s…

• 25.
• 23Copy of record

  23 (1) Subject to subsection (2), a person who is given access to a record or a part of a record under this Act shall be given a copy of the record or part unless it would not be reasonably practicable to reproduce it by reason of its length or nature, in which case the person shall be given an opportunity to examine the record or part. Access to original record (2) If a person requests the opportunity to examine a record or part and it is reasonably practicable to give the person that opportunity, the head shall allow the person to examine the record or part. Copy of part (3) A person who examines a record or a part and wishes to have portions of it copied shall be given a copy of those portions unless it would not be reasonably practicable to reproduce them by reason of their length or nature. R.S.O. 1990, c. M.56, s. 23.

• 26.
• [s34]

  Information to be published or available

• PART II PROTECTION OF INDIVIDUAL PRIVACY
• [s35]
• 24Publication of information re institutions

  24 (1) The Minister shall cause to be published a compilation listing all institutions and, in respect of each institution, setting out, (a) where a request for a record should be made; and (b) the title of the head of the institution. Idem (2) The Minister shall cause the compilation to be published before the 1st day of January, 1992 and at least once every three years thereafter. R.S.O. 1990, c. M.56, s. 24.

• [s36]
• 25Information available for inspection

  25 (1) A head shall cause to be made available for inspection and copying by the public information containing, (a) a description of the organization and responsibilities of the institution; (b) a list of the general classes or types of records in the custody or control of the institution; (c) the title, business telephone and business address of the head; and (d) the address to which a request under this Act should be made. Idem (2) The head shall ensure that the information made available is amended as required to ensure its accuracy. R.S.O. 1990, c. M.56, s. 25.

• 27.
• [s37]
• 26Annual report of head

  26 (1) A head shall make an annual report, in accordance with this section, to the Commissioner. 2006, c. 19, Sched. N, s. 3 (4). Note: On January 1, 2027, subsection 26 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 11, s. 8 (1)) Annual report of head (1) A head shall provide to the Commissioner an annual report with respect to the previous calendar year in accordance with this section. 2026, c. 2, Sched. 11, s. 8 (1). Contents of report (2) A report made under subsection (1) shall specify, (a) the number of requests under this Act or the Personal Health Information Protection Act, 2004 for access to records made to the institution or to a health information custodian within the meaning of the Personal Health Information Protection Act, 2004 that is acting as part of the institution; (b) the number of refusals by the head to disclose a record under th…

• 28.
• [s38]

  PART II PROTECTION OF INDIVIDUAL PRIVACY

• 29.
• [s39]

  Collection and Retention of Personal Information

• 30.
• [s40]
• 27Application of Part

  27 This Part does not apply to personal information that is maintained for the purpose of creating a record that is available to the general public. R.S.O. 1990, c. M.56, s. 27.

• [s41]
• 28Personal information

  28 (1) In this section and in section 29, “personal information” includes information that is not recorded and that is otherwise defined as “personal information” under this Act. Note: On January 1, 2027, subsection 28 (1) of the Act is amended by striking out “section 29” and substituting “section 29 and subsection 30 (5)”. (See: 2026, c. 2, Sched. 11, s. 9 (1)) Collection of personal information (2) No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity. R.S.O. 1990, c. M.56, s. 28. Note: On January 1, 2027, section 28 of the Act is amended by adding the following subsections: (See: 2026, c. 2, Sched. 11, s. 9 (2)) Privacy impact assessment (3) Unless the regulations provide otherwise, before col…

• 31.
• [s42]
• 29Manner of collection

  29 (1) An institution shall collect personal information only directly from the individual to whom the information relates unless, (a) the individual authorizes another manner of collection; (b) the personal information may be disclosed to the institution concerned under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act; (c) the Commissioner has authorized the manner of collection under clause 46 (c); (d) the information is in a report from a reporting agency in accordance with the Consumer Reporting Act; (e) the information is collected for the purpose of determining suitability for an honour or award to recognize outstanding achievement or distinguished service; (f) the information is collected for the purpose of the conduct of a proceeding or a possible proceeding before a court or judicial or quasi-judicial tribunal; (g) the information is col…

