Summary:

Notice to the Public and Institutions

To protect the health of our employees and to do our part to slow community transmission of the COVID-19 virus, the IPC has closed its physical office.

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.

We continue to update our FAQs as we get more information. You can also reach us by emailing info@ipc.v51.com.

If you’ve made a request for general or personal information from a public-sector organization, you should expect delays. Because of the COVID-19 outbreak, many public sector staff are working remotely and may not be in a position to search for the records you are asking for until they are back in the office.

Tips for Working from Home

We understand that these are exceptional circumstances. The reasonableness of security and privacy measures has to take into account time-limited, urgent needs.

Many organizations are striving to manage service disruptions and continue to provide essential services, especially in the health and child and family services sectors.

Here are some tips for dealing with personal information when working from home:

Mobile devices

  • password protect your device
  • lock your device when not in use
  • if using portable storage devices, such as USBs and portable hard drives, if possible, ensure they are encrypted and password protected
  • keep your software up-to-date

Emails

  • if possible, use work email accounts rather than personal ones for work-related emails involving personal data
  • before sending an email, check that you’re sending it to the correct recipient, particularly for emails involving personal data

Paper copies and files

  • only remove personal information from the office if it is necessary to carry out your job duties
  • securely store any paper files when not in use – lock files away and do not leave files in your car

Frequently Asked Questions

 

When will the IPC reopen?

When will the IPC reopen?

We will continue to evaluate this evolving situation and provide regular updates here and on Twitter @IPCinfoprivacy.

 

What essential services will be provided by the IPC during this time?

What essential services will be provided by the IPC during this time?

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.

 

Will institutions be required to respond to requests for access to or correction of information during this time?

Will institutions be required to respond to requests for access to or correction of information during this time?

UPDATED MARCH 25 – The expectation to comply with Ontario’s access laws remains in effect, however this is an exceptional circumstance and we understand that many organizations will be unable to meet the 30-day response requirement. As such, we will consider these circumstances when evaluating appeals relating to deemed refusals.

 

How should requests and appeals be treated that relate to third party records?

How should requests and appeals be treated that relate to third party records?

The Ontario government has issued a suspension order, effective March 16, under the Emergency Management and Civil Protection Act that ‘freezes’ the time limits for initiating complaints or appeals to the IPC set out in Ontario’s access laws, health privacy law, and child and family services law.  It is important to note that the suspension order applies to the time limit for a third party affected by a request under the Municipal/Freedom of Information and Protection of Privacy Acts to submit an appeal. The time limit is frozen.

Under normal circumstances, the IPC notifies institutions when an affected third party submits an appeal. This is done to ensure that the records related to an affected third party are not disclosed to the requester before the issue of disclosure is settled or determined. Due to the closure of the IPC’s office, we are not currently confirming receipt of third party appeals to institutions.

For the reasons set out above, institutions under the Municipal/Freedom of Information and Protection of Privacy Act cannot assume that a third party has not filed an appeal, or will not file an appeal against a decision to disclose records once the suspension order is lifted. They must therefore ensure that the consent of affected third parties to a request/appeal is sought and received before disclosing records to a requester.  If consent has not been obtained, no third party records should be disclosed until the issue of disclosure can be settled or determined in accordance with the provisions of the Municipal/Freedom of Information and Protection of Privacy Act.

Please contact our office should you require further clarification.

 

What will happen with my appeal?

What will happen with my appeal?

The Ontario government has issued a suspension order, effective March 16, under the Emergency Management and Civil Protection Act that ‘freezes’ the time limits for initiating complaints or appeals to the IPC set out in Ontario’s access laws, health privacy law, and child and family services law.

Most tribunal services will be on hold while the office is closed.

These steps are subject to any additional rules the Ontario government may establish in the interim and when lifting the suspension order.

Our top priority is keeping the public and all IPC staff safe during the COVID-19 outbreak. We will make every effort to get back to regular business quickly once this crisis is over.

 

What if my privacy is breached? Will the IPC be taking complaints?

What if my privacy is breached? Will the IPC be taking complaints?

