The Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) is undergoing its most significant overhaul since it came into force over 35 years ago. Bill 97 has brought major regulatory changes for municipalities in terms of both privacy protection and freedom of information. In this episode, Commissioner Kosseim speaks with Kyle Pratt, president of the Association of Municipal Managers, Clerks, and Treasurers of Ontario (AMCTO) and chief administrative officer of the town of Tillsonburg, together with John Elvidge, clerk for the city of Toronto. They discuss how municipalities of all sizes can best ready themselves for the regulatory changes. -- La Loi sur l’accès à l’information municipale et la protection de la vie privée (LAIMPVP) fait l’objet de la refonte la plus importante depuis son entrée en vigueur, il y a plus de 35 ans. Le projet de loi 97 a apporté d’importantes modifications législatives pour les municipalités, tant sur le plan de la protection de la vie privée que sur celui de l’accès à l’information. Dans cet épisode, la commissaire Kosseim s’entretient avec Kyle Pratt, président de l’Association of Municipal Managers, Clerks and Treasurers of Ontario (AMCTO) et directeur général de la ville de Tillsonburg, ainsi qu’avec John Elvidge, secrétaire de la ville de Toronto. Ils discutent de la façon dont les municipalités de toutes tailles peuvent se préparer au mieux à ces modifications.
Kyle Pratt has served as president of Association of Municipal Managers, Clerks and Treasurers of Ontario (AMCTO) since June 2026 and was vice-president of AMCTO from 2025-2026. He is also Chief Administrative Officer (CAO) of the Town of Tillsonburg, a role he has held since 2020.
Since 1938, AMCTO has provided education, accreditation, leadership, and management expertise for Ontario municipal professionals. With 2,200+ members working in municipalities across the province, AMCTO is Ontario’s largest association of local government professionals and the premier organization for professional development in the sector.
John Elvidge is clerk for the City of Toronto. He carries out the duties of head under MFIPPA with responsibilities for access to information, privacy, records & information management, and the Toronto Archives. He is a 30+ year veteran of the City of Toronto and the former Metro Toronto.
John’s professional interests include strengthening and modernizing the machinery of local government. He continues to serve as a champion and advisor on openness in city government including open meetings, fair, open and accessible elections, privacy by design, and routine disclosure.
Resources
Info Matters is a podcast about people, privacy, and access to information hosted by Patricia Kosseim, Information and Privacy Commissioner of Ontario. We dive into conversations with people from all walks of life and hear stories about the access and privacy issues that matter most to them.
If you enjoyed the podcast, leave us a rating or a review.
Have an access to information or privacy topic you want to learn more about? Interested in being a guest on the show? Comment on our posts on BlueSky and LinkedIn or email your ideas to podcast@ipc.on.ca.
--
Kyle Pratt est président de l’Association of Municipal Managers, Clerks and Treasurers of Ontario (AMCTO) depuis juin 2026, après en avoir été le vice-président en 2025 et 2026. Il est aussi directeur général de la ville de Tillsonburg, poste qu’il occupe depuis 2020.
Depuis 1938, l’AMCTO offre aux professionnels municipaux de l’Ontario de la formation, des agréments, du leadership et une expertise en gestion. Avec plus de 2 200 membres qui travaillent dans des municipalités partout dans la province, l’AMCTO est la plus grande association de professionnels des administrations municipales en Ontario et l’organisme de référence en matière de perfectionnement professionnel dans ce secteur.
John Elvidge est secrétaire de la ville de Toronto. Il exerce les fonctions de personne responsable au sens de la LAIMPVP et s’occupe à ce titre de l’accès à l’information, de la protection de la vie privée, de la gestion des documents et de l’information ainsi que des Archives de Toronto. Il compte plus de 30 ans de service à la ville de Toronto et à l’ancienne communauté urbaine de Toronto.