• 32.
• 30Retention of personal information

  30 (1) Personal information that has been used by an institution shall be retained after use by the institution for the period prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the personal information. Standard of accuracy (2) The head of an institution shall take reasonable steps to ensure that personal information on the records of the institution is not used unless it is accurate and up to date. Exception (3) Subsection (2) does not apply to personal information collected for law enforcement purposes. Disposal of personal information (4) A head shall dispose of personal information under the control of the institution in accordance with the regulations. R.S.O. 1990, c. M.56, s. 30. Note: On January 1, 2027, section 30 of the Act is amended by adding the following subsection: (See: 2026, c. 2, Sched. 11,…

• 33.
• [s44]
• 30.1Breach of privacy safeguards

  30.1 (1) The head of an institution shall report to the Commissioner any theft, loss or unauthorized use or disclosure of personal information in the custody or under the control of the institution if it is reasonable in the circumstances to believe that there is real risk that a significant harm to an individual would result or if any other prescribed circumstances exist. 2026, c. 2, Sched. 11, s. 11. Report requirements (2) The report mentioned in subsection (1) must contain the prescribed information and must be made in the prescribed form and manner as soon as feasible after the head determines that the theft, loss or unauthorized use or disclosure has occurred. 2026, c. 2, Sched. 11, s. 11. Notification to individual (3) Unless otherwise prohibited by law, the head of an institution shall notify an individual of any theft, loss or unauthorized use or disclosure of the individual’s p…

• [s45]

  Use and Disclosure of Personal Information

• 34.
• [s46]
• 31Use of personal information

  31 An institution shall not use personal information in its custody or under its control except, (a) if the person to whom the information relates has identified that information in particular and consented to its use; (b) for the purpose for which it was obtained or compiled or for a consistent purpose; or (c) for a purpose for which the information may be disclosed to the institution under section 32 or under section 42 of the Freedom of Information and Protection of Privacy Act. R.S.O. 1990, c. M.56, s. 31.

• 35.
• [s47]
• 32Where disclosure permitted

  32 An institution shall not disclose personal information in its custody or under its control except, (a) in accordance with Part I; (b) if the person to whom the information relates has identified that information in particular and consented to its disclosure; (c) for the purpose for which it was obtained or compiled or for a consistent purpose; (d) if the disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions; (e) where permitted or required by law or by a treaty, agreement or arrangement made under an Act or an Act of Canada; (f) if disclosure is by a law enforcement institution, (i) to a law enforcement agency in a foreign country under an arrangement, a written agreement or treaty or legislative authority, o…

• [s48]
• 33Consistent purpose

  33 The purpose of a use or disclosure of personal information that has been collected directly from the individual to whom the information relates is a consistent purpose under clauses 31 (b) and 32 (c) only if the individual might reasonably have expected such a use or disclosure. R.S.O. 1990, c. M.56, s. 33.

• 36.
• [s49]

  Personal Information Banks

• 37.
• 34Personal information bank index

  34 (1) A head shall make available for inspection by the public an index of all personal information banks in the custody or under the control of the institution setting forth, in respect of each personal information bank, (a) its name and location; (b) the legal authority for its establishment; (c) the types of personal information maintained in it; (d) how the personal information is used on a regular basis; (e) to whom the personal information is disclosed on a regular basis; (f) the categories of individuals about whom personal information is maintained; and (g) the policies and practices applicable to the retention and disposal of the personal information. Ensure accuracy (2) The head shall ensure that the index is amended as required to ensure its accuracy. R.S.O. 1990, c. M.56, s. 34. Note: On July 1, 2026, section 34 of the Act is repealed. (See: 2026, c. 2, Sched. 11, s. 12) Sec…

