Personal Information Protection Act Regulation

(Consolidated up to 147/2026) ALBERTA REGULATION 366/2003 Personal Information Protection Act PERSONAL INFORMATION PROTECTION ACT REGULATION Table of Contents 1 Definition 2 Application of Act to ATB Financial Part 1 Definition for the Purposes of the Act 3 “ managing ” Part 2 Personal Information that is Publicly Available 6 Definitions 7 Publicly available personal information Part 3 Access to Records 8 Designated and non‑designated offices 9 Copy of record may be provided 10 Alternative means for making a request Part 4 Archival Purposes and Research 11 Definitions 12 Collection, use and disclosure by archival institution 13 Prohibition re use and disclosure 14 Collection, use and disclosure by non‑archival institution Part 5 Fees 15 Providing of estimate 16 Acceptance of estimate, etc. 17 Fees owing Part 6 Notification of Loss of or Unauthorized Access to or Disclosure of Personal Information 19 Notice to the Commissioner 19.1 Notification to individuals Part 7 Professional Regulatory Organization 20 Interpretation 21 Establishment of professional regulatory organization program 22 Personal information code 23 Application for authorization 24 Granting of authorization 25 Effect of authorization 26 Revocation of authorization 27 Publication in The Alberta Gazette 28 Act and personal information code prevail Part 8 Coming into Force and Expiry 29 Coming into force 30 Expiry Definition 1 In this Regulation, “Act” means the Personal Information Protection Act . AR 366/2003 s1;51/2010 Application of Act to ATB Financial 2 (1) The Act applies to ATB Financial and its subsidiaries and to any personal information in the custody of or under the control of ATB Financial or any of its subsidiaries. (2) Notwithstanding subsection (1), any records of ATB Financial and of any of its subsidiaries that are subject to the Access to Information Act or the Protection of Privacy Act remain subject to those Acts. AR 366/23 s2;142/2025 Part 1 Definition for the Purposes of the Act “ managing ” 3 For the purposes of sections 1(1)(j), 15(1)(a), 18(1)(a) and 21(1)(a) of the Act, “managing” includes administering. AR 366/2003 s3;51/2010 4 and 5 Repealed AR 51/2010 s5. Part 2 Personal Information that is Publicly Available Definitions 6 In this Part, (a) “Corporate Registry” means (i) the records maintained by the Registrar of Corporations pursuant to a statute of Alberta or a regulation of Alberta, and (ii) the records maintained by the Registrar of Companies pursuant to a statute of Alberta or a regulation of Alberta; (b) “established purpose” means, when used in reference to a registry, the purpose for which a registry is established and operated as that purpose, (i) in the case of a Government registry, is, directly or indirectly, set out or otherwise described or provided for pursuant to (A) a statute of Alberta or a regulation of Alberta, or (B) any policy governing or relating to the operation of the registry that is made pursuant to a statute of Alberta, a regulation of Alberta or by the Government, and (ii) in the case of a non‑governmental registry, is set out pursuant to a statute of Alberta or a regulation of Alberta; (c) “Government registry” means (i) the Personal Property Registry, (ii) the Corporate Registry, and (iii) the Land Titles Registry, and includes any other registry not referred to in subclauses (i) to (iii) that is operated by the Government and to which the public has access; (d) “Land Titles Registry” means the register and the other records required or authorized to be kept by the Registrar of Titles under the Land Titles Act ; (e) “non‑governmental registry” means a registry (i) that is operated pursuant to a statute of Alberta or a regulation of Alberta by (A) an organization, or (B) a local public body as defined in the Protection of Privacy Act , and (ii) to which a right of public access is authorized by law. AR 366/2003 s6;51/2010;142/2025 Publicly available personal information 7 For the purposes of sections 14(e), 17(e) and 20(j) of the Act, personal information does not come within the meaning of “the information is publicly available” except in the following circumstances: (a) the personal information is contained in a telephone directory but only if (i) the information consists of the name, address and telephone number of a subscriber to the directory, (ii) the directory is available to the public, and (iii) the subscriber can refuse to have the personal information appear in the directory; (b) the personal information, including, but not limited to, the name, title, address, telephone number and e‑mail address of an individual, is contained in a professional or business directory, listing or notice but only if (i) the directory, listing or notice is available to the public, and (ii) the collection, use or disclosure of the personal information relates directly to the purpose for which the information appears in the directory, listing or notice; (c) the personal information is contained in a registry that is (i) a Government registry, or (ii) a non‑governmental registry, but only if the collection, use or disclosure of the information relates directly to the purpose for which the information appears in the registry and that purpose is an established purpose of the registry; (d) the personal information is contained in a record of a quasi‑judicial body but only if (i) the record is available to the public, and (ii) the collection, use or disclosure of the information relates directly to the purpose for which the information appears in the record; (e) the personal information is contained in a publication, including, but not limited to, a magazine, book or newspaper, whether in printed or electronic form, but only if (i) the publication is available to the public, and (ii) it is reasonable to assume that the individual