Table of Contents 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62

Guide to LA FOIP-Chapter 2

GUIDE TO LA FOIP The Local Authority Freedom of Information and Protection of Privacy Act Chapter 2 Administration of LA FOIP

Table of Contents Overview.......................................................................................................................................................................1 Minister of Justice and Attorney General – Roles & Responsibilities....................................................2 Ministry of Justice and Attorney General.....................................................................................................2 Local Authorities – Roles & Responsibilities...................................................................................................3 Head of a Local Authority ..................................................................................................................................5 The LA FOIP Coordinator or Privacy Officer ...............................................................................................7 Section 50: Delegation........................................................................................................................................9 Notices Required by LA FOIP ........................................................................................................................ 11 Routine Disclosure & Active Dissemination ............................................................................................ 14 Proactive Reporting of Privacy Breaches .................................................................................................. 15 Information & Privacy Commissioner - Roles & Responsibilities........................................................ 17 Section 38: Appointment ................................................................................................................................ 18 Procedural Fairness ........................................................................................................................................... 19 Section 32: Privacy Powers ............................................................................................................................. 21 Section 39: Review or Refusal to Review................................................................................................... 23 Section 42: Conduct of Review ..................................................................................................................... 24 Section 43: Powers of Commissioner ......................................................................................................... 25 Section 43.1: Power to Authorize a Local Authority to Disregard Applications or Requests 26 Section 44: Report of Commissioner .......................................................................................................... 28 Section 45 (FOIP): General Powers of Commissioner........................................................................... 29 Section 46 (FOIP): Confidentiality ................................................................................................................ 31 Section 47 (FOIP): Non-compellability....................................................................................................... 34 Section 48: Certain Provisions Adopted.................................................................................................... 35 Section 52: Annual Report .............................................................................................................................. 35 Court of King’s Bench - Roles & Responsibilities ...................................................................................... 36 Section 46: Appeal to Court........................................................................................................................... 36 Section 47: Powers of Court on Appeal..................................................................................................... 38 Section 51: Burden of Proof ............................................................................................................................... 43 Standard Required to Meet Burden of Proof .......................................................................................... 43

Who has the Burden of Proof........................................................................................................................ 46 Affidavit Evidence .............................................................................................................................................. 48 Offences & Penalties............................................................................................................................................. 49 Section 54: Proceedings Prohibited............................................................................................................ 49 Section 55: Immunity from Prosecution.................................................................................................... 50 Section 56: Summary Offences ..................................................................................................................... 51 Privacy and Access Offences............................................................................................................... 54 Not Cooperating with the Commissioner...................................................................................... 55 Section 66(3) (FOIP): Proceedings Prohibited ......................................................................................... 57