• 38.
• [s51]
• 35Inconsistent use or disclosure

  35 (1) A head shall attach or link to personal information in a personal information bank, (a) a record of any use of that personal information for a purpose other than a purpose described in clause 34 (1) (d); and (b) a record of any disclosure of that personal information to a person other than a person described in clause 34 (1) (e). Idem (2) A record of use or disclosure under subsection (1) forms part of the personal information to which it is attached or linked. R.S.O. 1990, c. M.56, s. 35. Note: On July 1, 2026, section 35 of the Act is repealed. (See: 2026, c. 2, Sched. 11, s. 12) Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 12 - 01/07/2026

• PART III APPEAL
• [s52]

  Right of Individuals to Whom Personal Information Relates to Access and Correction Rights of access and correction

• 39.
• [s53]
• 36Right of access to personal information

  36 (1) Every individual has a right of access to, (a) any personal information about the individual contained in a personal information bank in the custody or under the control of an institution; and (b) any other personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to render it reasonably retrievable by the institution. Note: On July 1, 2026, subsection 36 (1) of the Act is repealed and the following substituted: (See: 2026, c. 2, Sched. 11, s. 13) Rights of access and correction Right of access to personal information (1) Every individual has a right of access to any personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to re…

• 40.
• 37Access

  37 (1) An individual seeking access to personal information about the individual shall, (a) make a request in writing to the institution that the individual believes has custody or control of the personal information, and specify that the request is being made under this Act; (b) identify the personal information bank or otherwise identify the location of the personal information; and Note: On July 1, 2026, clause 37 (1) (b) of the Act is amended by striking out “identify the personal information bank or otherwise” at the beginning. (See: 2026, c. 2, Sched. 11, s. 14) (c) at the time of making the request, pay the fee prescribed by the regulations for that purpose. 2017, c. 2, Sched. 12, s. 6 (2). Access procedures (2) Subsections 4 (2), 17 (1.1) and (2) and sections 18, 19, 20, 20.1, 21, 22 and 23 apply with necessary modifications to a request made under subsection (1). 1996, c. 1, Sch…

• 41.
• 38Exemptions

  38 A head may refuse to disclose to the individual to whom the information relates personal information, (a) if section 6, 7, 8, 8.1, 8.2, 9, 9.1, 10, 11, 12, 13 or 15 would apply to the disclosure of that personal information; (b) if the disclosure would constitute an unjustified invasion of another individual’s personal privacy; (c) that is evaluative or opinion material compiled solely for the purpose of determining suitability, eligibility or qualifications for the awarding of contracts and other benefits by an institution if the disclosure would reveal the identity of a source who furnished information to the institution in circumstances where it may reasonably have been assumed that the identity of the source would be held in confidence; (c.1) if the information is supplied explicitly or implicitly in confidence and is evaluative or opinion material compiled solely for the purpose …

• 42.
• 38.1Commissioner’s review of information practices

  38.1 (1) The Commissioner may conduct a review of the information practices of an institution if the Commissioner has received a complaint under subsection 30.1 (4) or has other reason to believe that the requirements of this Part are not being complied with. 2026, c. 2, Sched. 11, s. 15. Informal dispute resolution (2) Before conducting a review, the Commissioner may try to resolve the matter through mediation, conciliation or any other informal means of dispute resolution that the Commissioner considers appropriate. 2026, c. 2, Sched. 11, s. 15. No review (3) The Commissioner may decide not to conduct a review for whatever reason the Commissioner considers proper, including if satisfied that, (a) the institution has responded adequately to the complaint; (b) the complaint has been or could be more appropriately dealt with, initially or completely, by means of a procedure other than a c…

• 43.
• [s57]

