Access and Privacy Regulation

Access and Privacy Regulation, M.R. 64/98 The Freedom of Information and Protection of Privacy Act , C.C.S.M. c. F175 Regulation 64/98 Registered April 17, 1998 bilingual version (HTML) Table of Contents Section DEFINITIONS AND APPLICATION 1 Definitions 1.1 Repealed 1.2 Application ACCESS AND PRIVACY COORDINATOR 2 Access and privacy coordinator REQUESTS FOR ACCESS 3 Request for access NOTIFICATION OF PRIVACY BREACH 3.1 Risk of significant harm — factors 3.2 Form and manner of direct notice to individuals 3.3 When indirect notification may be given FEES 4 Search and preparation fee 5 Copying fees 6 Computer programming and data processing fees 7 Matters for which no fee is payable ESTIMATE OF FEES 8 Estimate of fees WAIVER OF FEES 9 Waiver of fees 10 Repealed DESIGNATIONS 11 Designation of government agencies 12-12.2 Repealed 12.3 Designation of local government bodies 13 Repealed REPEAL AND COMING INTO FORCE 14 Repeal 15 Coming into force Schedule A Forms B Government Agencies C Repealed D Repealed E Repealed F Local Government Bodies DEFINITIONS AND APPLICATION Definitions 1 In this regulation, "access and privacy officer" means a person to whom the head has delegated a duty or power under section 81 of the Act; (« agent d'accès à l'information et de protection de la vie privée ») "Act" means The Freedom of Information and Protection of Privacy Act . («  Loi  ») M.R. 165/2010 ; 138/2021 1.1 [Repealed] M.R. 157/2013 ; 207/2015 Application 1.2(1) For the purposes of clause 13(1.1)⁠(b) and subclause 15(1)⁠(b)⁠(ii) of the Act, a public body may consider two or more applicants to be associated if the public body reasonably believes that they have acted in concert in making one or more requests for access. 1.2(2) In assessing if applicants are acting in concert, a public body must consider the commonality of interest shared by the applicants in the requested information, as determined by having regard for the following: (a) the identity of the applicants and any known relationship between them; (b) any commonality of employment shared by the applicants; (c) any commonality of interests shared by the applicants, including memberships in or affiliations with the same or similar organizations or entities. M.R. 138/2021 ACCESS AND PRIVACY COORDINATOR Access and privacy coordinator 2(1) A public body must appoint a person as an access and privacy coordinator. 2(2) The access and privacy coordinator is responsible for (a) receiving requests for access to records; and (b) the day-to-day administration of the Act for the public body. M.R. 138/2021 REQUESTS FOR ACCESS Request for access 3(1) If practicable, a person making a request for access under section 8 of the Act must submit the request to the public body's access and privacy coordinator using the public body's address specified at: www.gov.mb.ca/fippa . 3(2) A public body must ensure that a request for access is date stamped on the day it is received by the public body. 3(3) A public body may require an applicant to provide suitable identification if the public body considers it necessary to verify the applicant's identity, or that of a third party, to respond to the request. M.R. 165/2010 ; 138/2021 NOTIFICATION OF PRIVACY BREACH Risk of significant harm — factors 3.1 For the purpose of subsection 41.1(2) of the Act (notifying individual of privacy breach), for determining if a privacy breach could reasonably be expected to create a real risk of significant harm to an individual, the relevant factors to be considered are (a) the sensitivity of the personal information involved; (b) the probability that the personal information could be used to cause significant harm to the individual, having regard for (i) the event that caused the privacy breach to occur, including whether there is evidence of any malicious intent, such as the breach being the result of theft or gaining unauthorized access to a computer system, (ii) the number of persons who actually or potentially accessed the personal information, (iii) if the identity of the persons who actually or potentially accessed the personal information is known or unknown, (iv) any known relationship between any of the persons who actually or potentially accessed the personal information and the individual to whom the information relates, and the nature of the relationship, (v) if the public body is reasonably satisfied that any person who actually or potentially accessed the personal information has destroyed any unauthorized copies of it and has committed to not use or disclose it, (vi) the length of time since the privacy breach first occurred and the duration of the period in which the personal information was available to be accessed, used, disclosed, destroyed or altered in contravention of the Act, (vii) the amount of personal information involved, (viii) if the personal information has been recovered, (ix) if the personal information was adequately encrypted, anonymized or otherwise not easily accessible, and (x) if harm has materialized; and (c) any other factors that are reasonably relevant in the circumstances. M.R. 138/2021 Form and manner of direct notice to individuals 3.2(1) When notice of a privacy breach is to be given to an individual as required under section 41.1 of the Act, the notice must be given in writing and must include (a) a description of the circumstances of the