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 1 OVERVIEW This Chapter explains the administration of The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP). This includes the roles and responsibilities of various bodies including the Ministry of Justice, local authorities and the Information and Privacy Commissioner. What follows is non-binding guidance. Every matter should be considered on a case-by-case basis. This guidance is not intended to be an exhaustive authority on the interpretation of these provisions. Local authorities may wish to seek legal advice when deciding on how to interpret the Act. Local authorities should keep section 51 of LA FOIP in mind. Section 51 places the burden of proof for establishing that access to a record may or must be refused on the local authority. For more on the burden of proof, see Section 51: Burden of Proof later in this Chapter. This is a guide. The tests, criteria and interpretations established in this Chapter reflect the precedents set by the current and/or former Information and Privacy Commissioners in Saskatchewan through the issuing of Review Reports. Court decisions from Saskatchewan affecting The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) will be followed. Where this office has not previously considered a section of LA FOIP, the Commissioner looked to other jurisdictions for guidance. This includes other Information and Privacy Commissioners’ Orders, Reports and/or other relevant resources. In addition, court decisions from across the country are relied upon where appropriate. This Chapter will be updated regularly to reflect any changes in precedent. This office will update the footer to reflect the last update. Using the electronic version directly from our website will ensure you are always using the most current version.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 2 MINISTER OF JUSTICE AND ATTORNEY GENERAL – ROLES & RESPONSIBILITIES The Lieutenant Governor of Saskatchewan designates the Minister responsible for the administration of The Local Authority Freedom of Information and Protection of Privacy Act (LA FOIP) by Order in Council. This responsibility has been given to the Minister of Justice and Attorney General. While the nature of LA FOIP requires that decisions with respect to access to records and the management of personal information be made within each local authority, the Minister of Justice and Attorney General retains overall responsibility for its administration.1 Ministry of Justice and Attorney General On an ongoing basis, the Ministry of Justice and Attorney General provides direction and support to local authorities as it relates to LA FOIP. The Ministry of Justice and Attorney General: • Provides legal advice to government institutions. • Plays a leadership role on access and privacy issues, including the collection of statistical information related to access to information requests and the preparation of the annual report. • Prepares and maintains access and privacy tools, such as guidelines, checklists and administrative procedures. • Provides and supports training and awareness regarding access and privacy. • Through its website, provides information to the public, government institutions and local authorities to help with understanding both the access to information and the privacy components of the legislation.2 1 Ministry of Justice, Annual Report 2001-2002, The Freedom of Information and Protection of Privacy Act at p. 4. 2 Ministry of Justice and Attorney General, The Freedom of Information and Protection of Privacy Act, Annual Report 2021-22, at p. 5.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 3 LOCAL AUTHORITIES – ROLES & RESPONSIBILITIES Interpretation 2 In this Act: … (f) “local authority” means: (i) a municipality; (ii) Repealed. 2002, c.C-11.1, s.389. (iii) Repealed. 2002, c.C-11.1, s.389. (iv) a committee of a council of a municipality; (v) any board, commission or other body that: (A) is appointed pursuant to The Cities Act, The Municipalities Act or The Northern Municipalities Act, 2010; and (B) is prescribed; (vi) the board of a public library within the meaning of The Public Libraries Act, 1984; (vii) the Northern Library Office established pursuant to The Public Libraries Act, 1984; (viii) any board of education or conseil scolaire within the meaning of The Education Act; (viii.1) a police service or regional police service as defined in The Police Act, 1990; (ix) a regional college within the meaning of The Regional Colleges Act, other than the Saskatchewan Indian Community College; (x) the Saskatchewan Polytechnic; (xi) the University of Saskatchewan, including Saint Thomas More College; (xii) the University of Regina, including: (A) Campion College; and (B) Luther College with respect to its post-secondary level activities; (xiii) the provincial health authority or an affiliate, as defined in The Provincial Health Authority Act; (xiv) Repealed. 2002, c.R-8.2, s.83. (xv) Repealed. 2002, c.R-8.2, s.120. (xvi) Repealed. 2002, c.R-8.2, s.83.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 4 (xvii) any board, commission or other body that: (A) receives more than 50% of its annual budget from the Government of Saskatchewan or a government institution; and (B) is prescribed; LA FOIP applies to all “local authorities” as defined by subsection 2(f) of LA FOIP. This includes Boards, Commissions and other bodies prescribed as local authorities in the Appendix, Parts I and II of The Local Authority Freedom of Information and Protection of Privacy Regulations. See the Guide to LA FOIP, Chapter 1, “Purposes and Scope of LA FOIP” for more on the definition of a local authority. A local authority that is subject to LA FOIP has statutory duties with regards to providing access to information and protection of personal information in its possession or control. The head of a particular local authority may claim that the local authority is not covered by LA FOIP3 and consequently refuses a request for information on that basis. Such a refusal will likely be subject to review, at the request of the applicant, in the same way as a refusal based on a disclosure exemption. The applicability of LA FOIP to a particular organization may be resolved in this manner or through ultimate resort