Les intérêts professionnels de John portent notamment sur le renforcement et la modernisation des rouages de l’administration municipale. Il continue d’agir comme champion et conseiller en matière d’ouverture au sein de l’administration, notamment sur les plans des réunions publiques, d’élections justes, ouvertes et accessibles, de la protection de la vie privée dès la conception et de la divulgation systématique.
Ressources
L’info, ça compte est un balado sur les gens, la protection de la vie privée et l’accès à l’information animé par Patricia Kosseim, commissaire à l’information et à la protection de la vie privée de l’Ontario. Avec des invités de tous les milieux, nous parlons des questions qui les intéressent le plus sur la protection de la vie privée et l’accès à l’information.
Si vous avez aimé cet épisode, laissez-nous une note ou un commentaire.
Patricia Kosseim:
Hello, I'm Patricia Kosseim, Ontario's Information and Privacy Commissioner, and you're listening to Info Matters, a podcast about people, privacy, and access to information. We dive into conversations with people from all walks of life about privacy and access to information issues that matter to them.
Welcome to Info Matters, the Municipal Freedom of Information and Protection of Privacy Act, known as MFIPPA, applies to a broad range of local public institutions in Ontario, including municipalities, libraries, school boards, and police services. As a result of recent changes brought about by Bill 97, MFIPPA is undergoing what is arguably its biggest overhaul since it came into force 35 years ago.
The changes involve both the privacy and access to information obligations of institutions. Some of the amendments relating to FOI processes already took effect on July 1. These include giving institutions longer response times and more flexible procedures for handling complex requests. On the privacy side, there are more changes slated to come into force January 1, 2027. These include new requirements for institutions to complete mandatory privacy impact assessments and to notify affected individuals and my office of certain privacy breaches as soon as feasible.
Institutions will also have to submit annual statistical reports on the total number and types of privacy breaches they experience during the prior calendar year. Also, as of January 1, 2027, my office will have more extensive investigation and enforcement powers, including the power to issue binding orders against municipal institutions.
My two guests today are well-seasoned administrative experts in the municipal world. They will help shed light on what municipalities can expect as a result of these statutory changes, and how municipalities, both small and large, can best prepare to operationalize them in practice. Joining me today is Kyle Pratt, president of AMCTO, which is the Association of Municipal Managers, Clerks, and Treasurers of Ontario. Kyle is also the chief administrative officer of the Town of Tillsonburg.
We're also joined today by John Elvidge, clerk for the City of Toronto. John serves as a valued member of the IPC’s Strategic Advisory Council. Kyle and John, welcome to the show.
John Elvidge:
Thank you. Great to be here.
Kyle Pratt:
Thanks for having us.
Patricia Kosseim:
So, let's dive in. Government transparency is high on Ontarians' agenda right now. Indeed, Ontarians are highly interested in what their governments are doing, and they're exercising their right to access information more than ever. Our latest annual report shows that institutions received over 84,000 freedom of information or FOI requests in 2025, and that's an increase of more than 20 per cent from the previous year. As municipalities, both large and small, how are you dealing with this soaring rise in FOI requests, and what other types of day-to-day challenges are you facing on the ground? Kyle, maybe we'll start with you, and then we'll go to John.
Kyle Pratt:
From AMCTO's perspective, we're hearing about these issues from municipalities of all sizes across Ontario. As the professional association, which includes more than 2,200 members working in 98% of Ontario municipalities, including municipal clerks and roughly half of Ontario CAOs, we've been actively involved in the conversation around MFIPPA modernization.
What we're hearing from members is that access, privacy, technology, and public trust are becoming increasingly interconnected, and their recent amendments reflect many of the changes municipalities have been asking for. AMCTO has been hearing from FOI staff for years the concerns about increasing incivility from members of the public when it comes to FOI.
