The Freedom of Information and Protection of Privacy Amendment Act, 2026 adds a statutory framework for 'connected services providers' that can host online platforms, facilitate personal‑information sharing between public bodies, and identify eligibility for programs. The minister responsible for FOIPPA can designate a public body as a connected services provider and issue directions about what personal information may be shared, in what format, and which sources to use.
The bill also adds a new exemption allowing refusal to disclose information that would reveal the substance of communications from judicial officers to public bodies about policies or legislation, tightens the legal test for how specific access requests must be, authorizes time extensions if applicants consent, expands grounds to disregard abusive or repetitive requests, and creates new rules for the privacy commissioner's information exchanges and involvement in privacy impact assessments. Together, these changes centralize operational control over cross‑public‑body data flows while introducing new limits on disclosure and new administrative duties for public bodies and the commissioner.
At a Glance
What It Does
The Act creates a legal category—'connected services provider'—and authorizes those providers to collect, use and disclose personal information to operate shared online service platforms. It also adds an exemption for communications from judicial officers, modifies the required particularity for access requests, allows extensions when applicants consent, and authorizes information‑sharing agreements for the privacy commissioner.
Who It Affects
All public bodies in British Columbia, any public body designated as a connected services provider, the minister responsible for FOIPPA, the Office of the Information and Privacy Commissioner, and applicants seeking access or correction of records. Service users whose data will be aggregated or shared across platforms will be directly affected.
Why It Matters
This law shifts how government can centralize and direct cross‑agency data sharing, embedding ministerial control over types, formats and sources of personal data used for integrated digital services. It also narrows disclosure in two areas—judicial communications and requests deemed abusive—changing transparency and access practice across the public sector.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The single biggest addition is a statutory scheme for 'connected services providers.' The minister may designate a public body to act as a connected services provider and may give directions about the type, quantity and format of personal information to be shared, which data sources to prefer for specified categories of information, and the circumstances in which specific categories of data may or may not be shared. Designated providers can build and maintain online platforms to facilitate access to multiple public‑sector services and to identify eligibility for benefits, and they are expressly authorized to facilitate sharing between public bodies for those purposes.
The bill defines 'sharing' to mean collection, use and disclosure in the connected‑services context and creates reciprocal disclosure authorities allowing connected services providers and public bodies to disclose personal information to one another for the purpose of enabling a service under the connected‑services framework. The minister must notify the commissioner when a designation occurs, and the commissioner may review the related privacy impact assessment if they request it.
The statutory language also permits the minister to issue different directions for different classes of people, public bodies or categories of information, which builds flexibility into the model but concentrates practical control in the minister's office.On access mechanics, the Act changes the test for particularity: a request must now provide enough detail to let an experienced employee of the public body, with reasonable effort and time, identify the record sought. The Act also creates an explicit route for time extensions where an applicant consents in a prescribed manner.
Separately, the Act adds a new exemption allowing the head of a public body to refuse to disclose information that would reveal the substance of communications from judicial officers (or communications made on their behalf) to the public body about proposed or existing policy, programs or enactments.The commissioner gains two operational changes: express authority to enter information‑sharing agreements with counterparts in other provinces or Canada and to disclose information under those agreements, while a reciprocal limit prevents the commissioner from sharing records that are the subject of an active access or correction request and that were obtained as part of a review. The Act also expands grounds to treat requests as abusive—including malicious behaviour, repetitious or systematic requests, and excessively broad demands—and makes other administrative changes (fees for proactively published categories, modest inquiry timeline adjustments and transitional rules).
Several provisions come into force on royal assent while others require regulation, and the Act contains transitional clauses specifying which changes apply to previously received requests.
The Five Things You Need to Know
Section 69.3 allows the minister to designate a public body as a 'connected services provider' and to direct which categories and sources of personal information may be shared to support an online service platform.
Section 16.1 permits the head of a public body to refuse disclosure of information that would reveal the substance of communications from a judicial officer, or communications made on their behalf, about proposed or existing policy, program or enactment.
Section 5(1)(a) is replaced: a request must provide enough detail to enable an experienced employee of the public body, with reasonable effort and in a reasonable amount of time, to identify the record sought.
Section 10(1.1) lets a head of a public body extend response time if the applicant consents in the prescribed manner; previous automatic or other extension language is adjusted to reflect this consent route.
Sections 42 and 47 authorize the privacy commissioner to enter information‑sharing agreements and to disclose information under those agreements, but section 42(1.1) bars exchanges of records that are subject to an active access or correction request and were obtained during a review.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Clarifies duty to disclose records required by law in proceedings
The amendment adds an express exemption for records that the public body, Attorney General or government is required by law to produce, list or identify in a proceeding—applicable to applicants and third parties acting for them—and defines that requirement to include records falling within a general class listed for the proceeding. Practically, this narrows access by carving out evidence and court‑required disclosures from FOIPPA demands and removes doubt about whether unlisted but generically covered records must be produced.
Higher particularity test for requests and explicit consented extensions
The Act raises the bar for how specific an access request must be, shifting to a functional test that centers on what an experienced employee of the public body can reasonably locate. That changes how applicants should draft requests and how public bodies triage them. The Act also inserts section 10(1.1) to permit extensions where an applicant expressly consents in the prescribed manner—moving one source of delay into a documented consent path rather than a discretionary or implied extension mechanism. Transitional language limits application of some of these changes to requests received after the commencement regulation, creating a bifurcated period for compliance.
