The Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024 creates a statutory framework for cyber security, artificial intelligence (AI) use, and protections for digital information about children in Ontario’s public sector. It adds a standalone Enhancing Digital Security and Trust Act and amends the Freedom of Information and Protection of Privacy Act (FOIPPA) to require written assessments, breach reporting, records and new oversight powers for the Information and Privacy Commissioner.
Why it matters: the law forces institutions covered by FOIPPA and the Municipal FOI Act, plus school boards and children’s aid societies, to formalize risk management and documentation, answer new reporting demands, and comply with Ministerial directives and regulations that can specify technical standards, prohibited AI uses and disclosure rules. Privacy officers, compliance teams and IT/security leaders at these bodies will face immediate policy, process and record‑keeping changes; the Commissioner gains sharper tools to review and order corrective action.
At a Glance
What It Does
The Act creates two regulatory tracks: broad regulations via the Lieutenant Governor in Council and technical standards or directives the Minister may issue (directives are not subject to the Legislation Act Part III). It requires public‑sector entities to adopt cyber‑security programs, develop AI accountability frameworks, provide public-facing AI information in prescribed circumstances, and follow rules about digital technology affecting those under 18.
Who It Affects
Specified institutions under FOIPPA and the Municipal FOI Act (excluding the Assembly), municipal institutions, children’s aid societies, and school boards are the primary targets. Service‑provider organizations that handle customer service information and third‑party vendors acting on behalf of public bodies are also implicated through collection, retention and disclosure rules.
Why It Matters
The law elevates formal documentation and oversight as compliance linchpins: mandatory privacy impact assessments, breach recording and reporting, and Commissioner-initiated reviews can trigger orders to change or destroy practices. It also gives the executive branch routes to set prescriptive technical standards and direct implementation, shifting much of the detailed rule‑making from statute to regulation and direction.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The new Enhancing Digital Security and Trust Act defines core terms (for example, “artificial intelligence system” and “cyber security”) and sets out a dual rule‑making approach. The Lieutenant Governor in Council can make broad regulations about cyber security programs, incident reporting and prohibitions; the Minister may add technical standards and issue directives to regulated entities.
Importantly, directives are carved out from Part III of the Legislation Act and the statute requires entities to comply with directives issued under the Act.
On artificial intelligence, the Act does not set a single set of prescriptive rules in the text; instead it imposes process obligations where regulations will fill in the detail. Entities prescribed under the Act must provide information to the public about AI use, build and run accountability frameworks, take prescribed risk‑management steps, and follow any use‑limits the regulations set.
For certain “prescribed circumstances,” institutions must disclose information about an AI system and ensure a named individual exercises oversight and provides further information — the regulations will determine the format, content and update frequency of required disclosures and documentation.The sections specific to children create a regulation and directive pathway for children’s aid societies and school boards to restrict or control the collection, use, retention and disclosure of digital information about individuals under 18. The Minister may set technical standards for data and for digital tools made available to minors; the government can also issue directives to those institutions that they must follow.The FOIPPA amendments add concrete administrative obligations: a new definition of “information practices,” a requirement that heads prepare written assessments before collecting personal information listing purpose, legal authority, types and sources of information, access roles, retention period, safeguards and planned mitigation measures, and implement those mitigation steps either before collection or within a reasonable time after collection if pre‑implementation is impossible.
A new breach provision requires heads to report thefts, losses or unauthorized uses or disclosures to the Commissioner when there is a real risk of significant harm (factors that inform that test are listed in the Act), to notify affected individuals where appropriate, and to keep prescribed records of every reported incident. The Commissioner may review an institution’s information practices (including based on such breach notifications), try informal dispute resolution, compel records and, after hearing, order discontinuation, change or destruction/return of personal information, subject to a reasonableness limit on orders.
The Five Things You Need to Know
Directives issued by the Minister under the new Act are not subject to Part III of the Legislation Act and are binding on named public‑sector entities; entities must comply with those directives.
Before collecting personal information, heads must prepare a written assessment (privacy impact assessment) that includes a specified checklist of items (purpose, legal authority, types and sources of data, access roles, safeguards, retention and mitigation steps) and must implement mitigation steps before or within a reasonable time after collection.
Section 40.1 requires heads to report to the Information and Privacy Commissioner any theft, loss or unauthorized use/disclosure if there is a reasonable belief of a real risk of significant harm and, unless prohibited by law, to notify affected individuals; the Act also requires maintaining a record of every such reported incident.
The Commissioner may open a review of an institution’s information practices under section 49.0.1 (including on receipt of a complaint tied to a breach), compel production of relevant records, seek informal resolution first, and — after hearing — order discontinuation, change, return or destruction of information where necessary to secure compliance.
The Act creates a statutory whistleblowing route (section 57.1) allowing anyone who reasonably believes an institution is contravening the Act to notify the Commissioner and request that their identity be kept confidential; the Commissioner must keep that identity confidential if an assurance is given.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Who and what the Act covers
This early part fixes the scope: a public sector entity is an institution under FOIPPA (excluding the Assembly), an MFIPPA institution, a children’s aid society or a school board. The Act clarifies that an AI system includes publicly available or third‑party systems used by an entity and that ‘digital information’ includes data handled by third parties on an entity’s behalf; those inclusions make downstream obligations apply regardless of whether systems are built in‑house or outsourced.
