The Protection of Privacy Act creates a stand‑alone privacy framework that applies to personal information, data derived from personal information and non‑personal data held or created by Alberta public bodies. It restricts collection to narrowly defined legal authorities or necessary program purposes, prohibits the sale of personal information, requires notice where automated systems will be used, and sets out correction, retention and breach‑notification obligations.
The Act also regulates data matching and the creation, disclosure and protection of non‑personal (including synthetic) data; requires privacy management programs and privacy impact assessments in prescribed circumstances; gives the Information and Privacy Commissioner expanded investigatory and ordering powers (with an independent adjudicator for conflict cases); and establishes tiered fines and criminal‑style prohibitions. The result is a modern compliance regime that both enables some public‑sector data reuse and imposes tight procedural, contractual and technical controls that public bodies and their partners must implement.
At a Glance
What It Does
The Act limits when and how public bodies may collect, use and disclose personal information, bans selling personal information, and tightly controls data matching and the creation and sharing of non‑personal data. It mandates privacy management programs, privacy impact assessments in prescribed cases, and gives the Information and Privacy Commissioner authority to investigate, order remedies and have those orders filed as court judgments.
Who It Affects
All Alberta public bodies and their employees, post‑secondary institutions (with limited carve‑outs for alumni records and teaching evaluations), provincial archives, researchers and any third parties that receive non‑personal data or participate in data matching arrangements with public bodies. Vendors that host or process public‑sector data will face contractual and technical obligations.
Why It Matters
This law is one of the first provincial statutes to treat non‑personal and synthetic data explicitly and to forbid commercial sale of public‑sector personal information, while still permitting data matching for research and program management under strict controls. The combination of administrative orders, court‑enforceable remedies and large fines changes operational risk calculus for public‑sector analytics and external partners.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act establishes a single, detailed privacy regime for information held or created by Alberta public bodies, replacing the previous patchwork. It confines collection to three narrow paths: an express statutory authorization, law‑enforcement purposes, or information that is directly necessary for an operating program or activity.
Where personal information must be collected directly from an individual, the public body must generally collect it in person and give notice at the time of collection about the purpose, legal authority, a contact for questions and whether the information will be used in an automated system to generate outcomes.
On accuracy and retention, the Act forces public bodies to make “every reasonable effort” to ensure data used in decisions (including automated decisions) is accurate and complete, and to keep that information available for at least one year after use so individuals can access it. Individuals get a formal correction route; if a head refuses to correct an item, the head must annotate or link the record and notify past recipients from the prior year unless the correction is immaterial and the requester agrees not to notify.The law draws a clear line between personal information, data derived from personal information (produced by data matching) and non‑personal data (including synthetic data).
Public bodies may carry out data matching only for limited purposes (research, program management or prescribed purposes) under prescribed security arrangements. Data derived from matching is subject to tight controls: it may generally be retained only for the creating purpose, must be destroyed or converted to non‑personal data when no longer needed, and is prohibited from general disclosure except back to the public body that supplied the source in limited circumstances.For non‑personal data, the Act allows creation and wider use—but it requires documentation of the inputs, methods and a re‑identification assessment each time non‑personal data is produced.
Disclosure of non‑personal data to external parties is allowed only for research or program purposes, under approved security and confidentiality conditions, contractual commitments prohibiting re‑identification and requirements for destruction or further approvals for any subsequent use. Public bodies must also prepare privacy management programs (phased in with a one‑year delay for initial compliance) and carry out privacy impact assessments in prescribed situations, with the Commissioner empowered to request those assessments.Enforcement centers on the Information and Privacy Commissioner, who can investigate proactively, order specific remedies (including destruction of improperly collected records), and issue orders that can be filed and enforced as Court of King’s Bench judgments.
The Act provides an independent adjudicator—typically a designated judge—for reviews where the Commissioner has a conflict or complaints concern the Commissioner’s role. The statute includes whistleblower protections for employees who disclose contraventions to the Commissioner, a directory requirement for personal information banks, transitional rules tied to the Access to Information Act, and a range of specified fines and deadlines for compliance and judicial review.
The Five Things You Need to Know
A public body must give notice at the time of collecting personal information that states the purpose, the specific legal authority, contact details for questions and whether the data will be used in an automated system to make content, recommendations or decisions (section 5(2)).
If a public body uses an individual’s information to make a decision that affects them (including automated decisions), it must try to ensure accuracy and keep the records available for at least one year after use unless the individual agrees otherwise in writing (section 6).
Data matching is limited to research, program planning/administration or prescribed purposes and must follow prescribed security arrangements; derived data generally cannot be disclosed and must be destroyed or converted to non‑personal data when its purpose ends (sections 17–19).
When a public body creates non‑personal data (including synthetic data) it must document the input personal/data‑derived sources, the method used and an assessment showing the data cannot be (re)identified; external disclosures require contracts forbidding re‑identification and set destruction timelines (sections 21(4) and 23).
The Commissioner can order remedies (including destruction and stopping prohibited processing), those orders can be filed as enforceable court judgments, and the Act attaches significant fines (up to $1,000,000 for organizations and up to $200,000 for individuals on some breaches) and criminal‑style prohibitions on re‑identification (sections 42 and 60).
