Standing committee on government operations report on the review of the 2023-2024 annual report of the northwest territories information and privacy commissioner
Introduction
The Standing Committee on Government Operations (Committee) has reviewed the 2023-2024 Annual Report of the Northwest Territories Information and Privacy Commissioner (Commissioner). The Committee thanks Mr. Andrew Fox, Information and Privacy Commissioner, for his appearance before Committee on September 12, 2024.
The Access to Information and Protection of Privacy Act (ATIPP) and the Health Information Act (HIA) require the Commissioner to prepare an annual report. The Speaker tables the report in the Legislative Assembly; once tabled, Committee reviews it.
The Commissioner's 2023-2024 report includes an assessment of the effectiveness of the Act, a report on the Office's activities, and recommendations for consideration by the Legislative Assembly. The Commissioner's work and recommendations are reflected in Committee's observations.
About The Information And Privacy Commissioner
The Information and Privacy Commissioner is a Statutory Officer of the Legislative Assembly. The Commissioner's primary functions involve:
- Receiving and reviewing complaints about breaches of privacy
- Receiving and reviewing complaints about the adequacy of public bodies' responses to access to information requests
- Reviewing Privacy Impact Assessments (PIAs), and
- Reviewing and commenting on proposed legislation regarding possible implications for privacy protection or access to government information
Observations
Access to Information and Protection of Privacy Act
The Commissioner made two recommendations in the annual report concerning the Access to Information and Protection of Privacy Act (ATIPPA). Additional details about each recommendation can be found in the 2023-2024 annual report:
1. That the government should consider amending ATIPPA to allow a public body to extend the time once for the period required to complete third-party consultation without authorization by the Commissioner. For subsequent extensions, public bodies should continue to seek authorization from the Commissioner.
2. That public bodies should review their legal obligations to respond to access to information requests and assess their capacity to provide timely responses within the legislated time periods. They should collectively or individually ensure that the Access and Privacy Office (APO) is adequately resourced to assist public bodies in consistently meeting legal time frames and complying with the associated procedural requirements.
Committee acknowledges and supports the Commissioner's recommendations concerning the Access to Information and Protection of Privacy Act. Therefore, Committee recommends that:
Recommendation 1: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide a timeframe for implementing the Information and Privacy Commissioner's two recommendations related to the Access to Information and Protection of Privacy Act.
Delay in Responding to Access Requests
During the September 12, 2024, public briefing, the Commissioner expressed concerns about the Government of the Northwest Territories (GNWT)'s struggles to meet the legislated timeframes in responding to information requests. The APO is responsible for accepting requests from individuals applying for access to information and correction of personal information. Once the APO receives a request, they work with the relevant public body to retrieve the required records. The Commissioner brought forward to Committee that they believe delays are resulting from the time needed to clarify requests from public bodies and the ongoing issue that the APO lacks resources needed for the timely response to access to information requests within the legislated periods. It was noted by the Commissioner that wording within legislation remains clear and that no specific legislative changes are needed at this time that would help reduce the APO's workload.
Open Government
In 2019, Bill 29: Act to Amend the Access to Information and Protection of Privacy Act (Act) updated Section 72 to obligate public bodies to identify the types of records without personal information and can, therefore, be made available to the public without the need for a formal access request under the Act.
In addition, the GNWT committed to increasing openness, transparency, and accountability by embracing the “Open Government” movement and publicly releasing the Open Government Policy.
The Open Government Policy outlines actions to advance the GNWT's commitment to the principles of Open Government in three key areas:
Open Information
Open Information is the proactive release of government-held information in accessible and user-friendly formats. The Proactive Disclosure Directive (Directive), signed in July 2023, outlines information categories and guides public bodies on maximizing information disclosure.
Committee believes that information and documents outlined in the Directive are not being released proactively by the GNWT (for example, Committee is unaware of internal audit and evaluation reports being disclosed). For these reasons, Committee is recommending that:
Recommendation 2: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide the date by which all information and documents identified in the Proactive Disclosure Directive will be released and updated.
Recommendation 3: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories review and update the Proactive Disclosure Directive to maximize the release of information. Furthermore, Committee requests a date by which this review will be completed.
Open Data
The Open Data Portal (opendata.gov.nt.ca) is designed to make government-held data, including datasets, facts, figures, and statistics, available to the public in accessible and user-friendly formats. As of October 16, 2024, the Portal includes 340 datasets. However, it remains unclear which information resources are to be open and released, what decision processes govern the release of open data, and what efforts departments have made to maximize data release.