  PART III APPEAL

• 44.
• [s58]
• 39Right to appeal

  39 (1) A person may appeal any decision of a head under this Act to the Commissioner if, (a) the person has made a request for access to a record under subsection 17 (1); (b) the person has made a request for access to personal information under subsection 37 (1); (c) the person has made a request for correction of personal information under subsection 36 (2); or (d) the person is given notice of a request under subsection 21 (1). R.S.O. 1990, c. M.56, s. 39 (1). Note: On July 1, 2026, section 39 of the Act is amended by adding the following subsection: (See: 2026, c. 2, Sched. 11, s. 16 (1)) Limit on right of appeal (1.0.1) Despite subsection (1), a decision of a head to amend a plan for providing access to the records in stages referred to in subsection 17.1 (1) after the plan has already been amended once by the head may not be appealed to the Commissioner. 2026, c. 2, Sched. 11, s. 1…

• PART IV GENERAL
• [s59]
• 40Mediator to try to effect settlement

  40 The Commissioner may authorize a mediator to investigate the circumstances of any appeal and to try to effect a settlement of the matter under appeal. R.S.O. 1990, c. M.56, s. 40.

• 45.
• [s60]
• 41Inquiry

  41 (1) The Commissioner may conduct an inquiry to review the head’s decision if, (a) the Commissioner has not authorized a mediator to conduct an investigation under section 40; or (b) the Commissioner has authorized a mediator to conduct an investigation under section 40 but no settlement has been effected. 1996, c. 1, Sched. K, s. 21. Procedure (2) The Statutory Powers Procedure Act does not apply to an inquiry under subsection (1). R.S.O. 1990, c. M.56, s. 41 (2). Inquiry in private (3) The inquiry may be conducted in private. R.S.O. 1990, c. M.56, s. 41 (3). Powers of Commissioner (4) In an inquiry, the Commissioner may require to be produced to the Commissioner and may examine any record that is in the custody or under the control of an institution, despite Parts I and II of this Act or any other Act or privilege, and may enter and inspect any premises occupied by an institution for…

• 46.
• 42Burden of proof

  42 If a head refuses access to a record or a part of a record, the burden of proof that the record or the part falls within one of the specified exemptions in this Act lies upon the head. R.S.O. 1990, c. M.56, s. 42.

• 47.
• 43Order

  43 (1) After all of the evidence for an inquiry has been received, the Commissioner shall make an order disposing of the issues raised by the appeal. Idem (2) If the Commissioner upholds a decision of a head that the head may refuse to disclose a record or a part of a record, the Commissioner shall not order the head to disclose the record or part. R.S.O. 1990, c. M.56, s. 43 (1, 2). Conditions (3) Subject to this Act, the Commissioner’s order may contain any conditions the Commissioner considers appropriate. R.S.O. 1990, c. M.56, s. 43 (3); 1996, c. 1, Sched. K, s. 22. Notice of order (4) The Commissioner shall give the appellant and the persons who received notice of the appeal under subsection 39 (3) written notice of order. R.S.O. 1990, c. M.56, s. 43 (4). Section Amendments with date in force (d/m/y) 1996, c. 1, Sched. K, s. 22 - 30/01/1996

• 48.
• 44Delegation

  44 The Commissioner shall not delegate to a person other than an Assistant Commissioner his or her power to require a record referred to in section 8 to be produced and examined. R.S.O. 1990, c. M.56, s. 44.

• 49.
• [s64]

  PART IV GENERAL

• 50.
• 45Fees

  45 (1) A head shall require the person who makes a request for access to a record to pay fees in the amounts prescribed by the regulations for, (a) the costs of every hour of manual search required to locate a record; (b) the costs of preparing the record for disclosure; (c) computer and other costs incurred in locating, retrieving, processing and copying a record; (d) shipping costs; and (e) any other costs incurred in responding to a request for access to a record. 1996, c. 1, Sched. K, s. 23 (1). (2) Repealed: 1996, c. 1, Sched. K, s. 23 (1). Estimate of costs (3) The head of an institution shall, before giving access to a record, give the person requesting access a reasonable estimate of any amount that will be required to be paid under this Act that is over $25. R.S.O. 1990, c. M.56, s. 45 (3). Note: On July 1, 2026, subsection 45 (3) of the Act is repealed and the following substit…

