The Freedom of Information and Protection of Privacy Act (FIPPA) came into force on May 4, 1998. FIPPA replaced The Freedom of Information Act that had been in force since September 1988. It gives an individual a legal right of access to records held by Manitoba public bodies, subject to specific and limited exceptions. The Act also requires that public bodies protect the privacy of an individual's personal information existing in records held by public bodies.

FIPPA applies to public bodies, which include provincial government departments, government agencies and local public bodies. Provincial public bodies, which come under the executive branch of the Manitoba government, include government departments, offices of the ministers of government and the Executive Council Office (Cabinet). FIPPA also applies to Manitoba government agencies including boards, commissions, agencies, or other bodies whose members or whose board members are all appointed by a Manitoba statute or by order of the Lieutenant Governor in Council.

Local public bodies include educational bodies (such as school divisions, universities and colleges), health care bodies (such as hospitals and regional health authorities) and local government bodies (such as the City of Winnipeg, municipalities, local government districts, planning districts and conservation districts).

FIPPA does not apply to the legislative or judicial branches of the government. These bodies have their own legislation and rules respecting access to records and protection of privacy. Additionally, FIPPA does not apply to certain records specified under section 4, even when these records are held by public bodies. Some Manitoba statutes contain provisions that prevail in the event there is an inconsistency or conflict between the provisions of these statutes and FIPPA. These statutes include: The Adoption Act, The Child and Family Services Act, The Mental Health Act, The Regional Health Authorities Act, The Securities Act, The Statistics Act, The Testing of Bodily fluids and Disclosure Act, The Vital Statistics Act, The Witness Security Act, The Workers' Compensation Act and The Youth Drug Stabilization Act.

 

Section 2 of FIPPA describes the purposes of the Act, which are:

• to allow any person a right of access to records in the custody or under the control of public bodies, subject to the limited and specific exceptions set out in the Act;
  
  
• to allow individuals a right of access to records containing personal information about themselves in the custody or under the control of public bodies, subject to the limited and specific exceptions set out in the Act;
  
  
• to allow individuals a right to request corrections to records containing personal information about themselves in the custody or under the control of public bodies;
  
  
• to control the manner in which public bodies may collect personal information from individuals and to protect individuals against unauthorized use or disclosure of personal information by public bodies; and,
  
  
• to provide for an independent review of the decisions of public bodies under FIPPA.

  

FIPPA provides for access to records held by Manitoba public bodies. The Act sets out the manner in which to make a request for access under FIPPA. A request must be made on the prescribed application form.

The right of access is subject to limited and specific exceptions to disclosure. The practice of severance, which involves removing information that falls within an exception to disclosure from a copy of the record to be released, provides a means of disclosing as much information as possible. There are two types of exceptions to disclosure in FIPPA: mandatory exceptions and discretionary exceptions.

Mandatory Exceptions
A mandatory exception to disclosure contains the words "the head of a public body shall refuse to disclose information...". If all or part of the information contained in a record comes under a mandatory exception, the head of a public body is required to refuse to disclose the information. The mandatory exceptions to disclosure, in Division 3 of Part 2 of FIPPA, are:

• Privacy of a Third Party (section 17)
• Business Interests of Third Parties (section 18)
• Cabinet Confidences (section 19)
• Information Provided by Another Government (section 20)
• No Disclosure of a Law Enforcement Record if Prohibited by an Enactment of Canada (subsection 25(2))
• Solicitor-Client Privilege of a Third Party (subsection 27(2))

Discretionary Exceptions
A discretionary exception to disclosure contains the words "the head of a public body may refuse to disclose information…". A discretionary exception permits the head of a public body to disclose information in a record, even though it falls within the exception. In other words, the head must consider all relevant factors and the particular circumstances of the case in determining whether it is appropriate to disclose the information, unless an exception in another section of FIPPA applies. The main discretionary exceptions to disclosure, in Division 4 of Part 2 of FIPPA are:

