British Columbia’s Privacy Commissioner Publishes Annual Report Highlighting Key Developments

On August 24, 2022, the latest annual report (the Report) was released by the Office of the Information and Privacy Commissioner for British Columbia (the OIPC), for the period of April 1, 2021 – March 31, 2022 (FY 2021-22).  The Report highlights key developments in British Columbia as it relates to: (1) the regulation of artificial intelligence systems (AI systems) in the public sector; (2) the protection of personal information; and (3) the public’s right to access information.

The following are some of the key developments noted in the Report during FY 2021-22:

1. Due to increasing use of AI systems in the public sector, in June 2021, the privacy commissioner and ombudsman in both British Columbia and Yukon jointly released a report entitled, Getting Ahead of the Curve: Meeting the challenges to privacy and fairness arising from the use of artificial intelligence in the public sector.  Several recommendations were made in this report, including: (i) the need for the government to commit to guiding principles for the use of AI systems that incorporate transparency, accountability, legality, procedural fairness, and privacy protections; and (ii) the need for public bodies to notify an individual when an AI system is used to make a decision about them.

2. Also, in June 2021, the OIPC published a report regarding the handling of personal information by private sector liquor and cannabis retailers.  The OIPC found that few private liquor and cannabis retailers maintained adequate privacy management programs or document privacy policies.  Following the release of this report, the OIPC updated its guidance document, Protecting personal information: Cannabis transactions.

3. In October 2021, the provincial government introduced Bill 22, the Freedom of Information and Protection of Privacy Amendment Act, 2021 (which was passed in November). 

• The commissioner of the OIPC, Michael McEvoy, stated that the amendments in Bill 22 go “some ways to strengthen privacy protections by mandating new requirements for privacy management programs, mandatory breach notification, so-called ‘snooping offences,’ and privacy impact assessments.” 
• However, the Report found other elements of Bill 22 to be a step backwards, including the new application fee for information requests and the exclusion of certain record types from freedom of information requests.

4. With the passage of Bill 22, public bodies (and their service providers) are no longer prohibited under the Freedom of Information and Protection of Privacy Act from disclosing, storing or permitting access to personal information outside Canada (except in limited circumstances).  In responding to the removal of this prohibition, the OIPC published guidance that emphasized the key factors that should be considered before a public body discloses, stores, or permits access to personal information in a foreign jurisdiction.

5. In March 2022, the BC Green Party, BC Liberal Party, and BC NDP all signed the “Political Campaign Activity Code of Practice”.  This code was developed by the OIPC and Elections BC in conjunction with input from the three political parties referred to above.  Signatories of the code adhere to 10 fair campaigning practices.  These practices include: (i) obtaining meaningful consent from voters on the use of their personal information; (ii) collecting information directly from individuals where possible; and (iii) disclosing analytical models that predict information about individuals.  The full text of the code can be found here.

The Report also contains additional findings and statistics for FY 2021-22 that may be of interest. The full report can be found here.

Summary By: Olalekan (Wole) Akinremi