Interested in a Public Sector PIA Exchange?

Privacy Impact Assessments (PIAs) are becoming routine across Ontario’s public sector.

Bill 194 came into effect on July 1, 2025, mandating PIAs for Ontario’s provincial institutions. These provisions require institutions to conduct or update PIAs before collecting personal information or making significant changes to how personal information is used or disclosed.

While municipal institutions are not subject to the same statutory requirement, the Information and Privacy Commissioner of Ontario (IPCO) encourages all institutions, both provincial and municipal, to undertake PIAs early in project design and to update them when new or modified personal information practices may increase privacy risks.

As a result, PIAs are now being completed for a wide range of initiatives, including new information systems, surveillance technologies, AI-enabled tools, and changes to retention or disclosure practices.

In correspondence with FOI and privacy professionals, I have increasingly been asked if there is any good source for “template” or “precedent” PIAs that institutions can consult. It is easy to understand why institutions are interested in locating such precedents. Preparing a PIA requires careful analysis and alignment with IPCO guidance. Access to examples from comparable institutions can provide invaluable context and reassurance that key considerations have been addressed.

In practice, however, completed PIAs are rarely shared beyond the originating organization. Institutions are left conducting analyses with limited visibility into how their peer institutions have approached similar projects.

In light of the practical value that access to PIA precedents can provide, FOI Assist is considering whether there is sufficient interest in establishing a free “PIA Exchange” among public-sector institutions in Ontario.

Proposed PIA Exchange

The concept would be straightforward:

• Participating institutions would submit one to three completed PIAs
• Institutions would redact their submissions as necessary, removing personal or confidential information (similar to releasing documents under an FOI request)
• Submitted PIAs would be shared among the participating institutions
• There would be no cost to participate
• Participation would be limited to provincial and municipal institutions in Ontario
• Depending on interest and participation levels, submitted PIAs may be compiled into a longer-term “PIA Bank.”

The objective would be to facilitate knowledge-sharing within Ontario’s public sector, reduce unnecessary duplication of effort, and support institutions in preparing PIAs more efficiently and consistently.

Expressions of Interest

At this stage, FOI Assist is seeking expressions of interest from Ontario institutions to determine whether there is sufficient participation to proceed.

If your institution may be interested in participating in a Public Sector PIA Exchange, please let me know by email or through the FOI Assist Knowledge Base online contact form. Likewise, if you have suggestions, comments, or questions about the proposed initiative — or if you would simply like to be kept informed as it develops — please feel free to get in touch.

No PIA submissions are required at this time. If there appears to be sufficient interest, further details will follow.

Ontario’s public institutions are doing thoughtful and important privacy work. If there is interest in sharing that work with one another, this PIA Exchange could help strengthen privacy practice across the province — one precedent at a time.

I encourage you to take part, and I look forward to hearing from you!