that the information is about provided that information; (f) personal information that is under the control of an organization and that has been collected from outside of Alberta, that if collected from within Alberta would have been collected under the authority of clause (a), (b), (c), (d) or (e), or any 2 or more of those clauses. Part 3 Access to Records Designated and non‑designated offices 8 (1) For the purpose of enabling an individual to make a request under section 24(1) or 25(1) of the Act, an organization may designate one or more offices of the organization to which the individual may direct a written request. (2) If an organization designates an office under subsection (1), the organization must (a) make public the address of that office and the methods by which that office can receive requests, and (b) require that a request received by another office of the organization be forwarded to the designated office as quickly as possible. (3) If an organization designates an office under subsection (1), (a) a written request may be delivered to that office during normal business hours of that office, and (b) the time limit for responding to a request does not commence until the request is received by that office. (4) If an organization has not designated an office under subsection (1), (a) a written request may be delivered to any office of the organization during normal business hours of that office, and (b) the time limit for responding to a request commences when an office of the organization receives the request. AR 366/2003 s8;51/2010 Copy of record may be provided 9 (1) Instead of allowing an applicant to examine a record, an organization may provide to the applicant a copy of the record in the situation where allowing for examination of the record by the applicant (a) would unreasonably interfere with the operations of the organization, (b) may result in the disclosure of information to which access is not permitted or is refused under the Act, or (c) may result in harm to or destruction of the record. (2) Where, in respect of subsection (1)(b), a copy of a record is provided to an applicant by an organization, the copy of the record is not to include information to which access is not permitted or is refused under the Act. Alternative means for making a request 10 Notwithstanding anything in this Part, an organization may provide alternative means for an applicant to make a request under section 24(1) or 25(1) of the Act if the applicant is unable to make a written request. AR 366/2003 s10;51/2010 Part 4 Archival Purposes and Research Definitions 11 For the purposes of the Act and this Part, (a) “archival institution” means an institution (i) to which archival records are transferred for permanent preservation, and (ii) that provides public access to its archival collections; (b) “archival records” means records of historic or archival importance; (c) “for archival purposes” means for the purposes (i) of preserving archival records, and (ii) making those records accessible in an archival institution to the public. Collection, use and disclosure by archival institution 12 (1) An archival institution may, for archival purposes, collect and use personal information about an individual without the consent of the individual and, as part of carrying out the archival purposes, may engage in the appraisal, acquisition, conservation, arrangement and description of records. (2) An archival institution may disclose personal information about an individual without the consent of the individual for a research purpose but only if (a) in the case of individually identifiable information, the disclosure is necessary for the research purpose, (b) the disclosure is not harmful to the individual concerned, (c) the research purpose is not contrary to the purposes and intent of the Act, and (d) either (i) a reasonable person, taking into consideration all relevant circumstances, would find that disclosure of the personal information was appropriate at the time, or (ii) the information is disclosed under a research agreement. (3) If personal information is to be disclosed under a research agreement, the person to whom the information is to be disclosed must agree to do all of the following: (a) to use the information only for the research purpose; (b) to make reasonable security arrangements to protect the information; (c) to maintain the confidentiality of the information; (d) to not contact any individual to whom the information relates; (e) to remove or destroy, at the earliest reasonable time, individual identifiers; (f) to not disclose the information in individually identifiable form; (g) to notify the archival institution immediately of a breach of the agreement. AR 366/2003 s12;108/2004 Prohibition re use and disclosure 13 An archival institution shall not use or disclose personal information that is contained in its archival records for any purpose other than for archival purposes or research purposes. Collection, use and disclosure by non-archival institution 14 (1) An organization that is not an archival institution may, for archival purposes, collect and use personal information about an individual without the consent of the individual and, as part of carrying out the archival purposes, may engage in (a) the acquisition of records of historical importance for transfer to an archival institution, and (b) the preparation of organizational records for archival appraisal and transfer to an archival institution. (2) An organization that is not an archival institution may, for archival purposes, disclose personal information about an individual without the consent of the individual and, as part of carrying out the archival purposes, may engage in (a) the obtaining of an archival appraisal of the organization’s record, and (b) the transferring of custody and control of the