by the courts.4 IPC Findings In Investigation Report 074-2018, 075-2018, the Commissioner considered an alleged breach of privacy involving the Town of Rocanville, the Rural Municipality of Rocanville No. 151, the Rocanville Parks and Recreation Board, the Rocanville Economic Development Organization and the Potash Corp Rocanville Community Hall Committee. Part of the Commissioner’s investigation involved first determining which bodies constituted local authorities under LA FOIP. The Commissioner found that the Town of Rocanville and the Rural Municipality of Rocanville No. 151 were local authorities pursuant to subsection 2(f)(i) of LA FOIP. Further, the Commissioner found that the Rocanville Economic Development Organization constituted a local authority pursuant to subsection 2(f)(v) of LA FOIP because the Town established it via bylaw pursuant to section 8 of The Municipalities Act. Subsection 2(f)(v)(B) of LA FOIP and the Appendix, Part I of The Local Authority Freedom of Information and 3 Local authorities should consider the definition of a “local authority” at subsection 2(f) of LA FOIP and the Appendix, Parts I and II, of the LA FOIP Regulations for additional prescribed “local authorities”. 4 Adapted from McNairn and Woodbury, Government Information: Access and Privacy, (2009), Carswell: Toronto at p. 2-7.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 5 Protection of Privacy Regulations provides that boards established pursuant to The Municipalities Act qualify as local authorities. Finally, the Commissioner found that the Potash Corp Rocanville Community Hall Committee was a committee of the Rocanville Parks and Recreation Board via bylaw and it did not fit under the definition of a local authority at subsection 2(f) of LA FOIP. As such, the Commissioner found that it was not a stand-alone local authority but rather a committee within a local authority, that being the Rocanville Parks and Recreation Board. Head of a Local Authority Interpretation 2 In this Act: … (e) “head” means: (i) in the case of a municipality, the mayor, reeve or chairperson of the local authority committee, as the case may be; (i.1) in the case of a police service, the chief as defined in The Police Act, 1990; or (ii) in the case of any other local authority (A) the chairperson of the governing body of the local authority; or (B) the individual designated as the head by the governing body of the local authority; The head of each local authority is responsible for all decisions made under LA FOIP that relate to that local authority. It would be difficult and perhaps ineffective to have an entire local authority accountable. Therefore, accountability rests with the “head” of the local authority. Subsection 2(e) of LA FOIP defines the “head” of a local authority. The head is generally the mayor, reeve, chairperson of the local authority committee, chief of police or chairperson of the governing body of the local authority. The head of a local authority can delegate some or all of the responsibilities to another individual. Such delegation should be done in compliance with section 50 of LA FOIP. For more on delegation, see Section 50: Delegation, later in this Chapter.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 6 IPC Findings In Review Report LA-2012-003, the Commissioner reviewed a denial of access involving the Village of Buena Vista (Village). The applicant was the Mayor of the Village. The Mayor was also the designated head with responsibility under LA FOIP. However, the elected Council and Village Administrator did not agree and did not recognize this designation. In addition, the elected Council and Village Administrator refused to provide the Mayor access to the requested records. The Commissioner found that the Mayor was the designated head of the local authority and recommended the Mayor be given access to records. In Review Report LA-2010-002, the Commissioner dealt with a request for access to a report resulting from a harassment investigation. In that report at footnote [3], the Commissioner noted that although the City Clerk had referred to herself as the “head” in correspondence this was inaccurate. The Mayor of Saskatoon had delegated to the City Clerk his rights and powers under LA FOIP pursuant to section 50 of LA FOIP. However, the delegation did not change the status of the Mayor as the “head”. Further, the Commissioner noted that the City Clerk was for purposes of LA FOIP, in the role of the LA FOIP Coordinator. In Review Report LA-2013-004, the Commissioner clarified for the Northern Village of Pinehouse, that the designation of the Mayor as “head” is a statutory provision designed to ensure accountability to the public. The Mayor had no power to designate someone else as the head, although the Mayor was permitted to delegate some or all of the duties to another by reason of section 50 of LA FOIP.5 In Review Report LA-2014-001, the Commissioner recommended to the Village of Killaly that, within 15 days of the Commissioner’s report, it clarify whether the Mayor would retain responsibility for LA FOIP or if some or all responsibility would be formally delegated to other officers of the Village pursuant to section 50. The Commissioner also noted that it appeared that the Village was laboring under the misapprehension that it was the Village Council that was vested with responsibility for LA FOIP compliance. The Commissioner clarified that it was the Mayor who was the designated “head” for all purposes of LA FOIP unless there was evidence of a section 50 delegation. In Review Report 143-2017, the Commissioner considered whether the Reeve was the head of the Rural Municipality of Blaine Lake #434 for purposes of LA FOIP. The Reeve had argued that according to The Municipalities Act, the Reeve did not have any authority or power to provide written notice to the applicant under LA FOIP. The Reeve indicated that he only 5 Office of the Saskatchewan Information and Privacy Commissioner (SK OIPC) Review Report LA-2013004 at [25].