• 51.
• 45.1Whistleblowing

  45.1 (1) Any person who has reasonable grounds to believe that an institution has contravened or is about to contravene this Act or the regulations may notify the Commissioner of the particulars of the matter and may request that their identity be kept confidential with respect to the notification. 2026, c. 2, Sched. 11, s. 18. Confidentiality (2) The Commissioner must keep confidential the identity of a person who has notified the Commissioner under subsection (1) and to whom an assurance of confidentiality has been provided by the Commissioner. 2026, c. 2, Sched. 11, s. 18. Section Amendments with date in force (d/m/y) 2026, c. 2, Sched. 11, s. 18 - 01/01/2027

• 52.
• 46Powers and duties of Commissioner

  46 The Commissioner may, (a) offer comment on the privacy protection implications of proposed programs of institutions; (b) after hearing the head, order an institution to, (i) cease a collection practice that contravenes this Act, and (ii) destroy collections of personal information that contravene this Act; (c) in appropriate circumstances, authorize the collection of personal information otherwise than directly from the individual; (d) engage in or commission research into matters affecting the carrying out of the purposes of this Act; (e) conduct public education programs and provide information concerning this Act and the Commissioner’s role and activities; and (f) receive representations from the public concerning the operation of this Act. R.S.O. 1990, c. M.56, s. 46.

• 53.
• 47Regulations

  47 (1) The Lieutenant Governor in Council may make regulations, (0.a) prescribing standards for determining what constitutes reasonable grounds for a head to conclude that a request for access to a record is frivolous or vexatious; (0.a.1) prescribing Aboriginal organizations and communities for the purposes of clause (c) of the definition of “Aboriginal community” in subsection 9.1 (2); (a) respecting the procedures for access to original records under section 23; (a.1) requiring the head of an institution to assist persons with disabilities in making requests for access under subsection 17 (1) or 37 (1); (b) prescribing the circumstances under which records capable of being produced from machine readable records are not included in the definition of “record” for the purposes of this Act; Note: On January 1, 2027, subsection 47 (1) of the Act is amended by adding the following clause: (…

• 54.
• 48Offences

  48 (1) No person shall, (a) wilfully disclose personal information in contravention of this Act; Note: On January 1, 2027, clause 48 (1) (a) of the Act is amended by striking out “disclose” and substituting “collect, use or disclose”. (See: 2026, c. 2, Sched. 11, s. 20 (1)) (b) wilfully maintain a personal information bank that contravenes this Act; Note: On July 1, 2026, clause 48 (1) (b) of the Act is repealed. (See: 2026, c. 2, Sched. 11, s. 20 (2)) (c) make a request under this Act for access to or correction of personal information under false pretences; (c.1) alter, conceal or destroy a record, or cause any other person to do so, with the intention of denying a right under this Act to access the record or the information contained in the record; (d) wilfully obstruct the Commissioner in the performance of his or her functions under this Act; (e) wilfully make a false statement to m…

• 55.
• 49Delegation of head’s powers

  49 (1) A head may in writing delegate a power or duty granted or vested in the head to an officer or officers of the institution or another institution subject to such limitations, restrictions, conditions and requirements as the head may set out in the delegation. R.S.O. 1990, c. M.56, s. 49 (1); 2006, c. 34, Sched. C, s. 19. Protection from civil proceeding (2) No action or other proceeding lies against a head, or against a person acting on behalf or under the direction of the head, for damages resulting from the disclosure or non-disclosure in good faith of a record or any part of a record under this Act, or from the failure to give a notice required under this Act if reasonable care is taken to give the required notice. R.S.O. 1990, c. M.56, s. 49 (2). Vicarious liability of institutions preserved (3) Subsection (2) does not relieve an institution from liability in respect of a tort …

• 50Oral requests

  50 (1) If a head may give access to information under this Act, nothing in this Act prevents the head from giving access to that information in response to an oral request or in the absence of a request. Pre-existing access preserved (2) This Act shall not be applied to preclude access to information that is not personal information and to which access by the public was available by statute, custom or practice immediately before the 1st day of January, 1991. R.S.O. 1990, c. M.56, s. 50.

