Thank you, Mr. Speaker. Mr. Speaker, your Standing Committee on Government Operations is pleased to provide its Report on the Review of the 2024-2025 Annual Report of the Northwest Territories Information and Privacy Commissioner and commends it to the House.
Mr. Speaker, I move, seconded by the Member for Great Slave that committee report 30- -- oh, I need to read the report. Sorry, Mr. Speaker; I'm getting ahead of myself here.
Okay, thank you, Mr. Speaker. This is the Standing Committee on Government Operations Report on the Review of the 2024-2025 Annual Report of the Northwest Territories Information and Privacy Commissioner.
INTRODUCTION:
The Standing Committee on Government Operations (referred to as committee in this report) has reviewed the 2024-2025 Annual Report of the Northwest Territories Information and Privacy Commissioner.
The committee thanks Mr. Andrew Fox, the fCommissioner, and Assistant Commissioner, Ms. Megan Holsapple, for their appearance before committee on September 12, 2025.
The Access to Information and Protection of Privacy Act and the Health Information Act require the Commissioner to prepare an annual report. The Speaker tables the report in the Legislative Assembly; once tabled, committee reviews it.
The Commissioner's 2024-2025 Report includes an assessment of the effectiveness of the ATIPPA and the HIA, a report on the office's activities and recommendations for consideration by the Legislative Assembly. The Commissioner's work and recommendations are reflected in committee's observations.
The Legislative Assembly appointed the Commissioner to be an independent officer to provide accountability about information and privacy in the Government of the Northwest Territories. The committee is concerned that many of the Commissioner's recommendations from previous annual reports have gone unaddressed by government. Committee urges the government to address the recommendations and, in doing so, acknowledge that government has a responsibility to ensure sufficient capacity to meet the legal obligations established in the Access to Information and Protection of Privacy Act.
The Information and Privacy Commissioner is a Statutory Officer of the Legislative Assembly. The Commissioner's primary functions involve:
- Receiving and reviewing complaints about breaches of privacy;
- Receiving and reviewing complaints about the adequacy of public bodies' responses to access to information requests;
- Reviewing Privacy Impact Assessments; and
- Reviewing and commenting on proposed legislation regarding possible implications for privacy protection or access to government information.
OBSERVATIONS OF COMMITTEE
Time Extensions
In appearing before committee, the Commissioner emphasized that consultation is necessary where third party personal information may be disclosed in a response to an access to information request. This requires 55 business days to complete, which is only available if an extension is authorized by the Commissioner. The Commissioner highlighted that, most often, there is no basis for his office to deny an authorization as it is essentially a 'rubber stamp'. This change would allow the public body to follow the law and complete third party consultation efficiently without needing to cease work to request a time extension from the Commissioner. Committee believes that legislative amendments that remove unnecessary steps and ultimately support the efficient use of the Commissioner's and staff's time in the information request process should be viewed as beneficial to the public.
The Commissioner made one recommendation in the annual report concerning the Access to Information and Protection of Privacy Act. Additional details about the recommendation can be found in the 2024-2025 annual report. The Commissioner recommended:
- The government should consider amending Access to Information and Protection of Privacy Act to allow a public body to extend the time once for the period required to complete third party consultation without authorization by the Commissioner. For subsequent extensions, public bodies should continue to seek authorization from the Commissioner.
Committee acknowledges and supports the Commissioner's recommendations concerning the Act. The Act mandates regular reviews to ensure efficiency, understanding, and compliance. A review of the Act is currently underway by government, and the Commissioner has been invited to participate in engagement. Therefore, committee provides the following:
Recommendation 1:
The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide a timeframe for implementing the Information and Privacy Commissioner's recommendation related to the Access to Information and Protection of Privacy Act.
Delay in Responding to Access Requests - Resourcing Public Bodies.