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Collection, accuracy, correction and limits on use/disclosure of personal information
This part sets the gate for any personal information a public body handles. Section 4 narrows lawful collection to express statutory authorizations, law enforcement, or information directly necessary to a program. Section 5 generally requires direct collection from the individual and prescribes a detailed notice at point of collection, including explicit disclosure when the data will feed an automated system. Sections 6–9 create accuracy, retention (minimum one‑year retention after use for decision data), correction and transfer obligations: heads must annotate records if they refuse a correction and notify prior recipients. Sections 11–15 govern permitted uses and a broad, enumerated list of disclosure exceptions; the Act also flatly forbids selling personal information by any public body.
Data matching, derived data and non‑personal (including synthetic) data
These provisions carve out a separate regime for analytics. Data matching is allowed only for narrow purposes and under prescribed security controls; the public body may use other public bodies’ records for matching but not collect directly from individuals for matching (section 17). Data derived from matching is tightly protected: retention limited to the creating purpose and disclosure generally prohibited except to the supplying public body if needed (sections 18–19). Non‑personal data can be created and used more broadly, but creation must follow best practices and prescribed standards, each creation must be logged with methods and re‑identification assessments, and external disclosures require contracts forbidding re‑identification and setting destruction/approval conditions (sections 21–23).
Privacy management programs and privacy impact assessments
Public bodies must establish a privacy management program scaled to the volume and sensitivity of data they hold and comply with prescribed requirements; the law allows one year before that duty and the disclosure requirement for the program take effect (section 25). Privacy impact assessments are mandatory in prescribed situations, must identify risks and mitigation strategies, and may have to be submitted to the Commissioner on request; the Commissioner can demand copies for review (section 26). Together these sections push operational privacy governance into documented processes and external oversight.
Commissioner powers, reviews, orders and the independent adjudicator
The Act expands the Commissioner’s mandate to investigate proactively, give advice, review complaints and request PIAs. The Commissioner has broad production powers, limited exclusions aligning with Access to Information Act exclusions, and statutory protections for statements given during investigations. On inquiry, the Commissioner can issue binding orders (require compliance, destroy records, stop prohibited processing) that may be filed and enforced as court judgments; those orders are final but may be judicially reviewed within specified timeframes. An independent adjudicator (a designated judge) handles reviews where the Commissioner has a conflict or complaints against the Commissioner, and has equivalent powers to issue final orders (sections 27–51).
Operational requirements, whistleblower protection, offences and rule‑making
This part sets notice and service rules, allows rights to be exercised by representatives, requires a public directory of personal information banks, and provides protections for public bodies and employees acting in good faith. It makes employee whistleblowing to the Commissioner lawful and shields identities. The Act prescribes a graduated offences and penalties scheme with higher fines where data‑matching or re‑identification prohibitions are breached, empowers the Lieutenant Governor in Council and the Minister to make technical and substantive regulations (including security standards and what constitutes non‑personal data), and mandates a six‑year periodic legislative review.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Alberta residents and data subjects — stronger notice, correction and breach‑notification protections, explicit limits on collection and a statutory right to have annotations linked to contested records.
- Researchers and provincial analysts — a legal path to perform data matching and to receive non‑personal data for research or program evaluation, subject to documented methods and contractual safeguards that enable reuse while managing risk.
- Public bodies that invest in governance — the Act provides a clear compliance framework, statutory authority for privacy programs and PIAs, and defined procedures for resolving disputes through the Commissioner or independent adjudicator, which can reduce legal uncertainty if implemented well.
Who Bears the Cost
- Public bodies (ministries, local public bodies, post‑secondary institutions) — must operationalize direct‑collection rules, notification practices, accuracy checks, one‑year retention windows for decision data, privacy management programs, PIA processes and exhaustive recordkeeping for non‑personal data creation.
- Third‑party vendors and researchers who receive non‑personal data — must sign binding agreements that prohibit re‑identification, adhere to approved security controls, and accept destruction or further‑use conditions, increasing contractual and compliance overhead.
- Legal and compliance teams and the Commissioner’s office — higher administrative workload from mandated PIAs, requests for program directories, investigatory productions, and potential increases in judicial reviews and enforcement actions.
Key Issues
The Core Tension
The central tension is between two legitimate goals: enabling evidence‑based public‑sector use of linked and derived data (for research, planning and service delivery) and preventing privacy harms from re‑identification, misuse or commercial exploitation. The Act tries to permit beneficial reuse under strict governance while deterring risky behaviour with severe penalties—but that trade‑off places heavy implementation demands on public bodies and leaves outcomes dependent on future regulations and the Commissioner’s interpretation.
The Act attempts to thread a difficult needle: it allows public bodies to continue using data for research and program management while erecting procedural, technical and contractual barriers intended to prevent re‑identification and misuse. That design creates several implementation problems.
First, many operational details are deferred to regulations and “prescribed” requirements (security arrangements for matching, technical standards for synthetic data, circumstances triggering PIAs), so until those regulations are published, public bodies face material uncertainty about what compliance will require.
Second, the statutory prohibitions and high fines create real risk of chilling. Public‑sector teams and external researchers may be reluctant to engage in data matching or create synthetic datasets if they perceive an elevated risk of penalties for inadvertent re‑identification or for failing to meet still‑to‑be‑defined best practices.
Third, the rule that data used in a decision must be retained for at least one year is protective of access and correction rights but could complicate data minimization policies and retention schedules, especially for volatile analytics pipelines. Finally, while the Commissioner’s expanded powers and ability to have orders filed as court judgments speed enforcement, the statute also makes many decisions final with limited appeal, shifting significant discretion to administrative actors and to later regulatory drafting.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.