For conservation authorities

What applies from January 1, 2027

• A written privacy impact assessment before each collection of personal information (s. 28(3)), updated before a significant change in purpose (s. 28(5)).
• Reasonable safeguards for personal information and records (s. 30(5)).
• Breach reports to the IPC and notice to the people affected when the real risk of significant harm test is met (s. 30.1).
• A record of reported breaches and the count in the annual report to the IPC, first due March 31, 2028.
• IPC reviews of information practices, with orders (s. 38.1).

The notice of collection on every form is already required (s. 29(2)). Every change, section by section.

Who signs

The members of the authority may designate one of themselves, or a committee, in writing to act as head (s. 3(2)); otherwise the head is the members (s. 3(3)(b)). The head may delegate duties in writing to an officer, for example the chief administrative officer (s. 49(1)). An authority serves several member municipalities but is one institution under MFIPPA, with its own documents.

Collections that usually need an assessment first

• Permit applications for work in regulated areas, and planning and property inquiries, which hold landowners’ names, addresses and site details.
• Camps, outdoor education and school programs: children’s details and health notes.
• Park passes, memberships and campground or facility reservations, often through a booking vendor.
• Tree planting, stewardship and landowner grant programs.
• Volunteer and job applications, and cameras at parks and offices.

What we found on conservation authority websites

We read 72 public forms in full on 27 authority websites. 88% left out at least one required part of the notice of collection, the lowest share of any group but still most forms, and 42% had no part at all. A privacy policy was visible on 19 of 29 websites (66%). None showed a breach protocol or a way to report a breach, and none mentioned privacy impact assessments. That does not mean none exist inside the office; it means residents cannot see them.

We do not name any authority. All institution types compared.

The pack for a conservation authority

• First assessment: permit applications, or camp and education program registration.
• Inventory: covers field work as well as the office, such as landowner contact lists and site photos taken by staff.
• Safeguards register: includes the off-site rules field staff need, such as devices and paper records taken out of the office.
• Board briefing: one page for members. Staff briefing: for front desks, program and field staff.

CA$7,500, invoice after delivery, net 30. Each document in detail.