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 7 represented council and decisions made by council. The Commissioner found that subsection 93(1)(b) of The Municipalities Act reinforced that the Reeve must meet his duties under LA FOIP. Finally, that the powers and duties are vested in the head under LA FOIP, not council. The powers and duties are the head’s responsibilities until he or she delegates them pursuant to section 50 of LA FOIP. The LA FOIP Coordinator or Privacy Officer Probably the most important person in managing access and privacy issues in any local authority is the designated LA FOIP Coordinator or Privacy Officer. The LA FOIP Coordinator may have different titles such as Access Coordinator. It is also possible the title does not appear to relate to access and privacy, yet the individual also carries these duties. For example, the local authority’s Administrator. The roles of the LA FOIP Coordinator and Privacy Officer might be combined and handled by one individual in the organization, or the roles might be separated and handled by two. The duties and roles of each in an organization are very different but also very interrelated. LA FOIP places responsibility on the “head” of the local authority. The head may delegate some or all of those powers to someone else, in the organization, such as the LA FOIP Coordinator or Privacy Officer, pursuant to section 50 of LA FOIP. The LA FOIP Coordinator or Privacy Officer is responsible for the overall management of access to information and protection of personal information within the organization.6 So, what exactly does an LA FOIP Coordinator or Privacy Officer do? LA FOIP Coordinators and Privacy Officers assist departments to meet their statutory responsibilities, promoting open government and fostering “an organizational culture” that advances four fundamental principles: 1. Information (general records should be available to the public). 2. Individuals should have access to their own personal information. 3. Exemptions to access should be limited and specific. 6 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 2, p. 24.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 8 4. Institutions should protect the privacy of individuals with respect to their personal information.7 An LA FOIP Coordinator or Privacy Officer should: • Respond to access requests and privacy complaints. • Raise awareness of access and privacy issues on a regular and proactive basis within their organization. • Be aware of operations of the organization, the types of records and recordmanagement systems in the department. • Quickly identify what units within the department are likely to have the records responsive to an access request and which employees should be consulted. • Be senior enough to be able to provide access and privacy advice to the Mayor or head of the organization on a regular basis. • Monitor decisions and recommendations of the IPC and ensure those decisions are integrated into the orientation and in-service training of staff in the department. • Be involved in the design of new programs that may impact access or privacy rights; • Provide timely advice to the department to ensure that LA FOIP will be complied with. • Improve general awareness about the legislation through training sessions and materials within the department. In large organizations, newsletters, notices, FAQs, or a column in an intradepartmental bulletin may be helpful. The LA FOIP Coordinator or Privacy Officer may undertake internal audits to identify areas where more work is required to ensure full compliance.8 LA FOIP Coordinators and Privacy Officers may meet from time to time to discuss common problems or share knowledge and experience. 7 SK OIPC, FOIP FOLIO, January 2004 at p. 3. 8 SK OIPC, FOIP FOLIO, January 2004 at p. 3-4.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 9 Section 50: Delegation Delegation 50(1) A head may delegate to one or more officers or employees of the local authority a power granted to the head or a duty vested in the head. (2) A delegation pursuant to subsection (1): (a) is to be in writing; and (b) may contain any limitations, restrictions, conditions or requirements that the head considers necessary. Delegation means entrusting someone else to act in one’s place.9 Only the head of a local authority has the power to delegate some or all of the head’s powers under LA FOIP to one or more officers or employees of the local authority. The delegation should: • Be in writing. • Contain any limitations, restrictions, conditions, or requirements the head considers necessary. The head, for purposes of LA FOIP, includes the mayor, reeve or chairman of the local advisory committee or the chairperson of the governing body or the individual designated as the head by the governing body of the local authority.10 Here are some important things regarding a delegation: • The delegation should identify the position, not the individual, to which the powers are delegated. When delegation is to the position, a new delegation is not required when a new appointee assumes the position. • The delegation can cover a wide variety of duties, powers, and functions. • It remains in effect until replaced by an updated version. 9 British Columbia Government Services, FOIPPA Policy Definitions at https://www2.gov.bc.ca/gov/content/governments/services-for-government/policiesprocedures/foippa-manual/policy-definitions. Accessed April 23, 2020. 10 The Local Authority Freedom of Information and Protection of Privacy Act, SS 1990-91, c L-27.1 at s. 2(e).

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 10 • It is important to review the delegation periodically for any changes that may be needed, especially if the local authority is restructured or a new head is elected. • The delegation should specifically refer to handling access to information requests including the processing of requests and the power to make decisions whether or not to disclose all or part of a record. • A delegation relating to the handling of privacy can be more general and center on the delegated responsibility for collection, handling, and protection of personal information. • Delegated authority empowers certain officials and employees to make decisions or act. • In general, delegation should be considered for all provisions of LA FOIP that state that the head may or must do something.11 • The person delegating the authority remains responsible and accountable for all actions and decisions made under that delegation.12 The LA FOIP Coordinator or Privacy Officer normally prepares the delegation instrument and submits it to the head for approval.13 It is important that all delegated officers or employees know and understand their delegated responsibilities. It is also important that others in the organization understand that only those with delegated responsibilities under LA FOIP should be carrying out those duties and functions.14 If the individual with delegated authority does not actually make the decisions that they were delegated to make, the delegation is not being properly exercised.15 In other words, in order to be a true delegation, the individual needs to actually be given the authority to make the decisions as per the delegation. As noted earlier, the head of a local authority may delegate some or all of the head’s powers under LA FOIP. Even with a delegation, the head may retain certain powers and make certain decisions. 