It's especially tough in smaller communities where people come up to you at the grocery store or in parks. But the rising incivility doesn't just hit FOI services; it's across the board. AMCTO released a survey last year where 85 per cent of respondents reported experiencing or witnessing harassment from the public, and 94 per cent reported incivility, and in both cases, more women experience these behaviors. It can be tough to try to provide access and customer service when people treat you as an adversary, are rude, or harassing. When all you're trying to do is provide them with services and access they want.
Another area we're hearing about from our members is where AI meets privacy protection. In your annual report, you highlighted AI and the digital intensification as defining issues for the sector, and that aligns closely with what our members are telling us. The fact is, read AI notes pop into every meeting. It's built into programs and applications. AI is looked at as an opportunity to assist with repetitive tasks and other potential innovations, but there is a privacy risk of putting information into a system that there is little to no control for the municipality. And the increased use of AI is the reason that the act should be comprehensively reviewed and updated to reflect changing technology as well as resident expectations. It is popping up and being used for staff across municipalities, but the use must come with good governance and staff training, so the privacy protection is balanced with enabling its appropriate use.
Patricia Kosseim:
So rising volumes, incivility, and increasing use of AI, very interesting. John, what about you? What are you seeing at the City of Toronto?
John Elvidge:
Well, you know Commissioner, I wasn't surprised to see the stats in your annual report. Well, maybe I should say I was surprised because for a long time I thought maybe we were the only ones experiencing the increase in volume and the increase in complexity of access requests on that side of the business. We're on track to be over 35 per cent up on FOIs over the last two years by the end of 2026. Obviously, reflects the public's interest in accessing information for their own use, for advocacy, for research purposes.
Something else that we notice is the complexity of access requests, the types of records that are being requested. You know we talk about this idea of digital sprawl. We have records that are being created in different places and different platforms on different devices. Even the requests for records and the searches for responsive records on the institution side are becoming increasingly complex as well.
I certainly agree with Kyle. The incivility that has crept into public life, is something we don't just see at counters, but we're starting to see in terms of our relationships with requesters. It disappoints us. I think because the people who, on our team that work in the access business, consider themselves to be facilitators. These are people who share the objectives of the act in terms of making information available. But we understand that people may be frustrated or skeptical or have lost trust in institutions, and that's starting to play out in the interactions.
Kyle mentioned AI. There's two things on that. We're seeing more and more people using AI to prepare access requests, which, quite frankly, is not helpful. The tendency of AI to hallucinate or overestimate the types of records that might be available means that we're going back to requesters more often to narrow requests or restate requests, and that's a new phenomenon really since the rise of the generative AI tools. AI has a connotation on the privacy side as well. I think those of us who act as the heads of the institution under MFIPPA, we see our responsibility to try to apply the legislation to the use of AI, and that sometimes puts us in conflict with those who are trying to enable or those who are trying to really accelerate the use of AI.
Patricia Kosseim:
Thank you for that level setting. That was very helpful, and I'd like to turn now more specifically to the changes to MFIPPA legislation that I mentioned earlier. And John, I'm going to start with you on this question. You've been working with the City of Toronto now for almost as long as MFIPPA has existed, and these amendments represent the most significant changes to the act in decades. So, from your perspective, what are the biggest changes municipalities need to understand right now and start getting ready for.
John Elvidge:
I have the luxury of speaking from the largest municipality in Ontario, and because of the volume that we faced both on the access and the privacy side, we're fortunate in that that work has resulted in resources that allow us to address those things. So, we have had lots of experience, both with the access side, but as well on the PIA side and privacy breach reporting.
Most municipalities have some experience with the access side of the act, and so some of the new provisions in the act, I'm sure, are going to be quite welcome. My perception is it's more on the privacy side that not all institutions have had that experience, and I've got a couple of things I think that is worth considering.