• Relations Between Manitoba and Other Governments (section 21)
• Local Public Body Confidences (section 22)
• Advice to a Public Body (section 23)
• Individual or Public Safety (section 24)
• Law Enforcement and Legal Proceedings (section 25)
• Security of Property (section 26)
• Solicitor-Client Privilege (subsection 27(1))
• Economic and Other Interests of a Public Body (section 28)
• Testing Procedures, Tests and Audits (section 29)
• Confidential Evaluations (section 30)
• Preservation of Heritage Resources and Life Forms (section 31)
• Information that will be Available to the Public (section 32)

 

FIPPA provides for the protection of an individual's personal information held by public bodies. Personal information is information, recorded in any form, about an identifiable individual. FIPPA imposes obligations on public bodies respecting the collection, accuracy, correction, retention, protection, use and disclosure of personal information.

The following are key privacy principles and practices reflected in FIPPA:

Collection

• Where a public body collects personal information, the collection must be for a purpose authorized under FIPPA and be limited to the minimum amount necessary to accomplish the purpose (section 36).
• Personal information must be collected directly from the individual, unless another method of collection is authorized under FIPPA (section 37).

Accuracy

• Public bodies must take reasonable steps to ensure that personal information is accurate and complete if it will be used to make a decision that directly affects the individual the information is about (section 38).

Correction

• An individual who has been given access to a record containing his or her own personal information has a right to request correction of errors or omissions in the record (section 39).

Retention

• Public bodies must keep personal information for a reasonable period of time so that the individual the information is about has a reasonable opportunity to access it (section 40).

Security

• Public bodies must protect personal information by making reasonable security arrangements against such risks as unauthorized access, use, disclosure or destruction (section 41).

Use

• Every use of personal information by a public body must be authorized under FIPPA (section 43).
• Every use of personal information by a public body must be limited to the minimum amount of information necessary to accomplish the purpose for which it is used and be limited to the employees and agents of the public body who need to know the information (section 42).

Disclosure

• Every disclosure of personal information by a public body must be authorized under FIPPA (section 44).
• Every disclosure of personal information by a public body must be limited to the minimum amount of information necessary to accomplish the purpose for which it is disclosed (section 42).

Information Manager Agreements

• A public body may provide personal information to an information manager that processes, stores or destroys personal information for a public body or provides information management or technology services to a public body, if the parties enter into an agreement in compliance with FIPPA (section 44.1).

Research Agreements

• A public body may disclose personal information for a research purpose only if the requirements of section 47 of FIPPA are met and the researcher has entered into a written agreement respecting the use and protection of personal information.

Advising Individuals of their Rights

Notice of Collection

A public body that collects personal information directly from the individual the information is about shall inform the individual:

- of the purpose for which the information is collected;

- the legal authority for the collection

- the title, business address and telephone number of an officer or employee of the public body who can answer the individual's questions about the collection

unless the public body has recently provided the individual with this information about the collection of the same or similar personal information for the same or a related purpose (section 37).

Informing Individuals of their Rights in the Disclosure of their Personal Information for Fundraising by Educational Institutions

An educational institution that is a public body may disclose personal information in its alumni records reasonably necessary for fundraising activities where the institution has entered into a written agreement in compliance with FIPPA with the persons receiving the information. The agreement must:

- require that individuals are informed of their right to request that their personal information cease to be disclosed

- allow individuals, on request, a right of access to personal information that is disclosed about them in the fundraising

- require that the person to whom the information is disclosed cease to use the personal information if any individual so requests (subsection 44 (1.1)).

 

 

FIPPA provides for an independent review of the decisions of public bodies under this Act. The Ombudsman is an independent Officer of the Legislature with broad investigative powers. The responsibilities of the Ombudsman under FIPPA include the investigation of complaints respecting access to information and protection of personal information, monitoring compliance with FIPPA by public bodies and promoting public awareness of FIPPA. The Ombudsman may also initiate a complaint respecting any matter about which the Ombudsman is satisfied there are reasonable grounds to investigate under FIPPA.

