On June 11, 2025, the Government of Alberta issued Order in Council 196/2025, formally bringing into force the Access to Information Act (“ATI Act”) and the Protection of Privacy Act (“PPA”). With this proclamation, the long-standing Freedom of Information and Protection of Privacy Act has been repealed. 

Although the ATI Act and PPA were passed in December 2024, they did not come into force immediately as the Government continued drafting accompanying regulations. These have now been finalized and proclaimed: the Access to Information Act Regulations (Alta Reg 133/2025), and the Protection of Privacy Act Regulations (Alta Reg 132/2025) were enacted by Orders in Council on June 11, 2025. In addition, two Ministerial Orders (No. SA:028/2025 and TI: 002/2025) were issued on June 11, 2025 to provide further guidance and direction to public bodies.

Access to Information Act (Bill 34)

While the ATI Act preserves many of the familiar processes previously found under FOIP for submitting access to information requests [so long FOIP requests], it introduces several significant changes for public bodies, including municipalities, school boards, and provincial agencies, boards, and commissions:

• Discretion to Disregard Requests: Public bodies have been given new powers to disregard access to information requests;
• Revised Timelines: Timeframes for responding to requests are now measured in business days, and “reasonable” extensions may be permitted;
• Expanded Exceptions:  New categories of information are exempt from disclosure, including:
  • Workplace investigations;
  • Information harmful to economic interests; and
  • Background and factual materials supporting decision-making.
• Revised Duty to Assist and Fee Structure: Expanded description of the duty to assist and basis to charge additional fees to process a request under the Regulation (maximum amounts that can be charged remained unchanged).

The legislation also places new limitations on when access to information requests can be made. Notably, public bodies may no longer submit requests to one another, and they may now classify certain information as “publicly available,” thereby exempting it from access to information requests.

Protection of Privacy Act (Bill 33)

The PPA replaces Part 2 of the FOIP Act, setting out updated rules for how public bodies collect, use, disclose, retain, and safeguard personal information. Keeping up with new and emerging technologies, including issues that were never contemplated under the FOIP Act, The PPA also introduces several significant new obligations. 

Notable changes and additions introduced by The PPA include:

• Public bodies are required to give notice at the time of collection when personal information is to be used in an automated system, and can now rely on prior notice in some circumstances;
• There is now mandatory breach reporting for public bodies where an unauthorized use or disclosure of personal information (e.g. a privacy breach) has occurred where there is a real risk of significant harm;
• New provisions for data matching, data derived from personal information, and non-personal data that has been anonymized or de-identified;
• Public bodies are required to establish a Privacy Management Program within one year of the ATI Act coming into force (i.e. June 11, 2026); and
• Pubic bodies will also now be required to conduct Privacy Impact Assessments in certain circumstances.

Changes at the Office of the Information and Privacy Commissioner (OIPC)

The new legislative framework introduces mandated timelines for reviews and inquiries conducted by the OIPC. These processes must now be completed within 180 business days, with a possible extension of up to an additional 180 business days. 

Both Acts introduce a lower threshold for offences and higher maximum fines for non-compliance, reinforcing the seriousness of these obligations. 

Brownlee LLP’s Access to Information and Privacy Law team is here to help.

Brownlee LLP’s Access to Information and Privacy Law team is available to assist public bodies in understanding and implementing the new legislative requirements.

Our Access to Information and Privacy Law team can assist with:

• Responding to access to information requests;
• Exercising discretion to disregard frivolous or excessive requests;
• Establishing Privacy Management Programs and conducting PIA's;
• Assisting with breach reporting and compliance; and
• Representing public bodies in OIPC reviews, complaints, and inquiries.

Privacy and Access to Information Training Sessions - Coming Soon

We will be offering training sessions in the near future tailored to heads of public bodies, privacy officers, and administrative leaders to ensure they are adequately familiarized with the new legislation. In-house training sessions for staff, councils and boards will also be made available and tailored to your needs.

Interested in Training?

Our training sessions on Alberta’s new access and privacy legislation are coming soon.
Click here to sign up and we’ll let you know as soon as registration opens.

Have questions in the meantime? Feel free to contact Lorne Randa, Practice Group Leader – Access to Information and Privacy Law, with any questions.