In their public briefing before committee, the Commissioner reiterated continued concerns regarding government's struggles to meet legislated timeframes for responding to information requests. Committee is concerned that in 2024-2025, the GNWT's central Access and Privacy Office failed to respond within the timelines approximately 60 percent of the time, an increase from 50 percent in 2022.
Committee understands that delays are the result of insufficient resources. It is difficult to properly implement the Act without adequate positions, dedicated and ongoing training, effective record management systems, and strong leadership committed to transparency. Without these crucial supports, access requests can be problematic and cause a significant drain on the public body's resources, leading to delays.
The APO is responsible for accepting requests from individuals applying for access to information and correction of personal information. The APO provides expertise and support to GNWT departments in order to process requests. Committee notes that although the Office of the Information and Privacy Commissioner is sufficiently funded, the APO and the public bodies undertaking the work to process information requests are not. The APO received funding for two full-time positions until March 2026, amounting to a capacity increase of 40 percent. Committee is hopeful that this will assist in addressing ongoing capacity issues.
However, departments are legally required to make every reasonable effort to assist an applicant and respond openly, accurately, completely, and without delay. Processing an information request involves departmental staff gathering responsive records and undertaking detailed assessments to ensure lawful disclosures. Fulfilling complex Act legal obligations within the required timeframes requires permanently funded positions. Committee understands that the growing complexity and demands of information requests often means that employees are fulfilling their ATIPP role at the expense of their other work on behalf of the public. Committee is concerned that public bodies have not been resourced to meet the legal obligations of the Act.
Records Management and Security Tools
The Commissioner notes that record management and security tools are available but underused amongst public bodies for the purpose of fulfilling access to information requests. The Act is over 30 years old and predates the regular use of email, text messages, and modern electronic systems. Modern tools have the effect of record proliferation, resulting in more records to collect and review through an information request. The use of appropriate record management systems, supplemented by clear rules for proper records storage, will help to address the current pressure on the public body's resources.
Training
The Act is complex and expertise must be applied in its implementation, including the treatment of records, application of mandatory and discretionary exemptions, consideration of presumptions, and undertaking third party consultation. Ongoing training is required to assist GNWT employees to advance their Act knowledge and skills and would result in more efficient and effective processing of ATIPP requests.
Transparency and Public Accountability
Committee understands that some departments are more culturally open to sharing information than others. Inconsistent approaches across government can lead to public mistrust and the proliferation of access requests, ultimately exacerbating the existing resource challenges across government. Committee believes there is value in government increasing its awareness across departments on the underlying purpose and application of the legislation. Once public bodies have a common understanding of the legislation, improved transparency and public accountability can be realized. Committee puts forward the following:
Recommendation 2:
The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide a timeframe for increasing dedicated resources, including dedicated positions in public bodies, staff training, and implementation of record management systems, in order to ensure that necessary supports are in place to implement the Access to Information and Protection of Privacy Act.
Proactive Disclosure
There is a broad requirement for public bodies to publish information so that it is accessible to members of the public without going through the formal ATIPP process. Section 72 of the Act requires public bodies to establish and publish categories of records that do not contain personal information and that can be made available without a formal request for access. Section 71 requires public bodies to make certain types of manuals, instructions, guidelines, rules and policy statements available without a formal access request. Section 5.1 directs public bodies to disclose information where there is a risk of significant harm to the environment or to the health or safety of the public.
As most information is now created and stored electronically, this should not be an onerous task for public bodies. Some public bodies are more proactive in publishing information than others. Committee understands that bureaucratic enthusiasm for transparency is an issue across government. Given the efficiencies of making information easily available, and given their legal status, committee encourages all public bodies to devote sufficient resources to fulfilling the requirements of these sections.
The Open Government Policy maintains as one of its principles that "government data, information, and decision-making should be accessible in a way that is responsive to the needs and expectations of NWT residents." Therefore, standing committee puts forward the following:
Recommendation 3:
The Standing Committee on Government Operations recommends that the Government of the Northwest Territories review and update the Proactive Disclosure Directive to maximize the proactive release of information based on categories of information that are most frequently sought through ATIPP requests. Furthermore, committee requests a date by which this review will be completed.