privacy breach; (b) the date or period of time that the privacy breach occurred, or is believed to have occurred; (c) the name of the public body who had custody or control of the personal information at the time of the privacy breach; (d) a description of the personal information that was the subject of the privacy breach; (e) a description of the steps that the public body has taken or is intending to take, as of the date of the notice, (i) to reduce the risk of harm to the individual as a result of the privacy breach, and (ii) to reduce the risk of a similar privacy breach in the future; (f) a description of the steps that the individual can take to reduce the risk of harm that can result from the privacy breach or to mitigate that harm; (g) a statement that the Ombudsman has been or will be given notice of the privacy breach, as required under subsection 41.1(4) of the Act; (h) the name and contact information of an officer or employee of the public body who is able to answer questions about the privacy breach; and (i) any other information that the public body considers relevant. 3.2(2) If the public body reasonably believes that the delay necessary to provide written notice to an individual is likely to significantly increase a real risk of significant harm to the individual, the public body may give the notice orally, provided (a) at the time the oral notice is given, the public body records the information that was given and the date on which it was provided; or (b) the public body gives notice in writing in accordance with subsection (1) within a reasonable time after the oral notice is provided. M.R. 138/2021 When indirect notification may be given 3.3(1) Under clause 41.1(3)⁠(c) of the Act, notification of a privacy breach may be given indirectly to one or more individuals in the following circumstances: (a) if the public body reasonably believes that the privacy breach may result in a risk to public health or safety; (b) if the identity or current contact information of the individual or individuals is not known; (c) if the public body reasonably believes giving notice to an individual in accordance with section 3.2 (i) is impractical or unduly expensive because of the large number of individuals that may have been affected by the privacy breach, or (ii) could threaten or harm the individual's mental or physical health. 3.3(2) Notification under this section must be given (a) by public communication or similar measure that (i) can be reasonably expected to reach the affected individual or individuals, and (ii) does not include any information that could reasonably identify the affected individual or individuals; or (b) if notice of the privacy breach can be reasonably expected to threaten or harm the recipient's mental or physical health, in writing to an individual who provides care to the recipient or to an individual with whom the recipient is known to have a close personal relationship. M.R. 138/2021 FEES Search and preparation fee 4(1) An applicant must pay a search and preparation fee to the public body whenever the public body estimates that search and preparation related to the request for access will take more than two hours. 4(2) The fee payable for search and preparation is $15.00 for each half-hour in excess of two hours. 4(3) When calculating search and preparation time, a public body shall include time spent in severing any relevant record under subsection 7(2) of the Act, but must not include time spent (a) in connection with transferring a request for access to another public body under section 16 of the Act; (b) preparing an estimate of fees under section 8; (c) reviewing any relevant record to determine whether any of the exceptions to disclosure apply, prior to any severing of the record; (d) copying a record supplied to the applicant; or (e) preparing an explanation of a record under subsection 14(2) of the Act. M.R. 138/2021 ; 121/2024 Copying fees 5(1) An applicant who is given a copy of a record must pay the following copying fees to the public body: (a) 20 cents for each page for paper copies made by a photocopier or computer printer; (b) 50 cents for each page for paper copies made from a micro printer; (c) actual costs for any other method of providing copies. 5(2) Despite subsection (1), an applicant requesting copies of his or her own personal information is not required to pay a copying fee if the total copying fee payable is less than $10.00. M.R. 138/2021 Computer programming and data processing fees 6 When a public body needs to use computer programming or incurs data processing costs in responding to a request for access, the applicant must pay to the public body (a) $10.00 for each fifteen minutes of internal programming or data processing; or (b) the actual cost of external programming or data processing incurred by the public body. M.R. 138/2021 Matters for which no fee is payable 7 No fee is payable by an applicant for (a) making a request for access to a record; (b) using any file list, file plan or similar record used by a public body to identify, locate or describe records, unless the applicant requires a copy, in which case 20 cents is payable for each page; or (c) regular mailing costs, other than special courier delivery which shall be charged to the applicant at actual cost. M.R. 165/2010 ; 138/2021 ESTIMATE OF FEES Estimate of fees 8(1) In accordance with subsection 82(2) of the Act, a public body must give an applicant an estimate of fees in Form 2 of Schedule A when it reasonably considers that, in responding to the request, (a) search and preparation is likely to take longer than two hours; or (b) computer programming or data processing fees will be incurred. 