This Act replaces earlier provincial FOI and privacy statutes and sets a single framework governing public access to records held by public bodies and protection of personal information. It creates a standalone Information and Privacy Commissioner, prescribes 30‑business‑day response deadlines (with explicit extension rules), standardizes fees and fee waivers, and lists the routine exemptions and third‑party notice procedures that govern refusals.
Beyond restating typical FOI rules, the Act imposes mandatory privacy assessments before new or substantially changed programs that collect, use or disclose personal information; defines and regulates data‑linking programs; restricts storage, disclosure and access to personal information outside Canada except as provided by regulation; establishes a provincial identity services provider scheme; and introduces a statutory privacy breach notification duty to affected individuals and the Commissioner where significant harm is reasonably possible. Those features materially change how public bodies must design digital services, contracts and research projects involving linked datasets or identity information.
At a Glance
What It Does
The Act gives people a statutory right to access records and to request correction of personal information, sets response timelines (30 business days), creates an independent Information and Privacy Commissioner with investigatory powers, and requires public bodies to conduct privacy assessments before launching or substantially changing programs that handle personal information. It also defines data‑linking programs and regulates cross‑border storage and disclosure of personal information.
Who It Affects
Provincial departments, universities, hospitals, municipalities and other designated public bodies, their contractors and auditors, researchers seeking identifiable data or data‑linking approvals, organizations operating as or contracting with a provincial identity information services provider, and any Nova Scotia resident whose personal information is held by a public body.
Why It Matters
The Act modernizes oversight for digital government: mandatory privacy assessments and data‑linking rules change procurement and project design; cross‑border restrictions affect cloud contracts; the identity services regime centralizes identity functions under Ministerial direction; and the Commissioner gains stronger production and review powers—shifting operational, compliance and legal risk across public bodies, vendors and researchers.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The Act consolidates freedom‑of‑information and privacy protections into a single, province‑wide statute that applies to records in the custody or control of a broad class of public bodies (departments, municipalities, hospitals, universities and bodies designated by regulation). It preserves the familiar right to request records and to seek correction of personal information, but sets a modern administrative structure: 30 business days to respond (with specific grounds for 30‑business‑day extensions and further extensions with the Commissioner’s approval), application and service fees with defined waivers, and a formal third‑party notice and review process.
On privacy, the Act requires public bodies to adopt privacy policies, publish internal complaint procedures and conduct a privacy assessment before launching or substantially changing any project, program or system that collects, uses or discloses personal information. It prohibits collecting personal information except where authorized by law, necessary to an operating program, or in specific prescribed circumstances, and limits indirect collection unless authorized.
The Act creates a new concept of a data‑linking program and requires such programs to comply with regulations; it permits disclosure for research under tight conditions, including head‑approved security and data‑destruction rules and signed confidentiality agreements.Two provisions materially affect digital operations and procurement. First, Section 76 forbids storing, disclosing or permitting access to public‑body personal information outside Canada unless the regulations allow it—placing cloud contracts and cross‑border analytics under regulatory control and transitional rules that grandfather older contracts until the end of their terms (with a May 1, 2027 cutoff for new international disclosure rules).
Second, the Act authorizes the Minister to designate a provincial identity information services provider and to give directions about the types of identity information, credential issuance, formats and privacy/security requirements—potentially centralizing government identity functions.Oversight and enforcement are concentrated in the provincially appointed Information and Privacy Commissioner, an officer of the House of Assembly with a 5–7 year term, powers to require production and inspect premises (subject to legal privilege), an ability to mediate and to conduct access, correction and privacy reviews, and an obligation to publish an annual report. The Act also creates criminal offences for willful privacy contraventions, unauthorized access, obstruction of the Commissioner and intentional destruction or falsification of records, with summary fines up to $10,000 (individuals) and $50,000 (corporations).
Finally, the Act contains a set of transitional and consequential amendments, repeals predecessor statutes and comes into effect April 1, 2027.
The Five Things You Need to Know
The Act requires public bodies to conduct a privacy assessment before undertaking or substantially changing any project, program, system or activity that involves collection, use or disclosure of personal information (Section 53).
Public bodies must notify affected individuals and the Commissioner of a privacy breach when it is reasonable to believe the breach could cause significant harm; the Commissioner may also notify affected individuals (Section 78).
Storing, disclosing or permitting access to personal information outside Canada is prohibited unless regulations permit it, and new international disclosure rules apply to contracts with a contract‑commitment date on or after May 1, 2027 (Sections 76 and 147).