 

FIPPA allows you to make a complaint to the Manitoba Ombudsman regarding the following matters, as long as your complaint is made within the specified time limits:

	COMPLAINT		TIME LIMIT
	You have not received a response and it has been more than 30 days since the public body received your application		FIPPA requires that this complaint be made within 120 days of making an application for access (subsection 60(3))
	You wish to challenge the decision of the public body to extend its response time beyond 30 days		FIPPA requires that this complaint be made within 60 days of being notified of the public body's decision (subsection 60(2))
	You have been denied access to all or part of the records for which you applied		FIPPA requires that this complaint be made within 60 days of being notified of the public body's decision to refuse access, unless the complaint relates to a decision under subsection 34(5) (subsection 60(2))
	Your request for correction of your personal information has been refused		FIPPA requires that this complaint be made within 60 days of being notified of the public body's decision not to correct the record (subsection 60(2))
	You believe your own personal information has been collected, used or disclosed in violation of Part 3 of the Act		There is no specific time limit under FIPPA, although the Ombudsman may decide not to investigate if the elapsed time makes an investigation no longer practical or desirable
	As a third party you wish to contest the public body's decision to give access to records against your wishes		FIPPA requires that this complaint be made within 21 days of being notified of the public body's decision to give access (subsection 34(4))

Where an individual has a right to make a complaint under FIPPA, the complaint may be made by another person who is authorized under section 79 to act on behalf of that individual. For example, if the person has written authorization from the individual to act on the individual's behalf, or is the parent or guardian of a minor and the exercise of the right or power would not constitute an unreasonable invasion of the minor's privacy, or is otherwise authorized under section 79 to act on the individual's behalf.

A complaint must be made on the prescribed complaint form. Copies are available from the Office of the Manitoba Ombudsman and the Government Records Office of the Provincial Archives of Manitoba or you may photocopy the blank form which is reproduced in the Access and Privacy regulation or print it off the web site. Additional information may be attached to your complaint form, such as copies of any relevant documentation, including your application for access or the written response from the public body. If you are making a complaint about the collection, use or disclosure of your personal information, please attach a letter describing the details of your concern to your complaint form. Another option, instead of writing a letter, is to complete a Questionnaire for a Privacy Complaint available on our website. We do not accept complaints by e-mail.

If you have any questions concerning the making of a complaint, you may contact the Office of the Manitoba Ombudsman for assistance.

 

The Ombudsman will investigate a complaint to determine if the public body is in compliance with FIPPA. The Ombudsman may also initiate a complaint concerning any matter about which the Ombudsman is satisfied there are reasonable grounds to investigate under FIPPA (section 59). During the investigation, the Ombudsman may take any steps considered appropriate to resolve the complaint informally to the satisfaction of the parties and in a manner consistent with the legislation (section 62).

The Ombudsman may decide not to investigate a complaint if in her opinion: the length of elapsed time makes an investigation of a privacy complaint no longer practicable or desirable; the subject matter of the complaint is trivial or the complaint is not made in good faith, or is frivolous, or vexatious, or an abuse of process; or the circumstances of the complaint do not require investigation (section 63).

In the course of an investigation, the Ombudsman is required to give the complainant and the public body an opportunity to make representations (section 64). FIPPA allows for a 90-day time limit for an investigation to be completed unless the Ombudsman extends this time period (section 65).

On completing an investigation of a complaint, the Ombudsman is required to prepare a report containing the findings about the complaint and any recommendations the Ombudsman considers appropriate respecting the complaint. The report will be provided to the complainant and the public body concerned (section 66).

If the report contains recommendations, the head of the public body must send the Ombudsman a written response within 15 days after receiving the report indicating whether the recommendations have been accepted and describing any action taken or proposed to implement them, or, the reasons why the head refuses to take actions to implement them (section 66).

If the report contains recommendations, the head of the public body must send the Ombudsman a written response within 15 days after receiving the report indicating whether the recommendations have been accepted and describing any action taken or proposed to implement them, or the reasons why the head refuses to take actions to implement them.

The Ombudsman shall notify the complainant of the head's response without delay and if the public body refuses to provide access to a requested record or part of a record or if the complainant is a third party notified under section 33 of a decision by the public body to give access, the Ombudsman shall inform the complainant of further steps. The Ombudsman must make recommendations made under this section available to the public. Recommendations will be posted on the Ombudsman's website (section 66).