Organization Total
Bureau of Statistics 290
Education, Culture and Employment 4
Environment and Climate Change 12
Executive and Indigenous Affairs 7
Finance 2
Health and Social Services 2
Industry, Tourism and Investment 2
Infrastructure 9
Justice 10
Municipal and Community Affairs 2
Total 340
Recommendation 4: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide:
1. A Directive on Open Government to maximize the release of government information and data of business value to support transparency, accountability, and citizen engagement.
2. Departmental Open Government Implementation Plans that outline departmental direction, strategies, and initiatives undertaken to meet the requirements of the Open Government Policy.
3. Inventories of all data and information resources of business value held by each department with determinations of eligibility and priority and the plan for effective release.
4. Periodic progress reports.
If these directives and guidelines do not yet exist, Committee requests a date by which they will be created and implemented.
Open Dialogue
Open Dialogue refers to the availability of a diverse range of engagement activities designed to facilitate meaningful participation of residents, communities, and organizations in government decision-making processes.
Committee recognizes the 2022 Public Engagement Employee Guide as a significant step toward establishing a unified approach in providing resources to support public engagement. Committee is eager in seeing the success of Open Dialogue and therefore recommends:
Recommendation 5: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide to Committee and publish all evaluation worksheets/reports from public engagement evaluation since the Public Engagement Employee Guide was released in July 2022.
Northwest Territories Health and Social Services Authority Privacy Breach Policy:
The current practice for health information custodians, such as the Northwest Territories Health and Social Services Authority (NTHSSA), is to delay notification of privacy breaches until a full investigation is completed, which often takes several months. This is inconsistent with the Health Information Act (HIA), which requires notice to be provided as soon as reasonably possible after a breach is confirmed. The delay in giving notice prevents individuals from taking timely action to protect their privacy. The Commissioner argues that notice should be given as soon as a privacy breach is confirmed rather than waiting for the full investigation to conclude, as this better aligns with the Health Information Act's intent. The Commissioner recommends in their 2023-2024 report:
• That the Health and Social Services Privacy Breach Policy should be amended to require notice to be given to the affected individual(s) and the Information and Privacy Commissioner as soon as reasonably possible once a privacy breach has been confirmed.
Committee recognizes the gap highlighted by the Commissioner between the NTHSSA policy and the HIA. Therefore, Committee is recommending the following:
Recommendation 6: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories work with the Northwest Territories Health and Social Services Authority to amend their Privacy Breach Policy to better align with the Health Information Act's intent.
Health Information Act
The Commissioner made seven recommendations in the annual report concerning the Health Information Act. Additional details about each recommendation can be found in the 2023-2024 annual report:
1. That the Department of Health and Social Services should consider implementing a policy, or the government should consider amending the Health Information Act, to require health information custodians to report to the Commissioner regarding the implementation of accepted recommendations.
2. That Health Information Custodians should continue to reduce or eliminate the use of fax machines to transmit personal health information.
3. That Health Information Custodians should use secure electronic transmission measures when transmitting personal health information. Privacy training for employees should include detailed instructions on using secure electronic measures.
4. That Health Information Custodians should prioritize implementation of, and compliance with, the Mandatory Training Policy and ensure that appropriate privacy training is provided for new employees, returning employees, and for all employees annually.
5. That the Legislative Assembly should consider amending the section amending section 87 of the Health Information Act to require a Health Information Custodian to give notice of a privacy breach within a specific time period. (Pg 19)
6. That Privacy Impact Assessments addressing any new information system or communication technology that involves the collection, use, or disclosure of personal health information should be completed and submitted so that there is a reasonable period for review by the Information and Privacy Commissioner and for any comments to be considered by the Health Information Custodian in the planning stages before implementation.
7. That the Legislative Assembly should consider amending Section 89 of the Health Information Act to include similar provisions regarding Privacy Impact Assessments as mandated in section 42.1 of ATIPP.
Committee acknowledges and supports the Commissioner's recommendations concerning the Health Information Act. Therefore, Committee is recommending the following:
Recommendation 7: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide a timeframe for implementing the Information and Privacy Commissioner's seven recommendations related to the Health Information Act.
Conclusion
This concludes the Standing Committee on Government Operations Report on the Review of the 2023-2024 Annual Report of the Northwest Territories Information and Privacy Commissioner.
Recommendation 8: The Standing Committee on Government Operations recommends that the Government of the Northwest Territories respond to the recommendations contained in this report within 120 days.
Reports on standing and special committees. Member from Frame Lake.