11 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 2, p. 27. 12 “Delegate” British Columbia Government Services, FOIPPA Policy Definitions at https://www2.gov.bc.ca/gov/content/governments/services-for-government/policiesprocedures/foippa-manual/policy-definitions. Accessed April 23, 2020. 13 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 2, p. 27. 14 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 2, p. 28. 15 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 2, p. 29.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 11 IPC Findings In Review Report LA-2013-004, the Commissioner clarified for the Northern Village of Pinehouse, that the designation of the Mayor as “head” is a statutory provision designed to ensure accountability to the public. The Mayor had power to designate someone else as the head, although the Mayor was permitted to delegate some or all of the duties to another by reason of section 50 of LA FOIP.16 In Review Report LA-2014-001, the Commissioner recommended to the Village of Killaly that, within 15 days of the Commissioner’s report, it clarify whether the Mayor would retain responsibility for LA FOIP or if some or all responsibility would be formally delegated to other officers of the Village pursuant to section 50. The Commissioner also noted that it appeared that the Village was laboring under the misapprehension that it was the Village Council that was vested with responsibility for LA FOIP compliance. The Commissioner clarified that it was the Mayor who was the designated “head” for all purposes of LA FOIP unless there was evidence of a section 50 delegation. Notices Required by LA FOIP LA FOIP contains requirements for giving various types of notices to persons. For example, section 7 of LA FOIP provides that the head shall give written notice of its decision regarding access to an applicant within 30 days after an application is made. The following are notices required to be provided by local authorities. This list does not include other obligations to inform: • Section 7 notice of the head’s decision regarding access is to be provided to an applicant within 30 days after an application is received by a local authority. • Subsection 7.1(2) notice is to be provided to applicants when applications are deemed abandoned. • Subsection 11(1)(b) notice is to be provided to applicants when a record responsive to an access request is transferred to another local authority or government institution for processing. • Subsections 12(2) and (3) require a notice to be provided to applicants when the head extends the 30-day response time. Notice of the extension is to be given within 16 SK OIPC Review Report LA-2013-004 at [25].

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 12 the first 30 days after an application is made. Within the period of extension, the head shall give notice in accordance with section 7. • Subsection 25(2) requires the local authority to inform an individual of the purpose for the direct collection of the individual’s personal information. • Section 33 notice is to be given to third parties where a head intends to give access to third party information (see section 18 of LA FOIP) or personal information that may be disclosed pursuant to subsection 28(2)(n) of LA FOIP. This notice requirement can be waived by the third party (see section 34 of LA FOIP). • Section 36 notice of the head’s decision regarding whether access to the third party information will be given is to be provided to the third parties within 30 days after the third party was provided notice pursuant to section 33 of LA FOIP. • Section 41 notice is to be given to third parties that a review by the Information and Privacy Commissioner (IPC) is occurring. The head shall provide this notice to any third party that was or would have been given notice under section 33 of LA FOIP. This notice shall be given immediately upon learning of the IPC’s review. The head must also immediately provide notice of a review to an applicant where the review is requested by the third party. • Section 45 notice of the head’s decision regarding the Commissioner’s report must be given to the Commissioner, applicant or individual and third party within 30 days of receiving the Commissioner’s report. • Subsections 46(2) and (3) require notice to be given to any third party that was or would have been given notice under section 33 of LA FOIP advising them that an appeal to the Court of King’s Bench has been made by an applicant. If it is the third party that is appealing to the Court of King’s Bench, then the head must give notice to the applicant. Subsection 54(1)(c) of LA FOIP provides that no proceeding lies or shall be instituted against a local authority or the head or other officer or employee of a local authority if it fails to give any notice required under LA FOIP provided reasonable care was taken to give the notice. Subsection 54(2) of LA FOIP provides that reasonable care is deemed to have been taken if the notice was sent to the applicant’s address that was provided on the access to information form.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 13 IPC Findings In Review Report LA-2013-004, the Commissioner found that the Northern Village of Pinehouse failed to provide a proper section 7 notice in accordance with LA FOIP. The Commissioner also found that it failed to respond appropriately to the Commissioner when notified that a formal review was underway. The Commissioner recommended the Village issue a compliant section 7 response to the applicant. Further, the Commissioner recommended the Ministry of Justice, which had administrative responsibility for LA FOIP, in consultation with the Ministry of Government Relations ensure the Village had proper delegation powers for a Privacy Officer, the Privacy Officer receive a clear job description and appropriate training and that appropriate policies and procedures be implemented for compliance with LA FOIP. The former Commissioner also recommended the Minister of Justice and Attorney-General consider prosecution pursuant to subsection 56(3) of LA FOIP. In Review Report LA-2014-001, the Commissioner found the Village of Killaly was in contravention of LA FOIP as it failed to provide a proper section 7 response to the applicant. Further, the Commissioner found that the Village failed to respond appropriately to the Commissioner when notified that a formal review was underway. The Commissioner recommended that, within 15 days, the Village clarify if the Mayor will retain responsibility for LA FOIP or if some or all responsibility would be formally delegated to other officers of the Village pursuant to section 50. The Commissioner also recommended the Village issue a compliant section 7 response to the applicant and ensure