In Ontario, the Freedom of Information and Protection of Privacy Act (FIPPA) and the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) grant individuals three fundamental rights regarding information held by the institution: the right to access general records, the right to access personal information relating to the individual, and the right to seek correction of such personal information if it is inaccurate.
Under FIPPA and MFIPPA, institutions are permitted 30 days to respond to requests for access to records. But does the same deadline apply to requests for correction? The answer is a little more complicated than you might think!
General Access Requests
For general access requests under the Freedom of Information and Protection of Privacy Act (FIPPA), the legislative source of the 30-day deadline is section 26:
26. Where a person requests access to a record, the head of the institution to which the request is made or if a request is forwarded or transferred under section 25, the head of the institution to which it is forwarded or transferred, shall, subject to sections 27, 28 and 57, within thirty days after the request is received,
(a) give written notice to the person who made the request as to whether or not access to the record or a part thereof will be given; and
(b) if access is to be given, give the person who made the request access to the record or part thereof, and where necessary for the purpose cause the record to be produced.
For general access requests under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), the corresponding 30-day deadline language is in section 19, and is nearly the same:
19. Where a person requests access to a record, the head of the institution to which the request is made or if a request is forwarded or transferred under section 18, the head of the institution to which it is forwarded or transferred, shall, subject to sections 20, 21 and 45, within thirty days after the request is received,
(a) give written notice to the person who made the request as to whether or not access to the record or a part of it will be given; and
(b) if access is to be given, give the person who made the request access to the record or part, and if necessary for the purpose cause the record to be produced.
The Right of Correction
The right of correction is set out in section 47 of FIPPA, which provides for both (1) the right of individuals to access their own personal information held by provincial and municipal institutions, and also (2) the right to request correction of personal information held by the institution (as well as the right to attach a statement of disagreement to the personal information if the correction request is refused):
Right of access to personal information
47 (1) Every individual has a right of access to,
(a) any personal information about the individual contained in a personal information bank in the custody or under the control of an institution; and
(b) any other personal information about the individual in the custody or under the control of an institution with respect to which the individual is able to provide sufficiently specific information to render it reasonably retrievable by the institution.
Right of correction
(2) Every individual who is given access under subsection (1) to personal information is entitled to,
(a) request correction of the personal information where the individual believes there is an error or omission therein;
(b) require that a statement of disagreement be attached to the information reflecting any correction that was requested but not made; and
(c) require that any person or body to whom the personal information has been disclosed within the year before the time a correction is requested or a statement of disagreement is required be notified of the correction or statement of disagreement.
Personal Information Access Requests
Now, the 30-day deadline is explicitly extended to personal information access requests in section 48 of FIPPA, which describes how an individual may exercise their right of access to their own personal information. Section 48(2) specifically states that the 30-day deadline set out in Section 26 above applies to personal information access requests as well:
Request
48 (1) An individual seeking access to personal information about the individual shall,
(a) make a request in writing to the institution that the individual believes has custody or control of the personal information, and specify that the request is being made under this Act;
(b) identify the personal information bank or otherwise identify the location of the personal information; and
(c) at the time of making the request, pay the fee prescribed by the regulations for that purpose.
Access procedures
(2) Subsections 10 (2), 24 (1.1) and (2) and sections 25, 26, 27, 27.1, 28 and 29 apply with necessary modifications to a request made under subsection (1).
And nearly identical language is found in subsections 37(1) and (2) of MFIPPA.
30 Days For Correction Requests?
A careful reading of subsection 48(2) of FIPPA (and 37(2) of MFIPPA) reveals that the 30-day deadline is applied here only to requests for access to personal information, because only access requests are described in subsection (1). There is no equivalent language in either Act applying the 30-day deadline to requests for correction.
Does this mean that the 30-day deadline does not apply to institutions when responding to correction requests?
I was unable to find any decisions from the Information and Privacy Commissioner of Ontario (IPCO) which addressed this issue directly. (Perhaps it is unusual for an institution to fail to respond to correction requests in a timely fashion?) The Ministry of Government Services’ Freedom of Information and Protection of Privacy Manual appears to offer no clarity on the question either: correction requests are covered in Part 6 of Chapter 8, but there is no mention there of the 30-day deadline.
Will IPCO Apply a 30-Day Deadline?
The question we are left to ask is how would IPCO be likely to decide an appeal based on an institution failing to respond to a correction request within 30 days, in the absence of any clear legislative authority or applicable decisions?
Section 50(1)(c) of FIPPA (and section 39(1)(c) of MFIPPA) gives individuals the right to appeal any decision on a correction request. But this would appear to provide merely an illusory right if the institution could simply refuse to come to a decision on a correction request, that is, to “sit on it” forever. It seems sensible that there should be some limit to the amount of time an institution may spend considering a correction request before responding to the requestor with a decision.
Although there appears to be no explicit limit of 30 days to respond to a correction request under FIPPA or MFIPPA, it may serve as a convenient and familiar length of time when determining whether or not an institution has behaved appropriately and has acted in a reasonably timely fashion.
Regardless of the apparent absence of specific legislative authority or any relevant IPCO decision, the IPCO website states “There is no fee to have your personal information corrected, and public sector organizations should respond to your request for correction within 30 calendar days of receiving it.” (Source: https://www.ipc.on.ca/access-individuals/access-and-correction/) The use of the word “should” here (rather than “must”) perhaps indicates that IPCO is aware there is no explicit 30 day deadline in FIPPA or MFIPPA applicable to correction requests. However, it appears open to IPCO to adopt the same time period as a de facto deadline for correction requests, and the guidance on the IPCO website suggests that this would be a predictable course of action should the matter ever come up on appeal.
Conclusion
Although there is no explicit 30-day deadline for correction requests in FIPPA or MFIPPA, it seems likely that IPCO would use the same 30 day period applicable to access requests when deciding whether an institution has taken too long to respond to a correction request. Therefore, institutions would be well-advised to abide by a 30-day deadline for correction requests if they are looking to avoid a potential adverse ruling on appeal.
If you’d like to stay engaged with further updates and see pre-release previews and demos of the FOI Assist software, please follow FOI Assist. To subscribe, simply enter your email address at the bottom of the page then click the follow button.
Links to Resources:
Freedom of Information and Protection of Privacy Act (FIPPA) https://www.ontario.ca/laws/statute/90f31
Municipal Freedom of Information and Protection of Privacy Act (MFIPPA) https://www.ontario.ca/laws/statute/90m56
Freedom of Information and Protection of Privacy Manual https://www.ontario.ca/document/freedom-information-and-protection-privacy-manual
Information and Privacy Commissioner of Ontario (IPCO) Access and Correction https://www.ipc.on.ca/access-individuals/access-and-correction/
Related Articles:
How to count time and how to determine the initial 30-day deadline
Verifying the Identity of the Requestor
Requests for Personal Information with the Consent of the Individual
FOI Assist Knowledge Base 