New exemption for judicial communications to public bodies
Section 16.1 authorizes refusal to disclose information that would reveal the substance of communications from a judicial officer (judge, associate judge or justice of the peace) to a public body about proposed or existing policies, programs or enactments, and covers communications made on behalf of a judicial officer. The exemption is focused on protecting the content (the 'substance') of those communications rather than all documents involving a judicial officer, but it leaves room for debate about how broadly 'substance' will be interpreted in practice.
Connected services provider: powers, data flows and ministerial directions
The package of amendments enables two-way data flows between public bodies and designated connected services providers. Section 69.3 lists core functions—establishing an online platform, facilitating sharing, and identifying eligibility—and defines 'sharing' as collection, use and disclosure. The minister can direct which categories and quantities of personal information are to be shared, the format required, and which source data should be used for particular categories. Related edits to sections governing collection and disclosure (26, 27, 33) add specific authority for connected services‑related collection and sharing. The minister must notify the commissioner of any designation and provide the related privacy impact assessment if requested.
Commissioner information‑sharing and limits during active requests
The commissioner may now enter into information‑sharing agreements with counterparts in other provinces or with federal bodies and may disclose information under those agreements (section 47(6) cross‑references the new contracting power). However, a new limitation (section 42(1.1)) prevents the commissioner from exchanging records that are the subject of an active access or correction request and that the commissioner obtained during a review. The effect is to open a pathway for cross‑jurisdiction cooperation while preserving confidentiality for records that are under appeal or correction.
New grounds to disregard requests and proactive publication categories
Section 43 expands the grounds for refusing or disregarding a request to include abusive or malicious behaviour by applicants and clarifies that repetitious/systematic or excessively broad requests are abuses of the right to request. Separately, heads of public bodies must establish categories of records available to the public without a request, and may charge fees for copies of proactively published records; the minister may set cross‑ministry categories under section 71.1. These changes push governments toward proactive publication while giving them clearer tools to manage vexatious or operationally disruptive requests.
Staged commencement and selective retroactivity
The Act sets royal assent as the start date for provisions not otherwise regulated but sends several key changes—including the new tests for particularity and timing of some amendments—into force only by regulation. Transitional clauses specify which new rules apply to requests received before the commencement date and which do not, meaning public bodies will operate under mixed regimes for a period and must track which requests fall under which set of rules.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- People using multiple provincial services who want a single‑window experience—connected services providers can identify eligibility and streamline service delivery across public bodies.
- Public bodies designated as connected services providers, which gain statutory authority to run shared platforms and to collect, use and disclose personal information for integrated service delivery.
- The Office of the Information and Privacy Commissioner, which gets earlier notice and optional access to privacy impact assessments and formal authority to enter information‑sharing agreements with counterparts, enhancing oversight avenues.
- Ministries and central agencies, which gain tools to standardize data formats and sources across programs via ministerial directions, reducing technical fragmentation.
Who Bears the Cost
- Public bodies (including small agencies) that must implement technical interfaces, comply with ministerial directions on formats and sources, and manage new documentation and consent processes—this creates direct IT, compliance and operational costs.
- The privacy commissioner, whose office may face increased review workload and cross‑jurisdictional coordination obligations; the Act makes PIA review optional on request but expands the Commissioner's horizontal responsibilities.
- Applicants and advocates for transparency, who may face more refusals (judicial communications exemption) and see routine requests disregarded if the request is deemed abusive, repetitious, systematic or excessively broad.
- Individuals whose personal information is aggregated into connected platforms, because centralized sharing and ministerial discretion over data source selection raise risks around accuracy, scope creep and exposure if safeguards are weak.
Key Issues
The Core Tension
The bill resolves an operational problem—fragmented service delivery and the difficulty of sharing data across public bodies—by centralizing authority and enabling cross‑agency platforms, but that centralization conflicts with the principles of privacy, transparency and decentralized oversight: improving convenience and efficiency increases risk of over‑sharing, ministerial discretion, and reduced access to certain records (notably judicial communications) unless strong, enforceable safeguards and independent review mechanisms are implemented.
The Act pushes a centralized model of digital government while leaving critical implementation details to ministerial direction and regulation. That combination raises governance questions: the minister can specify which sources to use for particular data categories and can give different directions for different classes of people or public bodies, but the bill does not embed a detailed, statutory set of operational safeguards (for example, mandated retention limits, audit trails, or mandatory individual notice when data is shared) beyond the existing PIA process.
The commissioner’s role is consultation‑oriented—the minister must notify and must make a PIA available if requested—but the PIA review is not automatic, which reduces the Commissioner's pre‑deployment leverage.
The judicial communications exemption is narrowly worded to protect the 'substance' of communications, yet that term invites litigation over boundaries: does it cover a judge's informal comment about policy, legal advice provided to a minister, or factual material compiled for a judicial officer? Similarly, permitting the commissioner to enter information‑sharing agreements improves interoperability but raises cross‑jurisdictional privacy law mismatches and potential conflicts with active access or correction requests—section 42(1.1) attempts a carve‑out but only for records the commissioner obtained during a review, leaving other records exposed to exchange.
Finally, because several operational provisions come into force by regulation, public bodies face uncertainty about timing and a two‑regime transition that will complicate training, triage and case management.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.