One is the requirement to complete PIAs. This is a good time now to start sorting out roles within a municipal institution, the roles of the clerk, if the clerk is the is the head of the institution or whoever holds those duties, the legal advisors, the technology providers, and cybersecurity advisors. Those four pillars, plus the municipal departments that are responsible for collecting information. What's everyone's role going to be? This is a great time to try and sort that out, so that when there are new collection exercises where PI is being collected, or where there are privacy breaches, whose job is it to do what, and in what sequence? And so this is a good time to be thinking about that rather than trying to invent that, maybe with the first privacy complaint under this legislation or first PIA. So sorting out roles.
The second thing, the challenge we have, even in a large institution, is: Do you have the systems to capture when your institution is collecting PI or when there's a privacy breach? Does everybody in the municipal institution understand their obligations? It's really easy for someone in a field office or someone who hasn't thought about the legislation to start to prepare an application form for something. There's a new program. There's an application form required, and that information is now being collected without a PIA, even here in Toronto, there's times when we see a press release about some new program that's about to be launched, and we say, "I wonder if they did a PIA for that or not, and we get on the phone to find out. So, what are the systems that are in place to capture both new efforts to collect personal information, and then of course, more importantly, privacy breaches.
Now that the obligation is for the institution to make those reports to you, Commissioner, how do we know that there's a central place in the institution where those are going to be captured? My other piece of advice is, no one is alone in this, right? There's lots of municipalities in Ontario who have experience in some of these things, ourselves included. Our association is also able to provide resources through AMCTO and through the networks that exist within there. There are access resource groups and collaborating groups. So, don't be shy, I would say about borrowing templates or asking for templates and policies and procedures and the types of things that need to be put in place. We don't have to have 444 different initiatives here in every municipality in the province. So anyway, those some of the things I think would be my best advice to people to get ready for January 1.
Patricia Kosseim:
Oh, that's great advice, John, very, very wise. Kyle, from your conversations with municipalities across Ontario, particularly now the smaller municipalities and townships, what changes do you think they're happiest about, and what changes are causing them the greatest concern right now?
Kyle Pratt:
For some communities, the changes on the FOI side will be welcome. However, implementing these, as you can appreciate, requires some upfront operational work and what is very little time. In terms of the positives, it's probably the alignment of the timelines with the business days. It's just clearer for everyone when the timelines start and end, and timelines reflect operations of the municipality. Another positive is being able to better manage larger requests for staged access, which allows management of FOI services to multiple requesters.
The biggest change we know members are concerned about are on the privacy side, not because they disagree with them, but because they're so vast. It's a completely new required body of work: a written privacy impact assessment before collecting personal information, breach reporting obligations. That's new muscle municipalities have to build, especially when in some communities it's just one or two people in the clerk's office doing FOI, privacy, and 75+ other statutory responsibilities, including running municipal and school board elections this October. It's not that municipalities don't want to get this right; they do. It's the timing that has people worried, especially heading into a busy fall with an election underway, council orientation, and budget.
Many of these amendments reflect recommendations municipalities themselves have been advocating for. The conversation we're having now is not about whether the changes are needed, but how to make implementation successful across municipalities of every size.
Patricia Kosseim:
I want to drill down a little bit on those two sets of changes. Let's start with the FOI-related changes that came into effect on July 1. So again, I'm going to go back to John, and from your perspective, as a large institution like the City of Toronto, are you feeling any operational reprieve given the extended timelines in which you now have to respond to access requests? And are you making use of the new flexible tools you have, like providing staged access plans in cases that involve very large or voluminous records. What's your experience to date on the access side?
John Elvidge:
We're pleased about the changes to the timeline from calendar days to business days, that makes sense, and the staged release as well. But you know what? I kind of view them as kind of catching up to what reality was anyway in terms of the you know the high incidence of municipal institutions having to resort to extensions. It certainly provides more time for both the record search and for the review of records, but it seems to be a little bit in line with what we've been experiencing anyway.
The stage access, we've been doing that actually for quite a while informally, and we really welcome the guardrails around it. Like the rules around it are great. We appreciate the rules around the requester having to be involved in the approval of that plan. We hope that participation in negotiating that stage plan is actually better for the process. It requires them to be a little bit more involved and in dialogue with us. And where we've done that informally, you know, we've enjoyed that relationship.