Access to Information and Protection of Privacy Act Health Information Act
Incidence of Privacy Breaches
Mr. Speaker, in 2024-2025, the number of new Health Information Act privacy breach files increased significantly from 78 to 180. A strong culture of privacy awareness and sensitivity is essential. The Department of Health and Social Services created its Mandatory Training Policy in 2017. The purpose of this policy is to ensure employees are trained to prevent breaches and to respond to breaches appropriately. However, breaches still arise involving employees who have not received privacy training. Adequate employee training requires dedicated resources and ongoing support from leadership and management.
"Snooping"
Committee believes that a balance must be struck between the administrative burden placed on the healthcare system and the protection of individuals' personal information. The collection, use, or disclosure of personal health information without the consent of individuals and for purposes that are not permitted or required by law is commonly referred to as "snooping." Despite its alarming nature, committee understands snooping cases to be relatively rare in the NWT. Committee believes that the solution rests with regular auditing of the electronic medical records system followed by appropriate human resource disciplinary action. To ensure that government works to prevent the rise in snooping, committee puts forward the following:
Recommendation 4:
The Department of Health and Social Services and the Department of Finance develop a policy to communicate and implement clear expectations, rules and repercussions to employees for "snooping" of private medical information, to report to the Commissioner regarding the implementation of accepted recommendations.
Review Reports
Subparagraph 173(b) of the Health Information Act requires the Commissioner to report on any recommendations that were made in a report to a health information custodian that were not accepted. Committee is pleased that all recommendations in the 15 reviews undertaken by the Commissioner in 2024-2025 were accepted
Implementing Recommendations in a Review Report - Oversight
Mr. Speaker, the Commissioner has noted that they do not have any authority to conduct oversight of the implementation of an accepted recommendation nor is the Commissioner considered a custodian legally obligated to report on the implementation of any acceptation recommendations. In comparison, the Act section 49.14 creates such an obligation. Committee believes it would be helpful to have a statutory reporting process on the implementation of recommendations.
The Commissioner made five recommendations in the annual report concerning the Health Information Act. Additional details about each recommendation can be found in the 2024-2025 annual report:
- The Department of Health and Social Services should consider implementing a policy, or the Legislative Assembly should consider amending the Health Information Act, to require health information custodians to report to the Commissioner regarding the implementation of accepted recommendations.
- Health information custodians should continue to reduce or eliminate the use of fax machines to transmit personal health information. And with your indulgence, Mr. Speaker, I would like to emphasize this point.
- Health information custodians should prioritize implementation of, and compliance with, the Mandatory Training Policy and ensure that appropriate privacy training is provided for new employees, returning employees, and for all employees annually.
- Privacy Impact Assessments addressing any new information system or communication technology that involves the collection, use or disclosure of personal health information should be completed and submitted so that there is a reasonable period for review by the Information and Privacy Commissioner and for review of any comments by the health information custodian while the project or program is still in the planning stage.
- The Legislative Assembly should consider amending section 89 of the Health Information Act to include similar provisions regarding Privacy Impact Assessments as mandated in section 42.1 of the Access to Information and Protection of Privacy Act.
The committee acknowledges and supports the Commissioner's recommendations concerning the Health Information Act. The GNWT is currently conducting a 10-year statutory review of the Health Information Act; as such, committee views these recommendations as important for government to now address. Therefore, committee is recommending the following:
Recommendation 5:
The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide a timeframe for implementing the Information and Privacy Commissioner's five recommendations related to the Health Information Act.
CONCLUSION
This concludes the Standing Committee on Government Operations Report on the Review of the 2024-2025 Annual Report of the Northwest Territories Information and Privacy Commissioner.
Recommendation 6:
The Standing Committee on Government Operations recommends that the Government of the Northwest Territories respond to the recommendations contained in this report within 120 days.