Alberta government proposes new privacy law to safeguard personal information

The Alberta government seeks to overhaul privacy and access laws for the public sector, introducing legislation that ministers say will create the strongest privacy protections in Canada.

A second bill tabled Wednesday, if passed, would also shield the government from providing public access to communication between political staff — a change that one access to information expert says is worrisome.

"I want you to have confidence that your personal information is protected at all times and is secured from unauthorized access," Technology and Innovation Minister Nate Glubish said during an embargoed news conference Wednesday morning.

Alberta has made no meaningful update to privacy legislation in 20 years, Glubish said. The changes would ensure citizens are notified when their privacy is breached and would bar public bodies from selling data.

The proposed legislation is the result of a 2019 call to action from privacy commissioners across Canada, he said. At the time, they urged provinces and territories to reform laws so they keep pace with technology, such as social media, artificial intelligence and smart phones.

If passed, Bill 33, the Protection of Privacy Act, would also increase the penalties individuals and organizations would pay for breaches.

"Do you care about protecting Albertans, or do you care about protecting government?" Glubish said, when asked about higher penalties. "Protecting Albertans is the most important thing."

Common types of breaches include cases where an employee wrongly snoops on the records of someone they know, or returning rented scanning or computer equipment without properly deleting the data, said Gary Dickson, a former Alberta Liberal MLA for Calgary-Buffalo and Saskatchewan's first information and privacy commissioner.

Larger fines for breaches are "symbolic," Dickson told CBC News, and penalties levied are rarely close to the maximum amounts.

Existing legislation does not require public bodies to report breaches to the minister, so in the last five years, no breaches resulted in fines, Jonathan Gauthier, Glubish's press secretary, told CBC News in an email.

The provincial government plans to launch a website where Albertans can see when their information has been accessed, starting with digital child-care services, vehicle registrations and drivers' licence renewals, Glubish said.

The proposed legislation would also allow public bodies to de-personalize datasets, so the information could be used for research or making policy.

The Protection of Privacy Act would not apply to medical records or information in the possession of private companies. Although, Glubish said he's reviewing the legislation governing those records and will propose amendments next year.

Under the new privacy law, public bodies would have to perform privacy impact assessments in some scenarios. The government hasn't yet specified when.