But just back to the dates for a second. You know, I mean, what can we say about the previous you know regime of 30 days to try and turn around records with the volume and complexity that we've already talked about and that digital sprawl. The time it takes to actually locate those records and then the time it takes to review those records by our access team to make the necessary and required redactions, it sounds like a lot of time, I'm sure to a requester, but in reality, it's been a tight timeline for some time.
Some of the requests that we receive yield thousands of pages of records, for example. We have to take the time as access professionals to review those thousands of pages and look for protected information and apply the act. When I started, let's say that at the beginning, since you mentioned how long I've been working, Commissioner, you know when I started, records were created on a typewriter with carbon paper and put in a file. And locating records was a much easier chore than it is now, when records again sit on all these platforms. The 45 business days is welcome to us, and we are already making good use of that in terms of managing the expectations on the part of members of the public who are requesting info.
Patricia Kosseim:
With 45 business days, we'll certainly be looking for improved response rates among institutions. There's a lot more flexibilities now available, and we hope that the institutions will make good use of those in the 45 business days, so that we're not in situations of deemed refusals as frequently as we found ourselves in prior to July 1. So, Kyle, what about you in your role as CAO with the Town of Tillsonburg? Have you had any experience applying the newly amended FOI provisions, and if so, what's been your experience to date?
Kyle Pratt:
One of the things we pride ourselves in the municipal world is the great work our associations do. There has been some great information sessions and forums offered on the new MFIPPA provisions by AMCTO. Our legislative services team at the town of Tillsonburg has attended a number of these sessions to ensure they are aware of the new requirements and to have a better understanding of how to move forward in implementing these changes. To date, Tillsonburg has reviewed and updated our current policies and practices to include the new MFIPPA provisions on timelines and staged access. I know that my team is pleased with the extended deadline for access responses, and the business day calculation of certain statutory timelines
Patricia Kosseim:
So, let's turn now to the privacy-related changes to MFIPPA that are slated to come into force January 1, 2027. They include mandatory requirements to conduct PIAs, so no longer just a best practice, but an actual legal requirement. There's also a mandatory reporting requirement to report certain privacy breaches to affected individuals and to my office, where there's a real risk of significant harm, and a new requirement to submit annual statistical reports on numbers and types of privacy breaches institutions have suffered over the course of the prior year. John, how is the city of Toronto preparing to bring itself into compliance with these new requirements? I think you mentioned before you're already doing it, but is there something that ups the ante for you?
John Elvidge:
We've required PIAs now for a number of years for major system development and major initiatives. I think the one difference for us in the wording of the act as we're trying to come to terms with is there are some collection statements for things like forms and sign-up sheets, something that might have been a simple consultation with our forms experts on will now actually turn into a written PIA. And of course, through the use of templates and the repetitive nature of those, we hope to try to lighten the load of that. For us, even in Toronto, this is an area where we think there's net new activity.
In a large municipality like ours with so many employees, to try and get people to understand their obligations under the act is always a challenge. One of the things we've done, though, that we're quite proud of is we have a program we call it the IM Champions Program. Every department here at the city is asked to appoint someone in their department who becomes an IM Champion. It's everything from records through to access and to privacy. So, we'll be really heavily leaning on this network of champions across all of our departments to address this communications challenge. How to make sure that again, someone who's designing a form and they innocuously think who cares what this form looks like? Well, we care what the form looks like, and how do we capture those instances, so that's one of the tools that we're going to use to improve our capture, both of privacy breaches collection of PI.
Patricia Kosseim:
Wow, great idea! As you may know, my office recently updated its guidance on privacy breach reporting and privacy impact assessments. So, I was wondering, Kyle, particularly in your role as president of AMCTO, are there other educational resources you think your members might need from my office to bring them into compliance with the new privacy-related requirements?
