Ontario's New Cyber Security Legislation Now In Force

Bottom Line

As we previously wrote about here, on May 13, 2024, the Ontario government introduced Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 (the "Act"). Now that it is law, this Act:

• Amends the Freedom of Information and Protection of Privacy Act ("FIPPA") to require public sector institutions to implement appropriate privacy impact assessments and mitigate any identified risks, and creates new obligations for public sector institutions in the event of a data breach. It also give the Information and Privacy Commissioner of Ontario ("IPC") new order-making powers.
• Enacts the Enhancing Digital Security and Trust Act, 2024, a new statute that applies to institutions subject to FIPPA and its municipal equivalent, the Municipal Freedom of Information and Protection of Privacy Act ("MFIPPA"). The Enhancing Digital Security and Trust Act, 2024 creates new regulatory frameworks for the Ontario public sector with