organization’s records to an archival institution. (3) An organization that is not an archival institution may, under a research agreement, disclose personal information about an individual without the consent of the individual but only if (a) the person to whom the information is to be disclosed agrees to comply with the same requirements as those established in respect of archival institutions under section 12(3), (b) the research has been approved by a recognized research ethics review committee, and (c) the researcher has agreed to any additional conditions imposed by the ethics review committee. Part 5 Fees Providing of estimate 15 If an organization pursuant to section 32 of the Act intends to charge a fee for processing a request for access to personal information or for information about the use or disclosure of the applicant’s personal information and provides a written estimate to an applicant, processing of the request ceases once the notice of estimate has been sent to the applicant and is not to recommence until (a) the estimate has been accepted, and (b) where a deposit is required, the deposit has been paid. AR 366/2003 s15;51/2010 Acceptance of estimate, etc. 16 Where (a) an applicant has been given an estimate by an organization under section 32(3) of the Act, and (b) the organization has not received a response from the applicant within 30 days from the day that the estimate was given to the applicant, the organization may consider the applicant’s request to have been withdrawn. Fees owing 17 (1) Where, prior to the providing of information pursuant to a request, all or a portion of the fee payable in respect of that request remains owing, the balance of the fee that is owing is payable at the time that the information is delivered to the applicant. (2) An organization may decline to deliver any information pursuant to a request until the total fee payable in respect of that request is paid. 18 Repealed AR 51/2010 s10. Part 6 Notification of Loss of or Unauthorized Access to or Disclosure of Personal Information Notice to the Commissioner 19 A notice provided by an organization to the Commissioner under section 34.1(1) of the Act must be in writing and include the following information: (a) a description of the circumstances of the loss or unauthorized access or disclosure; (b) the date on which or time period during which the loss or unauthorized access or disclosure occurred; (c) a description of the personal information involved in the loss or unauthorized access or disclosure; (d) an assessment of the risk of harm to individuals as a result of the loss or unauthorized access or disclosure; (e) an estimate of the number of individuals to whom there is a real risk of significant harm as a result of the loss or unauthorized access or disclosure; (f) a description of any steps the organization has taken to reduce the risk of harm to individuals; (g) a description of any steps the organization has taken to notify individuals of the loss or unauthorized access or disclosure; (h) the name of and contact information for a person who can answer, on behalf of the organization, the Commissioner’s questions about the loss or unauthorized access or disclosure. AR 366/2003 s19;51/2010 Notification to individuals 19.1 (1) Where an organization is required under section 37.1 of the Act to notify an individual to whom there is a real risk of significant harm as a result of a loss of or unauthorized access to or disclosure of personal information, the notification must (a) be given directly to the individual, and (b) include (i) a description of the circumstances of the loss or unauthorized access or disclosure, (ii) the date on which or time period during which the loss or unauthorized access or disclosure occurred, (iii) a description of the personal information involved in the loss or unauthorized access or disclosure, (iv) a description of any steps the organization has taken to reduce the risk of harm, and (v) contact information for a person who can answer, on behalf of the organization, questions about the loss or unauthorized access or disclosure. (2) Notwithstanding subsection (1)(a), where an organization is required to notify an individual under section 37.1 of the Act, the notification may be given to the individual indirectly if the Commissioner determines that direct notification would be unreasonable in the circumstances. AR 51/2010 s11 Part 7 Professional Regulatory Organization Interpretation 20 (1) In this Part, (a) “authorization” means an authorization referred to in section 21(a); (b) “code” means a personal information code as defined in section 55 of the Act. (2) For the purposes of this Part, operating in accordance with a code includes the collection, use and disclosure of personal information pursuant to the code insofar as the code provides for the collection, use and disclosure. Establishment of professional regulatory organization program 21 There is hereby established a program under which the Minister may (a) grant an authorization to a professional regulatory organization authorizing the professional regulatory organization to operate in accordance with a personal information code; (b) direct that, during the period that a code is in effect for a professional regulatory organization, (i) the code, with respect to matters provided for under the code, is to operate in the place of sections 1 to 35, or any one or more of those provisions, of the Act insofar as the code provides for those matters, and (ii) compliance by the professional regulatory organization with the code, the terms or conditions, if any, imposed by the Minister and the directions, if any, of the Commissioner given under section 55 of the Act is deemed to be compliance with sections 1 to 35, or any one or more of those provisions, of the Act insofar as the code operates in the place of