Kyle Pratt:
Yes, guidance from your office is always appreciated. The most important thing for municipalities is that these resources consider scope and scale. Not every municipality has a specialist in privacy. It's often the clerk who is the jack of all trades. So simplified, step-by-step guidance in non-jargon language is always important. There are ranges of program maturity from municipality to municipality. Guidance that reflects this is important so that municipalities can work to build their program brick by brick towards a more robust system over time.
Sample PIAs or a repository of PIAs for common municipal applications, programs, and services are something else we have heard that would be helpful. While due diligence and risk assessment would still have to be completed, being able to leverage existing information and approaches is beneficial to helping those without capacity to start from scratch.
On timing, that's one thing we're pressing the government on this fall. We would like to extend the compliance and enforcement timeline for the new requirements to July 1, 2028, so implementation doesn't outrun the guidance and resources your office and ministry are rolling out. More time would allow for staff to build out the necessary pieces to manage these new requirements and request additional resources for the municipal budget approval process, which won't start until after councils are inaugurated in November.
Patricia Kosseim:
Another thing I mentioned is that effective January 1, 2027, my office is going to have strengthened powers of investigation and enforcement, including the power to issue binding orders against municipalities. John, in what way, if at all, do you think that this might affect the nature of interactions between municipalities and my office.
John Elvidge:
Well, I would hope it doesn't have much of an effect at all. I understand maybe for some municipalities that might be daunting, but our offices have worked together on investigations on complaints you've received, and you know in our experiences they have always been highly cooperative, collaborative, conversations and investigations.
I mean, look in the clerk's business, one of the things we're interested in is having our residents be able to exercise their rights to participate in local government. So, you know, whether that's the right to vote, something we're very preoccupied with at the moment, or the right to open meetings of council, so people can see how the decisions are made. The right to privacy and the right to access information are both important things that we're kind of hardwired to support.
Our experience here in this office is when we've worked together with yours, Commissioner, there's usually a shared goal. An investigation usually means there is an important and compelling public issue to be explored.
I think of your investigation into the vending machines at the university campus. What comes out of that, but a kind of a good warning or a good set of guidelines and guardrails for all institutions as we move forward in different kinds of arrangements with private sector partners and the mix of public-private things. Nothing but good can come out of shedding light on some of these thorny public issues. And our assumption is those are the types of things that are going to result in investigation. Those where we really kind of want to know where the boundaries are in emerging issues, so I'm hoping that it doesn't change the relationship to that degree. We've already enjoyed a relationship with you on a complaint basis, and my advice to my peers and colleagues would be not to let this affect the relationship.
Patricia Kosseim:
That's great to hear, John. And you're right. In my annual report, we reported that we resolve 89 per cent of appeals and complaints at early resolution, mediation, before they even get to the investigation or adjudication stage. So, you're absolutely right. There's a lot of collaborative work that's done on the front end to get to our shared objective, which is participation in local government enabled by privacy protection, transparency, and public trust. All of those things are hardwired, as you said, into what our work is all about.
Kyle, knowing that there are many small towns and cities that don't have the same level of expertise or resources, do you think that the new changes will create a chill for smaller municipalities? Or, on the contrary, are they going to be motivated to reach out to my office to seek guidance and support? What do you think?
Kyle Pratt:
I think municipalities are worried that right on January 1, or soon thereafter, the enforcement hammer will come down before municipalities have a real chance to build these programs out. We have to remember that in many municipalities, there aren't dedicated staff and there aren't enough financial resources available either, given the number of programs and services municipalities provide. That's what is keeping our members up at night, not the substance of the requirements themselves.
What motivates outreach for help is a clear signal that the relationship in year one is going to be about education and capacity building rather than penalties. If municipalities know they can come with questions or even flag gaps without it triggering an enforcement response, they'll engage early rather than staying quiet and hoping that they got it right. It gives all of us time to build muscle, learn from one another, and get it right together, rather than everyone racing to the clock.