A provincial identity information services provider regime is established: the Minister may designate providers and give directions about what identity data and credentials may be used and how they must be secured (Section 137).
The Information and Privacy Commissioner is an independent officer of the House of Assembly appointed for 5–7 years, with powers to require production and inspection, to mediate and review decisions, and to issue reports—while judicial appeals proceed de novo to the Supreme Court (Sections 120–128, 86, 87, 97).
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Scope, purpose and covered bodies
These opening sections set the Act's twin purposes—accountability through access and protection of personal privacy—and define the breadth of covered public bodies (departments, hospitals, universities, municipalities and those designated by regulation). The text explicitly applies to court administration records (section 4(2)) but lists a set of specific exclusions (judicial deliberations, court files, records of certain oversight offices). For implementers, this means a wide footprint for compliance but with discrete carve‑outs that require institutions to map records and identify where other statutory regimes take precedence.
Access requests, timelines, fees and process mechanics
The Act gives any person a statutory right to request records and to request corrections of personal information, and requires heads to 'make every reasonable effort' to assist applicants. It fixes 30 business days as the baseline response time, allows a single automatic 30 business‑day extension on listed operational grounds, and permits further extensions with the Commissioner's approval. Requesters must pay an application fee (unless requesting their own personal information) and may face service fees for search and reproduction but receive the first three hours of work free; heads must provide fee estimates and may require prepayment. The Act also codifies third‑party notice and appeal rights, procedures to transfer requests between bodies, and specific rules for electronic records and data in reusable formats—details that matter when public bodies set intake, search and disclosure workflows.
Exemptions and third‑party notices
This cluster contains the familiar suite of discretionary and mandatory exemptions—cabinet/Executive Council confidentiality, law‑enforcement sensitivities, legal privilege, trade secrets, labour‑relations material, and personal‑privacy refusals—together with timelines and presumptions (for instance, many exemptions lapse for records older than five or 15 years). The Act requires heads to notify third parties where personal information disclosure may affect their interests and creates a 20‑business‑day window for those third parties to seek review after a head decides to release. For records managers, the sections demand careful redaction/severing practices and record inventories that support age‑based disclosure assessments.
Privacy safeguards, privacy assessments and data‑linking
Part II compels public bodies to adopt privacy policies, publish internal complaint procedures and, critically, to perform privacy assessments before initiating or materially changing programs that touch personal information. It narrows when personal data may be collected, requires notice to individuals at collection, restricts indirect collection except in specified cases, and obliges reasonable security arrangements. The Act defines 'data linking' and 'data‑linking programs' and places them under regulatory control, sets conditions for disclosure of identifiable information for research (head‑approved security, early identifier removal and written confidentiality agreements), and prohibits cross‑border storage/disclosure/access unless regulations permit—creating concrete controls over analytics, linkage projects and vendor contracts.
Privacy breaches and criminal penalties
The statute establishes a risk‑based notification duty: where a head reasonably believes affected individuals could suffer significant harm, the head must notify those individuals and the Commissioner (notification standards to be set by regulation). The Commissioner may also notify affected individuals. The Act authorizes the Supreme Court to order return or destruction of improperly obtained personal information. It creates summary criminal offences for willful contraventions, unauthorized access, obstruction and deliberate destruction or falsification of records intended to evade access requests, with fines up to $10,000 for individuals and $50,000 for corporations—penalties that sit alongside administrative review and court appeal routes.
Commissioner reviews and judicial appeals
Applicants, third parties and complainants may ask the Commissioner to review access, correction and privacy decisions. The Commissioner can mediate or conduct reviews in private, require production and inspect premises (subject to legal‑privilege limits), and issue written reports with recommendations. Heads must respond to reports within 30 business days or be deemed to refuse; many decisions may then be taken to the Supreme Court on a de novo review. Burden‑of‑proof rules are spelled out for review and appeal stages, which increases legal clarity but may channel disputes into resource‑intensive judicial proceedings.
Information and Privacy Commissioner: appointment, powers and accountability
The Governor in Council appoints a full‑time Commissioner for a 5–7 year term; the Commissioner is an officer of the House of Assembly and can be removed for cause with Assembly involvement. The Commissioner may hire staff, delegate many powers (except certain duties), present budget estimates to a designated committee, publish an annual report and exercise investigatory powers (production, inspection, mediation, review). Those institutional arrangements aim to balance independence with legislative oversight but also create an office that will require sustainable funding and operational capacity to meet expanded responsibilities.