that those individuals with responsibility for LA FOIP receive a clear job description and appropriate training. Further, the Commissioner recommended the Village ensure that appropriate policies and procedures are implemented for compliance with LA FOIP. Finally, the Commissioner recommended that the Minister of Justice and Attorney-General consider prosecution pursuant to subsection 56(3) of LA FOIP with respect to the refusal of the Village to comply with a lawful requirement of the Commissioner. In Review Report 036-2016, the Commissioner found that the Northern Village of Pinehouse did not comply with section 7 of LA FOIP and therefore, pursuant to subsection 7(5) of LA FOIP, the Village was deemed to have refused access to the records requested. The Commissioner recommended that the Village release the responsive records. The Commissioner noted that there were six other reviews underway involving similar issues with the Village (See 106-2016, 171-2016, 040-2016 and 037-2016). In Review Report 143-2017, the Commissioner found that the Reeve (as head) of the Rural Municipality of Blaine Lake #434 did not respond to the applicant within the legislated timeline of 30 days and as such failed to meet the obligations under section 7 of LA FOIP. The

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 14 Commissioner recommended the R.M. release the records to the applicant within 15 days of issuance of the Commissioner’s report. Further, the Commissioner recommended that the Reeve contact the Ministry of Government Relations, the Ministry of Justice (Access and Privacy Branch) and the Saskatchewan Association of Rural Municipalities (SARM) for assistance on how to meet its obligations as the head under LA FOIP. Routine Disclosure & Active Dissemination In addition to providing access to records and information in response to access requests, local authorities may provide access to information and records through two other processes: 1. Routine disclosure in response to inquiries and requests for information. 2. Active dissemination of information. Routine disclosure and active dissemination will likely satisfy many of the information needs of members of the public. There are numerous advantages of using routine disclosure and active dissemination processes. The public will be better served and better informed through the planned and targeted release of information in support of overall program objectives. As well, making information available outside the LA FOIP process can promote cost-effective management of public information resources.17 Personal information and personal health information must be handled differently. For more on handling personal information, see the Guide to LA FOIP, Chapter 6, “Protection of Privacy”. For more on handling personal health information, see the IPC Guide to HIPA. For more on routine disclosure and active dissemination, see the Guide to LA FOIP, Chapter 3, “Access to Records” at Section 53.1: Access to Manuals and Section 53.2: Records Available Without an Application. 17 Service Alberta, FOIP Guidelines and Practices: 2009 Edition, Chapter 2 at p. 31.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 15 Proactive Reporting of Privacy Breaches A privacy breach occurs when there is an unauthorized collection, use or disclosure of personal information.18 For more on what constitutes a privacy breach see the Guide to LA FOIP, Chapter 6, “Protection of Privacy” at Privacy Breaches. When a local authority believes that a privacy breach may have occurred, it has the option to proactively report the matter to the Information and Privacy Commissioner (IPC) rather than wait for the IPC to learn about the breach through other sources such as the media or affected individuals. The IPC has a form titled, Proactively Reported Breach of Privacy Reporting Form: for Public Bodies. Local authorities should complete this form and submit it to intake@oipc.sk.ca. Some of the benefits of proactively reporting privacy breaches include: • May reduce the need for the IPC to issue a public report on the matter. • Receive timely, expert advice from the IPC - the IPC can help guide the local authority on what to consider, what questions to ask, and what parts of LA FOIP or The Local Authority Freedom of Information and Protection of Privacy Regulations may be applicable. • Should the media contact the local authority, the local authority can advise it has notified the IPC of the privacy breach and will seek assistance from the IPC with handling it. • Should affected individuals contact the IPC, the IPC can assure the individuals that the IPC is aware of the breach which may prevent a formal complaint to the IPC. When a local authority proactively reports a privacy breach to the IPC, a file will be opened. The local authority will be asked to complete and provide the IPC’s Privacy Breach Investigation Questionnaire (Questionnaire) and any other relevant material within 30 days. The Questionnaire takes local authorities through the four best practice steps of responding to a breach (see four steps below). The completed Questionnaire should provide the IPC with 18 SK OIPC Dictionary available at https://oipc.sk.ca/resources/dictionary/.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 16 what is required to conduct an investigation. If further information is required, the IPC will advise. Upon receipt, the focus of the IPC is on whether the local authority appropriately handled the breach. This is based on whether the local authority adequately addressed each of the four best practices recommended by the IPC. The four best practices include: 1. Contain the breach 2. Notify affected individuals and/or appropriate organizations 3. Investigate the breach 4. Prevent future breaches19 Once the IPC receives the relevant material, it will review the file and make a decision. The possible outcomes are as follows: • If the Commissioner is satisfied with the local authority’s overall response to the breach, the file will be closed informally without a public report. This process may include some informal recommendations from the IPC. • If the breach is egregious or it involves a large number of affected individuals, the Commissioner may determine that a report will be issued. • If an affected individual makes a formal complaint, the Commissioner may determine that a report will be issued. • If the Commissioner is not satisfied with the local authority’s response or handling of the breach, the IPC will issue a report. Once the IPC has made a decision, the local authority will be advised if a report will be issued or not. The local authority will also be notified if an affected individual makes a formal complaint, which may also result in a public report.20 If you have questions or need further guidance, contact the SK OIPC at intake@oipc.sk.ca. 19 SK OIPC Resource, Privacy Breach Guidelines for Government Institutions and Local Authorities at pp. 6 to 9. 20 For more, see SK OIPC resource, Privacy Breach Guidelines for Government Institutions and Local Authorities. Available at Privacy Breach Guidelines (oipc.sk.ca).

