Privacy And Access Considerations When Contracting With Third Parties: The IPC Provides New Guidance To Public Sector Entities

The IPC has published a new guidance document specifically for public sector entities in Ontario that are subject to the Freedom of Information and Protection of Privacy Act (FIPPA) or the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), collectively "the Acts". The guidance sets out recommended best practices for institutions to address privacy and access obligations under the Acts when they enter into agreements with service providers.

Importantly, the guidance confirms at the outset that, "Regardless of who processes data on their behalf, Ontario's public institutions remain accountable for protecting privacy and providing a right of access to records and personal information under their control". With this premise in mind, the IPC provides a detailed checklist, divided into 5 parts, to provide institutions with the necessary support they need to negotiate and develop agreement terms that comply with Ontario's access and privacy laws.