Transition rules and effective date
The Act repeals the former FOI and several related statutes and includes transitional measures: requests and reviews already underway under prior law proceed under the old rules; the 'new international disclosure rules' apply to contracts with commitment dates on or after May 1, 2027 (older contracts remain under previous rules until their term ends); and the Act takes effect April 1, 2027. These provisions create a defined migration path for procurement and contracts but require public bodies to inventory contracts by commitment date to determine applicable rules.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Residents and journalists: gain a consolidated statutory right to access records and to request corrections with clearer timelines, standardized fee rules and a single review body (the Commissioner) to raise disputes.
- Privacy‑sensitive individuals (victims of intimate‑partner violence, human trafficking or similar risks): receive explicit protections that allow collection and disclosure only where necessary to reduce risk and include exemptions that avoid disclosure that could endanger safety.
- Researchers and statisticians (subject to conditions): can obtain identifiable information or engage in data linking for public‑interest research if they meet strict head‑approved security, de‑identification and contractual conditions.
- Indigenous governing bodies and claimants: the Act recognises Indigenous governing bodies in definitions and explicitly includes consideration of disclosures that could assist research of Indigenous claims (Section 48(4)(d)), potentially improving access when disclosure would assist Indigenous grievances.
- Archival and historical researchers (limited benefit): the Public Archives and similar repositories may disclose older records for historical research under defined conditions, easing access to aged records.
Who Bears the Cost
- Provincial departments and local public bodies (including small municipalities, hospitals and universities): face new operational duties—conducting privacy assessments, updating privacy policies, handling privacy breaches, complying with data‑localization rules and responding to more formalized access/correction requests—requiring staff, training and possibly new technology.
- Procurement and IT vendors: cloud providers and data‑processing contractors will need to adjust contracts for cross‑border restrictions, meet regulatory requirements for data‑linking programs and satisfy provincial identity services directions, which may raise costs or limit supplier pools.
- The Office of the Information and Privacy Commissioner and the legislature: will need additional funding and administrative capacity to manage mediation, reviews, production orders, annual reporting and budgetary processes tied to a designated committee.
- Public bodies' legal teams and the courts: the Act's detailed review and appeal rights (de novo Supreme Court appeals) likely increase litigation and counsel workloads, producing additional legal cost and judicial resources.
- Researchers and institutions using linked datasets: must build compliance mechanisms (head approvals, security controls, destruction policies, agreements) that add administrative overhead and may slow project timelines.
Key Issues
The Core Tension
The central dilemma is between transparency and privacy/security in a digital government: the Act strengthens privacy oversight (mandatory assessments, data‑linking controls, cross‑border limits and breach notifications) at the same time as it preserves and formalizes robust exemptions and gives public bodies discretion over fees and severing—so the law tries to protect individuals and government data sovereignty without unduly crippling access or government digital operations, but achieving both will depend on detailed regulations, funding and administrative practice.
The Act stitches together modern digital‑era rules into the well‑worn FOI/privacy fabric, but it leaves several high‑stakes implementation choices to regulation and administrative practice. Key operational levers—how privacy assessments must be done, what the regulations will permit regarding cross‑border storage and disclosure, the regulatory regime for data‑linking programs, and the specific form and fee levels—are all delegated to the Governor in Council.
That delegation concentrates policy risk: outcomes will depend heavily on forthcoming regulations, procurement guidance and Ministerial directions about provincial identity services. Public bodies must therefore plan for compliance uncertainty while still inventorying records, contracts and data flows before April 1, 2027.
The Act strengthens individual protections (notification duties, mandatory privacy assessments, tighter rules for research disclosures), yet it also preserves and formalizes a suite of exemptions (Executive Council confidentiality, law‑enforcement and trade‑secret protections) and establishes thresholds (five‑ and 15‑year age‑based limits) that may blunt access in practice. Cabinet secrecy, for example, remains protected for up to 15 years with limited exceptions—this resolves some transparency demands but creates predictable friction when retrospective oversight requires earlier disclosure.
The cross‑border restriction is specifically potent: it protects data sovereignty but could raise costs and constrain cloud service architectures unless regulations articulate workable transfer mechanisms and standardized contractual safeguards.
Finally, the Act emphasizes independent review through the Commissioner and court appeals, but it does not create administrative monetary penalties or fast‑track enforcement remedies for systemic non‑compliance. Criminal summary offences are available for willful and serious misconduct, yet routine failures—missed timelines, incomplete privacy assessments or insufficient security—largely produce administrative reviews and judicial remedies that can be slow and resource‑intensive.
This design places a premium on adequate funding for the Commissioner's office, clear regulatory standards and pragmatic guidance to translate the statute into day‑to‑day operational practice.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.