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 17 Local authorities should be aware of section 28.1 of LA FOIP. It requires local authorities to notify an individual of an unauthorized use or disclosure of the individual’s personal information by the local authority if it is reasonable in the circumstances to believe that the incident creates a real risk of significant harm to the individual. For more on this, see the Guide to LA FOIP, Chapter 6, “Protection of Privacy” at Section 28.1. INFORMATION & PRIVACY COMMISSIONER - ROLES & RESPONSIBILITIES The Saskatchewan Information and Privacy Commissioner is an independent Officer of the Legislative Assembly. Commencing November 1, 2003, the Commissioner became a full-time position and resources were provided to enable a stand-alone office. Prior to this, the Commissioner was a part-time position and there was no office.21 The enabling statute creates the powers and duties of the Commissioner. In this case, that statute is LA FOIP. Under LA FOIP, the Commissioner has oversight over compliance with the Act by all local authorities in Saskatchewan that are subject to it. LA FOIP provides for independent reviews of decisions made by local authorities under LA FOIP and the resolution of privacy complaints. There are four elements in the Commissioner’s mandate: 1. The Commissioner responds to requests for review of decisions made by local authorities in response to access requests and makes recommendations to local authorities. 2. The Commissioner responds to complaints from individuals who believe their privacy has not been respected by local authorities and makes recommendations to those local authorities. 3. The Commissioner provides advice to local authorities on legislation, policies or practices that may impact access or privacy rights. 21 SK OIPC Annual Report - 2003-2004 at p. 7.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 18 4. The Commissioner undertakes public education with respect to information rights including both access to information and protection of privacy.22 The Commissioner prepares a report on the completion of a review or investigation that includes findings and recommendations for the local authority. The local authority has a responsibility to respond to the Commissioner’s report under section 45 of LA FOIP indicating whether it will comply with the recommendations. If not satisfied with the section 45 response from the local authority, an applicant can pursue an appeal to the Court of King’s Bench for Saskatchewan. The Court of King’s Bench will determine the matter de novo. A hearing de novo means a review of a matter anew, as if the original hearing had not taken place.23 The Commissioner is neutral and does not represent a local authority or an applicant in a review or investigation. In January 2018, the Commissioner wrote a blog about the Commissioner’s office and when the roles of collaborator and neutral objective decision-maker come into play. For more see, So, Do We Collaborate? Section 38: Appointment Appointment of commissioner 38(1) The office of the Information and Privacy Commissioner is continued. (2) The commissioner is an Officer of the Legislative Assembly. (3) The commissioner shall be appointed by order of the Legislative Assembly. (4) Subject to sections 39 and 40, unless he or she resigns, dies or is removed from office, the commissioner holds office for a term of five years. (5) The commissioner may be reappointed for one additional term of five years. 22 SK OIPC Annual Report 2010-2011 at p. 7. 23 Garner, Bryan A., 2009. Black’s Law Dictionary, Deluxe 10th Edition. St. Paul, Minn.: West Group at p. 837.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 19 (6) The commissioner may resign the office at any time by giving written notice to the Speaker. The provision that provides for the appointment of the Commissioner can be found at section 38 of The Freedom of Information and Protection of Privacy Act (FOIP). The Commissioner is an Officer of the Legislature and is independent of government. Section 38 of FOIP provides in part that the Commissioner: • Is appointed by order of the Legislative Assembly. • Is appointed for a term of five years. • Can be extended an additional term of five years. Sections 38, 39 and 40 of FOIP also provide that the Commissioner may resign or may be removed or suspended for cause, incapacity to act, neglect of duty or misconduct. The Commissioner’s office is made up of employees appointed by the Commissioner in order to exercise the powers and perform the duties of the commissioner effectively. Employees of the Commissioner’s office are employees of the Legislative Assembly. Procedural Fairness Procedural fairness is concerned with the procedures used by a decision-maker, rather than the actual outcome reached. It requires a fair and proper procedure be used when making a decision. It is highly likely that a decision-maker who follows a fair procedure will reach a fair and correct decision.24 Procedural fairness involves decision-makers: • Informing parties of the case against them. • Giving parties the opportunity to be heard. • Remaining neutral. 24 Ombudsman Western Australia, Guidelines, Procedural Fairness (natural justice), May 2009.