those provisions; (c) impose any terms or conditions in respect of a code, an authorization referred to in clause (a) or a direction referred to in clause (b). Personal information code 22 (1) A personal information code must, at least, meet the following criteria: (a) the code must, with respect to sections 1 to 35 of the Act, address in whole or in part, the matters dealt with by those provisions; (b) the code must include a provision stating which sections of the Act the code addresses; (c) the code must include provisions relating to the way the code is established and the way in which it will be reviewed by the professional regulatory organization; (d) the code must include a provision for publishing the code in printed or electronic form. (2) A code may include (a) additional provisions for the protection of personal information that are consistent with the purposes and intent of sections 1 to 35 of the Act; (b) provisions for a complaint or review procedure to be operated by the professional regulatory organization. Application for authorization 23 (1) A professional regulatory organization that wishes to operate under a code must apply to the Minister for an authorization in respect of that code. (2) In making an application for an authorization, the applicant must (a) file with the Minister a copy of the code in a form or format that is acceptable to the Minister, and (b) provide to the Minister a proposed date on which the code is to come into force and any other information that the Minister requests. (3) The application for an authorization must be signed by a person authorized to sign on behalf of the governing body of the professional regulatory organization. Granting of authorization 24 After receiving an application from a professional regulatory organization for an authorization in respect of a code, the Minister may, subject to any terms or conditions that the Minister considers appropriate, (a) grant an authorization to the professional regulatory organization authorizing the professional regulatory organization to operate in accordance with the code, and (b) direct that, during the period that the code is in effect, (i) the code with respect to matters provided for under the code, will operate in the place of sections 1 to 35, or any one or more of those provisions, of the Act insofar as the code provides for those matters, and (ii) compliance by the professional regulatory organization with the code, the terms or conditions, if any, imposed by the Minister and the directions, if any, of the Commissioner given under section 55 of the Act is deemed to be compliance with sections 1 to 35, or any one or more of those provisions, of the Act insofar as the code operates in the place of those provisions. Effect of authorization 25 (1) During the period that an authorization for a code is in effect, (a) the code is in effect, (b) the professional regulatory organization may operate in accordance with the code, and (c) the direction given under section 24(b) is in effect. (2) During the period that code is in effect, (a) the code, with respect to matters provided for under the code, operates in the place of sections 1 to 35, or any one or more of those provisions, of the Act insofar as the code provides for those matters, and (b) compliance by the professional regulatory organization with the code, the terms or conditions, if any, imposed by the Minister and the directions, if any, of the Commissioner given under section 55 of the Act is deemed to be compliance with sections 1 to 35, or any one or more of those provisions, of the Act insofar as the code operates in the place of those provisions. Revocation of authorization 26 (1) The Minister may revoke an authorization either (a) at the request of the professional regulatory organization, or (b) where the Minister considers it appropriate to do so. (2) The Minister may make the revocation subject to any terms or conditions that the Minister considers appropriate in order to permit the revocation to take effect in an orderly manner. (3) On the revocation of an authorization, (a) the code, subject to any terms or conditions imposed by the Minister, ceases to be in effect, and (b) to the extent that code ceases to be in effect, the direction given under section 24(b) ceases to operate. (4) Where the Minister intends to revoke an authorization, the Minister must notify (a) the professional regulatory organization to which the authorization was granted, and (b) the Minister who is responsible for the statute under which the professional regulatory organization was established or otherwise operates. Publication in The Alberta Gazette 27 The Minister must publish in Part 1 of The Alberta Gazette a copy of every (a) authorization granted and the code for which the authorization was granted; (b) direction given under section 24(b); (c) revocation of an authorization. Act and personal information code prevail 28 If a provision of (a) any legislative instrument of a professional regulatory organization, other than a personal information code, or (b) any rule of conduct or practice, policy, directive or instruction of any nature of a professional regulatory organization is in conflict with a provision of the Act, the personal information code of the professional regulatory organization or the operation of the Act as modified by the personal information code, the Act and the personal information code prevail. AR 366/2003 s28;51/2010 Part 8 Coming into Force and Expiry Coming into force 29 This Regulation comes into force on January 1, 2004. Expiry 30 For the purpose of ensuring that this Regulation is reviewed for ongoing relevancy and necessity, with the option that it may be repassed in its present or an amended form following a review, this Regulation expires on June 30, 2028. AR 366/2003 s30;51/2010;240/2018;120/2024;147/2026