Two channels for cyber security rules and binding directives
The Lieutenant Governor in Council can make regulations requiring prescribed public bodies to adopt cyber‑security programs and to submit incident reports; those regulations may list program elements (roles, awareness, response, oversight) and set reporting formats and frequencies. Separately, the Minister may issue technical standards and binding directives directly to public sector entities — and the statute explicitly removes directives from the normal regulatory procedure (Part III of the Legislation Act). Practically, that gives the executive branch a faster, more centralized route to impose specific operational requirements.
Process obligations for AI use; many specifics left to regulations
Sections 5–8 require prescribed institutions that use or intend to use AI to provide public information about that use, to create and run accountability frameworks, to take prescribed risk‑management steps, and to obey any prescribed use‑limitations or prohibitions. The Act anticipates regulators setting the content and update cadence of disclosures, requiring documentation across an AI system’s lifecycle, assigning roles within accountability frameworks, and in some cases demanding an identifiable human overseer for a system’s use — but the exact triggers, thresholds and formats are to be set in regulation.
Targeted controls for children’s aid societies and school boards
The Lieutenant Governor in Council may make regulations controlling how specified digital information about people under 18 is handled and may prohibit certain collections or uses outright. The Minister can issue directives to school boards and children’s aid societies about digital tools offered to minors and set technical standards. Because the Act contemplates prohibition powers, entities working with children must monitor regulatory developments closely and be prepared to change procurement and classroom/child welfare practices.
Mandatory assessments before collection and update rules
FOIPPA now requires heads to prepare written assessments before collecting personal information unless regulations say otherwise. Those assessments must enumerate the purpose, legal authority, categories and sources of data, who will access it, retention periods, safeguards and planned steps to prevent or mitigate breaches. Heads must implement mitigation steps before collection or, if impossible, within a reasonable time after; they must update assessments before any significant change to the purpose for the data and provide assessments to the Commissioner on request.
Breach duties, recordkeeping, reporting and remedial orders
Section 40.1 creates a duty to report to the Commissioner when a theft, loss or unauthorized use/disclosure creates a real risk of significant harm, and to notify affected individuals unless prohibited by law; the Act lists factors to guide the real‑risk test and defines significant harm broadly. Section 49.0.1 allows the Commissioner to review an institution’s information practices based on such complaints or other reasons, to pursue informal resolution first, to compel documents and to make orders — including discontinuing an information practice or ordering return/destruction of data — but limits orders to what is reasonably necessary to achieve compliance.
This bill is one of many.
Codify tracks hundreds of bills on this topic across all five countries.
Explore this topic in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Children and students — the Act empowers regulators to limit or prohibit collection and use of digital data about minors and to impose technical standards on tools used with children, potentially reducing risky data practices in schools and child welfare settings.
- Individuals affected by breaches — heads must report incidents that present a real risk of significant harm and notify individuals; the Commissioner will receive better incident records, increasing transparency and opportunity for redress or corrective action.
- Information and Privacy Commissioner (OIPC) and privacy oversight bodies — the Commissioner gains clearer statutory authority to review information practices, compel records, enter agreements with other privacy officials, and order corrective measures, expanding enforcement and coordination capabilities.
Who Bears the Cost
- Public‑sector institutions covered by FOIPPA/MFIPPA, school boards and children’s aid societies — they must produce PIAs, implement mitigation steps, submit reports, update assessments, and comply with Ministerial directives and technical standards, imposing legal, administrative and IT costs.
- Third‑party vendors and service providers — the Act treats digital information handled by third parties as subject to the institutions’ obligations, increasing contractual compliance, security and documentation burdens for suppliers.
- Information and Privacy Commissioner’s office — while given new powers, the OIPC will likely face higher workloads (reviews, records requests, coordination with other jurisdictions), requiring resources to operationalize the statute’s new duties; provincial government may not have allocated funding in the text.
Key Issues
The Core Tension
The central tension is between centralized, fast‑moving governance and procedural safeguards: the statute aims to accelerate security and AI oversight by shifting detailed rule‑making to Ministerial standards and binding directives, but doing so reduces the open regulatory process and places heavy compliance burdens on public bodies while limiting private civil remedies — a trade‑off between speed/consistency and transparency/accountability.
Delegation and detail-by-regulation: the Act delegates a great deal of substantive rule‑making to regulations and Ministerial directives. That offers flexibility for technical standards to evolve, but it means many operationally critical thresholds — which AI uses are ‘prescribed’, what constitutes a ‘prescribed circumstance’, exact notification forms and timelines, and the definitions of records to be kept — will be set later.
Organizations must track and adapt to forthcoming regulations and directives; legal risk hinges on draft/regulatory choices rather than the Act’s high‑level language.
Enforceability and remedies: the Commissioner receives powers to review and order corrective action, but the statute does not create new private‑law causes of action or civil damages tied to breaches (the Act explicitly says it does not establish a private law duty of care). That concentrates redress through administrative routes.
The Act also says failure to comply does not invalidate underlying policy or decisions, which raises questions about the practical bite of some orders and the interplay with other Acts where other rules prevail. Finally, directives are exempted from the normal regulatory procedural safeguards, which could speed implementation but reduce transparency and stakeholder input.
Operational uncertainty in key tests: the breach notification duty turns on a “real risk of significant harm,” a fact‑dependent and somewhat subjective test. The Act lists factors to inform that determination, but institutions will need OIPC guidance or precedent to apply the test consistently.
The Commissioner’s confidentiality guarantee for whistleblowers creates a safer reporting avenue, but the statute does not itself create workplace retaliation protections; employers must still rely on other laws for protection. Those gaps will shape how effectively the new regime protects individuals and holds institutions accountable.
There's more to this law than the bill.
Codify Laws traces every connection across the legislative lifecycle.