The COVID-19 pandemic has forced public institutions to either slow down or completely stop releasing materials in response to access and freedom of information requests. Some privacy professionals are responsible for responding to FOI requests, and it is helpful to know how jurisdictions across Canada are reacting to these changes.  

At the federal level, the Office of Privacy Commissioner of Canada has recognized that institutions may not be able to meet regular response times regarding FOI requests. Under the Privacy Act, federal agencies are required to respond to requests within 30 days. In response to the pandemic, the OPC recently adopted a “flexible and contextual approach in its application of the law.” It is unclear what this flexibility entails, though several provincial privacy commissioners have expanded on this for their information release practices.

For more information on COVID-19 read "Infographic: IAPP Resources for COVID-19"

and

"Sharing COVID-19 data with government authorities: Guidance from DPAs," by IAPP Senior Fellow Müge Fazlioglu, CIPP/E, CIPP/US

Amendments to legislation

In British Columbia, Information and Privacy Commissioner Michael McEvoy has allowed for a 30-day extension for public bodies to respond to access requests on the basis that COVID-19 constitutes a public health crisis. Alberta followed suit by allowing for temporary changes to the province’s Freedom of Information and Protection of Privacy Act, notably, allowing public institutions 90 days to reply to an access request instead of 30 days. It allowed a further extension of 60 days (up from 30 days) without the commissioner’s authorization, if the public body feels that COVID-19 is unreasonably interfering with operations.

How are FOI appeals going to be handled?

Not all jurisdictions have been so thorough in providing guidance to institutions that process FOI requests. In Ontario, the Information and Privacy Commission indicated that the province’s access laws remain in effect. However, they also acknowledge that these are exceptional circumstances and there is an understanding that many organizations will be unable to meet the initial 30-day response requirements. Still, there are no clear indications as to what the consequences are for institutions that are unable to meet response deadline requirements; the IPC has only stated they will consider the circumstances surrounding COVID-19 when evaluating appeals relating to deemed refusals.

Other jurisdictions have explicitly acknowledged the challenges they face in completing FOI requests. These challenges range from technological, to staffing and access issues relating to existing records. Institutions that use privacy professionals need greater certainty that their actions during a crisis do not have broader negative consequences. If staff is unable to access records, process requests, or send and receive materials, these are valid considerations for any provincial or federal privacy authority that has to decide what to do when an institution is unable to meet its statutory obligations.

Without clear instructions on timeline and expectations for what materials should be released and when, privacy professionals are challenged on two fronts when it comes to responding to access requests. Some jurisdictions acknowledge the restrictions the COVID-19 pandemic places on the normal functioning of public institutions, while still insisting on delivery of FOI materials within legislated timeframes. What should institutions do in light of this uncertainty around the consequences for breaching legislated requirements? Is it safe to be in breach of legislative requirements due to the unprecedented nature of the COVID-19 pandemic?

Answers to these questions depend on when COVID-19 related restrictions are lifted

More time is needed to understand what the fall out will be from an institution’s inability to respond to an FOI request during this time. We have yet to learn how commissioners across the country will react to delays and what the public will tolerate in terms of delays in the release of information.

It is unknown how long COVID-19 will continue to impact the way people live and work. Governments need to be able to respond to public requests, and a public health crisis should not provide justification for withholding public records or limiting government transparency.

In the short term, however, better guidance on what organizations can do to continue processing requests on time would be helpful. By providing institutions with more information on response timelines and clearer indications of what happens for failing to respond on time, public institutions can be more certain that they are taking the right approach in how they respond to FOI requests. The public has a right to know how its government is operating and, in particular, while in crisis. Privacy professionals need the tools to give them that information, as well.

Photo by Zia Syed on Unsplash