8(2) After receiving an estimate of fees, an applicant who still wishes to proceed with the request for access must sign and return a copy of Form 2 of Schedule A to the public body along with payment of the estimated fees. 8(3) The estimate of fees is binding on the public body, and if the actual cost of search and preparation or computer programming or data processing is less than the estimate, the public body must refund the difference to the applicant. 8(4) In addition, a public body must refund the amount of estimated fees paid by an applicant if access to every record the applicant has requested is refused. M.R. 138/2021 WAIVER OF FEES Waiver of fees 9(1) At the applicant's request, the head of a public body may waive all or part of the fees payable under this regulation if the head is satisfied that (a) payment would impose an unreasonable financial hardship on the applicant; (b) the request for access relates to the applicant's own personal information and waiving the fees would be reasonable and fair in the circumstances; or (c) the record relates to a matter of public interest concerning public health or safety or the environment. 9(2) Either when access is granted or before it is granted, the head of the public body must inform the applicant in writing as to the head's decision about waiving the fees. 9(3) In this section, "head" , in relation to a public body that is a department, means the deputy minister of the department or person holding an equivalent office. M.R. 138/2021 10 [Repealed] M.R. 138/2021 DESIGNATIONS Designation of government agencies 11 The bodies set out in Schedule B are designated as government agencies for the purposes of the Act, other than for the purposes of clause 75.1(1)⁠(e) and subsection 76.3(1). M.R. 138/2021 12 [Repealed] M.R. 165/2010 12.1 [Repealed] M.R. 23/2006 ; 165/2010 12.2 [Repealed] M.R. 8/2008 ; 138/2021 ; 121/2024 Designation of local government bodies 12.3 The bodies set out in Schedule F are designated as local government bodies for the purposes of the Act. M.R. 174/2012 13 [Repealed] M.R. 23/2006 ; 165/2010 REPEAL AND COMING INTO FORCE Repeal 14 The Access to Records Regulation , Manitoba Regulation 296/88, is repealed. Coming into force 15 This regulation comes into force on May 4, 1998. SCHEDULE A Form 1 [Repealed] M.R. 138/2021 Form 2 Estimate of Costs Form 3 [Repealed] M.R. 138/2021 SCHEDULE B (Section 11) GOVERNMENT AGENCIES Aboriginal Apprenticeship Program Advisory Committee established by The Apprenticeship and Trades Qualifications Board The Apprenticeship and Trades Qualifications Board continued under The Apprenticeship and Trades Qualifications Act Assiniboine River Management Advisory Board established by the Minister of Water Stewardship Certificate Review Committee established under The Education Administration Act Child and family services agencies under The Child and Family Services Act , other than a regional office of the Department of Family Services and Housing Child and family services authorities established under The Child and Family Services Authorities Act Child Care Qualifications and Training Committee established under The Community Child Care Standards Act Chiropractic Review Panel established by the Minister of Family Services and Housing Community Justice Committees established by the Minister of Justice Community Notification Advisory Committee established by the Minister of Justice Dental Review Panel established by the Minister of Family Services and Housing Health Information Privacy Committee established under The Personal Health Information Act Landlord and Tenant Advisory Committee established under The Residential Tenancies Act Manitoba Games Council Inc. The Manitoba Health Research Council established under The Manitoba Health Research Council Act Manitoba Housing Authority established under The Housing and Renewal Corporation Act Manitoba Product Stewardship Corporation established under the Multi-Material Stewardship (Interim Measures) Regulation under The Waste Reduction and Prevention Act Manitoba Safer Communities Awards Committee appointed by the Minister of Justice Provincial Evaluations Committee established by the Minister of Education, Citizenship and Youth Provincial Trade Advisory Committees established under The Apprenticeship and Trades Qualifications Act Sport Manitoba Inc. Taking Charge! Inc. Tax Appeals Commission established under The Tax Appeals Commission Act The Taxicab Board continued under The Taxicab Act Teacher Education and Certification Committee established by the Minister of Education, Citizenship and Youth Tire Stewardship Board established by the Tire Stewardship Regulation under The Waste Reduction and Prevention Act M.R. 95/98; 174/2003 ; 46/2004 ; 8/2008 ; 85/2017 ; 121/2024 SCHEDULE C [Repealed] M.R. 165/2010 SCHEDULE D [Repealed] M.R. 23/2006 ; 165/2010 SCHEDULE E [Repealed] M.R. 8/2008 ; 82/2018 ; 121/2024 SCHEDULE F (Section 12.3) LOCAL GOVERNMENT BODIES Police boards established by municipalities, including the City of Winnipeg, under The Police Services Act . M.R. 174/2012