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 20 • Acting only on the basis of logically probative evidence.25 The important purpose of having procedural fairness is to ensure that, in the end, the result of an investigation or review can be fairly relied upon with confidence. The courts have held on a considerable number of occasions that a proceeding before an administrative decision maker need not be absolutely perfect in order for it to comply with the duty of substantive or procedural fairness. The Supreme Court of Canada in R. v. Harrer, 1995 CanLII 70 (SCC), [1995] 3 SCR 562 at paragraph 45, observed in a general sense that: A fair trial must not…be conflated with the perfect trial; in the real world, perfection is seldom attained. A fair trial is one which satisfies the public interest in getting at the truth, while preserving basic procedural fairness to the accused.26 The duty of procedural fairness is flexible and variable and depends on an appreciation of the context of the particular statute and the rights affected in a given set of circumstances (i.e., “the specific context of each case”).27 The Commissioner conducts reviews and investigations following the principles of procedural fairness within the limits of LA FOIP. For example, while sharing submissions amongst parties is procedurally fair, section 42 (conduct of a review) of LA FOIP and section 46 (confidentiality) of The Freedom of Information and Protection of Privacy Act (FOIP)28 limit what the Commissioner can share with other parties during a review. Further, while LA FOIP provides the opportunity to make submissions to the Commissioner, it specifically limits the “right to be present during a review” or to have access to submissions by other parties made to the Commissioner before or after a review.29 25 SK OIPC, Presentation, Procedural Fairness: Factors that contribute to making an administratively fair decision. 26 R. v. Harrer, 1995 CanLII 70 (SCC), [1995] 3 SCR 562 at [45]. Also cited in Edmonton Police Service v. Alberta (Information and Privacy Commissioner), 2012 ABKB 595 (CanLII) at [57]. 27 Baker v. Canada (Minister of Citizenship and Immigration), 1999 CanLII 699 (SCC), [1999] 2 SCR 817 at [21] and [22]. Also cited in Edmonton Police Service v. Alberta (Information and Privacy Commissioner), 2012 ABKB 595 (CanLII) at [59]. 28 Section 46 of FOIP is adopted by LA FOIP pursuant to section 48 of LA FOIP. Therefore, this provision applies in the context of LA FOIP as well. 29 The Local Authority Freedom of Information and Protection of Privacy Act, SS 1990-91, c L-27.1 at s. 42(3).

Office of the Information and Privacy Commissioner. Guide to LA FOIP, CHAPTER 2, Administration of LA FOIP. Updated 2 March 2023. 21 All parties to a review or investigation are given the opportunity to provide representations (submissions) to the Commissioner. Representation means the documents, other evidence and/statements or affidavits provided by a party setting out its position with respect to the information at issue and often referred to as a submission.30 The Commissioner considers those representations in a neutral non-biased manner and makes decisions based on a balance of probabilities or a preponderance of the evidence presented by the parties. For more on this, see Section 51: Burden of Proof, later in this Chapter. The process, because of the legislative requirements, is not like a trial in a court or a hearing by a tribunal. The legislation, in effect, requires the review to occur in private. It is within these limits that the Commissioner and staff attempt to be procedurally fair. To assist parties in understanding the procedures used by the Commissioner’s office, the Commissioner issued, The Rules of Procedure. Section 32: Privacy Powers Privacy powers of commissioner 32 The commissioner may: (a) offer comment on the implications for privacy protection of proposed programs of local authorities; (b) after hearing the head, recommend that a local authority: (i) cease or modify a specified practice of collecting, using or disclosing information that contravenes this Act; and (ii) destroy collections of personal information that is collected in contravention of this Act; (c) in appropriate circumstances, authorize the collection of personal information in a manner other than directly from the individual to whom it relates; (d) from time to time, carry out investigations with respect to personal information in the possession or under the control of local authorities to ensure compliance with this Part. 30 SK OIPC Rules of Procedure at p. 3.

RkJQdWJsaXNoZXIy MTgwMjYzOA==