• 51Information otherwise available

  51 (1) This Act does not impose any limitation on the information otherwise available by law to a party to litigation. Powers of courts and tribunals (2) This Act does not affect the power of a court or a tribunal to compel a witness to testify or compel the production of a document. R.S.O. 1990, c. M.56, s. 51.

• 52Application of Act

  52 (1) This Act applies to any record in the custody or under the control of an institution regardless of whether it was recorded before or after the 1st day of January, 1991. R.S.O. 1990, c. M.56, s. 52 (12). Non-application of Act (2) This Act does not apply to records placed in the archives of an institution by or on behalf of a person or organization other than the institution. R.S.O. 1990, c. M.56, s. 52 (2). Same (2.1) This Act does not apply to a record relating to a prosecution if all proceedings in respect of the prosecution have not been completed. 2006, c. 34, Sched. C, s. 20. Same (3) Subject to subsection (4), this Act does not apply to records collected, prepared, maintained or used by or on behalf of an institution in relation to any of the following: 1. Proceedings or anticipated proceedings before a court, tribunal or other entity relating to labour relations or to the e…

• 52.1Non-application re: Hydro One Inc.

  52.1 (1) This Act does not apply to Hydro One Inc. and its subsidiaries on and after the date on which the Building Ontario Up Act (Budget Measures), 2015 received Royal Assent. 2015, c. 20, Sched. 28, s. 1. Transition, Minister’s report (2) The publication of information required by section 24 on or after the date described in subsection (1) must not include information about Hydro One Inc. and its subsidiaries. 2015, c. 20, Sched. 28, s. 1. Transition, request for continuing access (3) If a person had made a request under subsection 17 (3) for continuing access to a record of Hydro One Inc. or a subsidiary before the date described in subsection (1), and if the specified period for which access is requested expires after April 23, 2015, the specified period is deemed to have expired on April 23, 2015. 2015, c. 20, Sched. 28, s. 1. Repeal (4) Subsection (3) and this subsection are repea…

• 53Other Acts

  53 (1) This Act prevails over a confidentiality provision in any other Act unless the other Act or this Act specifically provides otherwise. R.S.O. 1990, c. M.56, s. 53 (1). Idem (2) The following confidentiality provisions prevail over this Act: 1. Subsection 88 (6) of the Municipal Elections Act, 1996. 2. Subsection 53 (1) of the Assessment Act. R.S.O. 1990, c. M.56, s. 53 (2); 1996, c. 32, s. 77. Section Amendments with date in force (d/m/y) 1996, c. 32, s. 77 - 19/12/1996

• 54Exercise of rights of deceased, etc., persons

  54 Any right or power conferred on an individual by this Act may be exercised, (a) if the individual is deceased, by the individual’s personal representative if exercise of the right or power relates to the administration of the individual’s estate; (b) by the individual’s attorney under a continuing power of attorney, the individual’s attorney under a power of attorney for personal care, the individual’s guardian of the person, or the individual’s guardian of property; and (c) if the individual is less than sixteen years of age, by a person who has lawful custody of the individual. R.S.O. 1990, c. M.56, s. 54; 1992, c. 32, s. 23; 1996, c. 2, s. 73. Section Amendments with date in force (d/m/y) 1992, c. 32, s. 23 - 03/04/1995 1996, c. 2, s. 73 - 29/03/1996

• 55Repealed

  55 Repealed: 2006, c. 34, Sched. C, s. 21. Section Amendments with date in force (d/m/y) 2006, c. 34, Sched. C, s. 21 - 01/04/2007 ______________