If a public body does not act on a recommendation made by the Ombudsman in an access to information or privacy complaint, the Ombudsman may refer the matter to the Information and Privacy Adjudicator for review (section 66.1). The Adjudicator is an additional level of independent review and complaint resolution available to the Ombudsman. Like the Ombudsman, the Adjudicator is an Officer of the Legislative Assembly.

The matter referred by the Ombudsman to the Adjudicator may be any decision, act or failure to act by the public body relating to an individual's request for access, for correction, any decision to give access where a third party is notified under section 33, or if the Ombudsman considers that an individual's personal information has been collected, used or disclosed contrary to FIPPA (section 66.1).

Upon receiving a request for review from the Ombudsman, the Adjudicator must conduct a review of the matter and decide all questions of fact and law arising in the course of the review (section 66.3). Upon completing the review, the Adjudicator has the power to make various orders. These include requiring a public body to give the applicant access to the requested information, confirming the public body's access decision or requiring a public body to cease or modify a specified practice of collecting, using or disclosing personal information in contravention of FIPPA. The Adjudicator must make his orders available to the public (section 66.8).

The public body must comply with the Adjudicator's order within 30 days of being given a copy (or longer, if specified in the order) unless a person makes an application for judicial review. In that event, the Adjudicator's order will be stayed until the court deals with the application (section 66.9).

If the Ombudsman does not ask the Information and Privacy Adjudicator to review a matter relating to a public body's, refusal of access or if the complainant is a third party notified under section 33 of a decision by the public body to give access, the complainant may appeal the public body's decision to court (section 66(5)).

 

In addition to the Ombudsman's powers and duties respecting complaints, the Ombudsman has the following general powers and duties under section 49 of FIPPA:

• to conduct investigations and audits and make recommendations to monitor and ensure compliance with FIPPA;
  
  
• to inform the public about FIPPA and to receive comments from the public about the administration of the Act;
  
  
• to comment on the implications for access to information or for the protection of privacy of proposed legislative schemes or programs of public bodies;
  
  
• to comment on the implications for protection of privacy of using or disclosing personal information for record linkage or using information technology in the collection, storage, use or transfer of personal information;
  
  
• to bring to the attention of the head of a public body any failure to fulfil the duty to assist an applicant; and
  
  
• the Ombudsman submits an annual report to the Manitoba Legislature about the work of the office, complaints and investigations, compliance with the Ombudsman's recommendations, and any other matters about access to information and protection of privacy that the Ombudsman considers appropriate. The Ombudsman may also issue special reports in the public interest relating to any matter respecting FIPPA (section 58).

 

FIPPA sets out, in sections 67 to 74, the process for appealing to court. An appeal may only be filed by a person who has been refused access to a record or part of a record requested under subsection 8(1) or by a person who is a third party notified under section 33 of a decision of the public body to give access to the third party's information in a record.

There is no appeal to court respecting other access to information matters or a public body's collection, use or disclosure of personal information under FIPPA.

Before filing an appeal to court, the person must have made a complaint to the Ombudsman about refused access or must be a third party notified under section 33 of a decision by the public body to give access, the Ombudsman must have provided a concluding report about the investigation and the Ombudsman not asked the Information and Privacy Adjudicator to review the matter.

Where a person has a right to appeal a decision under FIPPA, an appeal may be made by filing an application with the Manitoba Court of Queen's Bench. An application for an appeal must be made within 30 days after a person has received the Ombudsman's report or within a longer period of time, which the Court may allow in special circumstances. The application for an appeal names the head of the public body as the respondent.

The Manitoba Court of Queen's Bench is required to consider an appeal under FIPPA as a new matter, meaning that the Court is not restricted to the evidence that was produced before the Ombudsman. The Court may dismiss an appeal if it determines that the public body was required or authorized to refuse access to a record. If the Court determines that the public body was not required or authorized to refuse access to a record, it may order the public body to give access to some or all of the information. The Court may also make other orders it considers appropriate. A decision of the Court on an appeal is final and binding and there is no appeal from this decision.