Patricia Kosseim:
That's a very good point, Kyle, and certainly one we take note of and can appreciate from your perspective. I want to just gaze into the crystal ball for a brief moment and ask you to look ahead a couple of years, and what impact do you think these MFIPPA amendments are going to have on the state of access to information and privacy programs among municipalities across Ontario?
Kyle Pratt:
If municipalities get the runway and support they need, I think we'll see privacy management grow in maturity across the sector in a way that it hasn't before. Formal PIAs, documented breach controls, more consistent practices, whether you're a small township or a large city, the risk is a two-tier outcome. Municipalities with dedicated privacy staff and budget get there not without their own struggles, given their limited capacity, but more smoothly than smaller and rural municipalities who make up the majority of our membership, who struggle to keep pace without more support. That's a real equity issue for the sector, not just an administrative one. It really comes back to what we started off with today: public trust, incivility, access. Transparency depends on proper implementation.
Long term, from a privacy perspective, this will also depend on the framework around AI governance and risk associated with its growth and use. We also hope that we see continued improvements to MFIPPA that AMCTO and the sector has long been calling for. There's still work to do on things like addressing frivolous and vexatious requests, information sharing, and building a regular review cycle, so we're not having the same conversation in another 35 years.
Modernizing MFIPPA isn't just about compliance; it's about making sure the legislative tools municipalities have match the commitment they already have to open government. A clear act, clearer timelines, clearer principles, clearer processes, means less time spent interpreting ambiguous provisions and more time delivering access and protecting privacy.
Patricia Kosseim:
I can certainly tell you that the challenges small municipalities are having in Ontario are very similar to the challenges of small public bodies across the country. In fact, my federal, provincial, and territorial colleagues and I discuss this quite often, and it's a challenge, I think collectively we need to try to address, given the realities that you face on the ground. So, thank you for your perspective. John, what about you?
John Elvidge:
Well, let me just take up a little bit of what Kyle was saying. You know, he's absolutely right about everything from the large municipalities down to smaller municipalities, 444, I think it is, Kyle, across the province. It's always a challenge in any provincial regulatory regime that difference in capacity between big and small. We're very aware of it in Toronto and one of the things we try to do is contribute to our association together with some of the other large municipalities in the province to try to provide some knowledge transfer and technical transfer. So, you know, I just want to validate what Kyle's saying. It is a real, it's a real issue, and I'm fortunate to head an organization that has those resources.
But wow, the whole landscape is becoming so complicated. It really starts with the nature of records and how the nature of records have changed. Talked earlier about the digital sprawl. The issues we have in access in terms of response rates and capacity really come from an explosion in the complexity of records and how we're managing those and the conventional approach that's reflected in our information management schools or in our information management associations, information management practices.
I probably go out on a limb and say we need to start there, in a way to take a look at what are public expectations about the way records are managed and what resources are being allocated to the management of records. You know, we always say here to city departments that access is easy if you've mastered the record side of things, right? If you have a good repository, the production of responsive records on the timelines, new and old, are so much easier.
But in how many Western organizations can say they manage records, or any of us as executives even, that we manage records with precision? Maybe in a way, we did when it was just a typewritten document. You gave it to a file clerk, and it was put in a trusted repository. But now I got devices all around me here. Some things are buzzing while we've been talking, and it is a little bit like we're drowning in these different forms of records.
I don't think I'm answering your question directly, but it is to me, the future is depending on us agreeing in the public sector what's the right way to manage records. How do we manage the information in such a way that then access can be given to those records? Maybe there are new approaches and new thoughts on that, and that's something in the next wave we probably really need to turn our attention to while we're trying to keep our heads above water with these large percentage increases in record requests year over year.
