Bill 37 revises the Access to Information and Protection of Privacy Act by replacing two core definitions and rewriting the statute that governs review outcomes. The definition of "business day" now excludes Saturdays, Sundays, statutory holidays and any days between December 19 and January 5 when a majority of the Office of the Information and Privacy Commissioner’s staff are on mandatory leave; the bill also defines "common or integrated program or service" to mean services delivered by a public body working collaboratively with other public bodies.
The bill also substitutes section 49.5 to require the Commissioner to prepare a written report explaining agreement or disagreement with a public body's decision about collection, use, or disclosure of personal information, and to give the Commissioner explicit power to order corrections, cessation of unlawful collection/use/disclosure, or destruction of personal information. Copies of the report and any order must be provided to both the requester and the head of the public body.
These changes sharpen who bears responsibility for collaborative services, adjust how statutory timelines are counted, and expand available remedies following a privacy review.
At a Glance
What It Does
Rewrites key definitions in s.2 and replaces s.49.5. "Business day" is narrowed to exclude a specific winter shutdown when the majority of the Commissioner's office is on mandatory leave. The Commissioner must issue a written report after a review and may order corrections, cessation of unlawful handling, or destruction of improperly collected personal data.
Who It Affects
Government entities that deliver services collaboratively, legal and records teams in territorial public bodies, the Office of the Information and Privacy Commissioner, and any person who asks for a review of a privacy decision. IT and records-management units will be the operational points of compliance for orders to correct or destroy data.
Why It Matters
The statutory tweaks change how response and appeal deadlines are calculated and make the IPC’s remedial toolkit more explicit. That alters risk and operational planning for public bodies and increases the practical remedies available to individuals challenging privacy-related decisions.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
Bill 37 makes three practical changes to the Northwest Territories’ ATIPP framework. First, it narrows the statute’s definition of "business day." Beyond the usual weekends and holidays, the law now treats the period from December 19 through January 5 as non-business days if a majority of the Commissioner’s Office staff are on mandatory leave.
That affects the way statutory timelines run for access and privacy requests and for the Commissioner’s internal procedures.
Second, the bill defines "common or integrated program or service" as a program delivered by a public body working collaboratively with one or more other public bodies. The purpose is to clarify that collaborative delivery is recognized in statute, which helps determine which organizations’ obligations and responsibilities attach when multiple public bodies participate in a single service.Third, the bill replaces the statutory provision that governs what the Information and Privacy Commissioner must do after completing a review.
The Commissioner must now produce a written report setting out reasons for agreeing or disagreeing with the public body’s decision about collection, use or disclosure of an individual’s personal information. The Commissioner is given specific order-making powers: to specify how personal information should be corrected, to require a public body to stop collecting/using/disclosing personal information in violation of Part 2, and to require the head of the public body to destroy personal information obtained in contravention of the Act.
The statute also requires the Commissioner to send the report and any order to the individual who requested the review and to the head of the implicated public body.Taken together, these changes shift some predictable elements of practice: calendar-based deadlines need recalculation during the winter shutdown; multi-agency service arrangements have clearer statutory recognition; and review outcomes now include explicit statutory remedies that can force data correction or destruction. The bill does not, however, add explicit enforcement penalties or detail procedures for verifying compliance with destruction orders; implementation will depend on administrative practice and possibly downstream policy clarifications.
The Five Things You Need to Know
The revised "business day" excludes any day between December 19 and January 5 on which a majority of the Information and Privacy Commissioner's Office staff are on mandatory leave.
The new definition of "common or integrated program or service" treats collaborative service delivery as a program provided through a public body working with one or more other public bodies, clarifying the statutory scope of joint delivery.
Section 49.5 now obliges the Commissioner to prepare a written report explaining why they agree or disagree with a public body's decision about collection, use, or disclosure of an individual’s personal information.
The Commissioner may order three concrete remedies after a review: (1) specify how personal information is to be corrected; (2) require the public body to stop unlawful collection, use, or disclosure under Part 2; and (3) require the head of the public body to destroy personal information collected in contravention of the Act.