Anyone with a complaint should submit it to the IPC using our online complaint forms. We will make every effort to respond to urgent matters in a timely way, but may not be able to address your complaint until the office reopens.  We appreciate your patience during this difficult time.

 

Can I still reach the IPC to consult or ask questions about matters related to access and privacy at my organization?

Can I still reach the IPC to consult or ask questions about matters related to access and privacy at my organization?

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.

We continue to update our FAQs as we get more information. You can also reach us by emailing info@ipc.v51.com.

 

How will I comply with the requirement to report privacy breaches to the IPC?

How will I comply with the requirement to report privacy breaches to the IPC?

Institutions, health information custodians and child and family service providers should continue to report breaches at their organizations using the online breach report form. We will make every effort to respond to urgent matters in a timely way, but may not be able to address your report until the office reopens.  We appreciate your patience during this difficult time.

 

I am sending in an important piece of mail. Will it be received?

I am sending in an important piece of mail.  Will it be received?

No, all mail is being held until the office reopens and is not being opened. Also, if you sent any mail on or after March 9, 2020, or any courier packages on or after March 11, 2020, we may not have received them yet and they will not be opened, either. If the communication was urgent, you may email info@ipc.v51.com.

 

How do I get in touch with the IPC during the closure?

How do I get in touch with the IPC during the closure?

While most tribunal services will not operate as usual while the office is closed, we continue to provide limited services to the public, public sector organizations, and the health and child and family services sectors and we remain available to public organizations for consultation and discussions on access and privacy matters.

Members of the public can email info@ipc.v51.com. We will make every effort to respond to urgent matters in a timely way, but may not be able to address your email until the office reopens.

 

Should organizations tell staff who are working at home to avoid accessing and collecting personal information of patients/clients? Home computers may not have the same level of security as the devices in the office, which are on a secure network.

Should organizations tell staff who are working at home to avoid accessing and collecting personal information of patients/clients? Home computers may not have the same level of security as the devices in the office, which are on a secure network.

We understand that these are exceptional circumstances. The reasonableness of security and privacy measures has to take into account time-limited, urgent needs.  Many organizations are striving to manage service disruptions and continue to provide essential services, especially in the health and child and family services sectors.

If your organization believes that staff (or agents working on the behalf of the organization) should be allowed to handle personal information from home, in order to provide necessary services in an effective and efficient way, you should permit them to do so. You should guide any staff working from home on how to do their work within as privacy-protective an environment as they can, given the realities of our current situation.

In a public health crisis, it is also understandable that service professionals, especially in the health and child protection sectors, may need to send or receive information by phone, text, email or other messaging services. The above applies to the use of technologies not normally used for business, during this crisis.

We remain available to public organizations for consultation and discussions on access and privacy matters during this time.

 

Can public health bodies, government organizations and other facilities, such as long-term care homes, release information about numbers of infected individuals and deaths due to COVID-19? Does privacy prevent this kind of information from being disclosed to the public?

Can public health bodies, government organizations and other facilities, such as long-term care homes, release information about numbers of infected individuals and deaths due to COVID-19?  Does privacy prevent this kind of information from being disclosed to the public?

Privacy does not prevent the release of data related to COVID-19 infections and deaths in Ontario.

Public health offices, long-term care facilities, hospitals, and other organizations can release non-identifying information, especially in situations where the information is related to incidences of infection, numbers of deaths, or other information that can help control spread of the virus and keep the public safe. This vital information should be shared with the public as soon as it is possible to do so.

Non-identifying information could include the numbers of affected individuals, demographic data such as gender and approximate age of affected individuals, as well as geographic locations of infected or deceased individuals, including long-term care facilities and workplaces, especially if they are in a location where large numbers of people might have gathered. However, public health bodies and governments should only share as much information as is necessary for public health purposes. They don’t need to name the individual.

People need to be told if they have been exposed to the virus so they can take steps to self-isolate or otherwise protect themselves and their families, as well as assess the public health response. In matters of public health, privacy is not a barrier to sharing information critical to public well-being.