Patricia Kosseim:
That's so true, John, and very insightful. And you're right. Maybe it's the next wave of legislative amendments that will bring forth solutions. Maybe well before then, we will have found administrative solutions, technological solutions. It is very much tied to records management, and I couldn't agree with you more.
So, let's zoom out a little further still for the last question and ask you: What impacts do you think that these MFIPPA changes will have, if any, in moving organizational culture towards greater transparency and privacy protection? And ultimately, will it move the dial in terms of increasing public trust in the municipal sector.
Kyle Pratt:
As municipalities, we feel we're the most open and transparent order of government. With saying that, there's always room for continuous improvement. Of course, as you noted in your annual report, public trust is central to the IPC's mission. Municipalities and their staff share this goal. And from an access perspective, they are doing well with the limitations they have. Over 80 per cent response rate within 30 days.
These changes, if implemented well, should reinforce that. Clearer timelines and a modernized definition of a record make it easier for residents to actually get the information they're asking for. And mandatory breach reporting means that the public can trust that when something goes wrong, there's a transparent process behind it to deal with it. But public trust isn't about rules on paper; it's built request by request, interaction by interaction with the clerk's office and across departments which hold this information. The best thing we can do is make sure that the people delivering these services have the tools, time, and training to do it well, not just the policy requiring them to do it.
Patricia Kosseim:
Great, Kyle, thank you. John, last word to you.
John Elvidge:
We're prepared to celebrate as wins a couple of things in the legislation that are going to make our job in our office easier. The first, obviously, is the reinforcement of PIA's and privacy breach reporting. And even though it's been a policy of ours here for a while, I appreciate the opportunity to now have the conversation with my CAO, city manager, to you know point out that these are now statutory requirements.
From a testimonial point of view, as an institution that's had at least a policy requirement for PIAs, it's going to have an impact on the privacy culture of an organization for sure, because we hope that people are going to stop andthink twice before they over collect or exceed their retention schedules and all these types of things that we want to try and avoid.
So, while we sort out the future while we sort out these larger challenges, there's some good interim measures here that, in our office in City of Toronto, we're going to use to improve and educate the people who work here about their obligations. It is a positive, a step in the right direction. Let's put it that way.
Patricia Kosseim:
Well, this conversation has left me very hopeful about the state of affairs in the municipal sector, and I just want to say thank you so much, John and Kyle, for taking the time to have this conversation with me today and to share your insights with our listeners, many of whom are from the municipal sector. Thank you, John. Thank you, Kyle.
John Elvidge:
Thanks, Commissioner.
Kyle Pratt:
Thank you, Commissioner.
Patricia Kosseim:
Well, as you've heard, municipalities indeed have a lot to do to prepare for the new MFIPPA changes brought about by Bill 97 in terms of both privacy protection and FOI-related obligations. For dedicated resources on these MFIPPA changes and to learn more about the new rules and requirements under the law, municipalities are encouraged to visit our website at ipc.on.ca and to read the show notes attached to this episode. You will find our latest guidance on breach reporting, privacy impact assessments, and annual statistical reporting. We're also in the process of reviewing all of our other related resources to bring them up to date with these important MFIPPA changes. So please keep an eye out on our website and social media.
And don't forget to check out our Transparency Challenge 3.0, which calls on all public institutions, including municipalities, to show us their innovative projects that advance open data, access to information, and transparency. Stay tuned for the release of our third exhibit in our transparency showcase that will be unveiled during Right to Know Week in late September.
Well, that's it for this episode, folks. Thank you all so much for listening, and until next time. I'm Patricia Kosseim, Ontario's Information and Privacy Commissioner, and this has been the Info Matters podcast.
If you enjoyed the show, leave us a rating or a review. If there's an access to information or privacy topic you'd like us to explore on a future episode, we'd love to hear from you. You can comment on our posts on Blue Sky and LinkedIn, or email your ideas topodcast@ipc.on.ca. Thanks for listening, and please join us again for more conversations about people, privacy, and access to information. If it matters to you, it matters to me.