The statute requires the Commissioner to provide both the requester and the head of the public body with a copy of the written report and any order made at the end of the review.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Redefines "business day" and adds "common or integrated program or service"
This amendment removes the prior definitions and inserts two targeted replacements. The new "business day" is narrower than a calendar day: weekends, statutory holidays and a specific winter shutdown tied to mandatory leave at the Commissioner's Office do not count. Practically, that adjusts how deadlines are computed for requests and appeals, and may lengthen response windows during the holiday period. The new "common or integrated program or service" definition recognizes that a program or service can be delivered through collaboration between public bodies; the language focuses on the delivery model rather than creating a new corporate identity for joint programs.
Requires a written report explaining the Commissioner's position
The substituted provision makes the Commissioner’s reporting obligation mandatory and substantive: the report must lay out reasons for agreeing or disagreeing with the public body's handling of personal information. That raises the bar for the quality of review outcomes and creates a written record that parties can rely on for administrative transparency and potential judicial review. The provision also formalizes who receives the report — both the individual requester and the head of the public body — ensuring both parties have the Commissioner's rationale in hand.
Expands and specifies the Commissioner's remedial orders
Beyond reporting, the Commissioner gains three explicit powers: to direct correction of personal data, to require cessation of collection/use/disclosure that breaches Part 2, and to require destruction of personal information collected unlawfully. These are forward-looking, operational remedies: correction orders affect the form and accuracy of records; cessation orders force changes to ongoing practices; destruction orders require secure deletion and raise questions about records management and legal holds. The statute does not spell out compliance monitoring or sanctions for noncompliance, leaving those mechanics to administrative practice or other statutory vehicles.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Individuals who request reviews: They gain clearer statutory remedies (correction, cessation, destruction) and a guaranteed written explanation of the Commissioner's reasoning, increasing transparency and practical relief options.
- Office of the Information and Privacy Commissioner: The statute clarifies the office’s remedial authority and reporting mandate, strengthening its formal toolkit for resolving privacy disputes.
- Legal and compliance teams in public bodies: The definition of collaborative services and explicit order types reduce legal uncertainty about obligations when services are delivered jointly, making risk assessments more straightforward.
- Records-management and IT units: Clearer authority to order destruction or correction allows these teams to act under explicit statutory direction rather than ad hoc guidance.
Who Bears the Cost
- Heads of public bodies: They may need to implement orders to correct, stop, or destroy data — actions that can require staff time, secure deletion processes, and possibly legal review if records are implicated in litigation.
- Government IT and records-management teams: Operationalizing destruction orders and ensuring proper correction or cessation can impose technical and procedural costs and require changes to retention schedules and workflows.
- Public bodies involved in integrated service delivery: Clarified responsibilities may increase administrative burdens to demonstrate which entity is accountable for data handling and compliance.
- The Commissioner’s Office: The obligation to produce reasoned written reports and to manage increased remedial activity may increase workload and administrative requirements during reviews.
Key Issues
The Core Tension
The bill balances stronger remedies for individuals and clearer statutory recognition of collaborative services against operational and legal burdens for public bodies: it empowers the Commissioner to force correction or destruction of data to protect privacy, but it does so without detailed compliance, enforcement, or inter-legislative conflict mechanisms, creating a trade-off between effective privacy relief and predictable, administrable government record-keeping.
The bill tightens language in useful ways, but it leaves implementation questions that could create friction. The "business day" adjustment ties deadline calculation to whether a majority of the Commissioner's staff are on mandatory leave; that creates a movable rule dependent on internal staffing decisions and could make deadline predictability uneven for requesters and public bodies.
It also implicitly extends response windows over the winter shutdown without specifying whether agencies should plan around an assumed non-business period for other statutory deadlines.
The expanded order-making powers are substantial in practice but thin on enforcement detail. The statute authorizes correction and destruction orders but does not describe verification mechanisms, timelines for compliance, or consequences for noncompliance.
Destruction orders in particular intersect with records-retention regimes, ongoing litigation holds, and archival obligations; the Act is silent about how to reconcile a Commissioner's destruction order with other legal duties to preserve records. Finally, the definition of "common or integrated program or service" clarifies collaborative delivery but stops short of allocating operational responsibility among partners; disputes about which public body is the "head" for compliance purposes could push more matters back into review or court.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.