Most public forms miss part of a notice the Act already requires

Notice of collection is not one of the January 1, 2027 changes. It is already in MFIPPA, in s. 29(2), and it applies to every form your institution uses to collect personal information. It is also the easiest privacy gap for anyone to see, because it sits on the public form itself.

What the Act requires

When personal information is collected on behalf of an institution, the head must tell the person three things (MFIPPA s. 29(2) on e-Laws):

1. the legal authority for the collection;
2. the principal purpose or purposes for which the information will be used; and
3. the title, business address and business telephone number of an officer or employee who can answer questions about the collection.

That is three parts, and the third has three pieces of contact information. There are limited exceptions, for example some law enforcement collections, or where the Minister waives the notice (s. 29(3)). The duty applies to forms a vendor hosts for you too, because the information is still collected on your institution’s behalf.

What we found

On October 13 and 14, 2026 we checked the websites of 441 of Ontario’s 444 municipalities and 233 local boards, and read 1,503 public online forms in full against those parts. 93% of the forms (1,399) were missing at least one. 45% (672) had no notice of collection at all. 7% (104) had every part.

The part most often missing was the contact’s business address, which appeared on 17% of forms. The part most often present was the principal purpose, at 50%. One form in five named MFIPPA itself as the authority, which does not authorize a particular program. The full results, by type of institution, with the method and limits, are on our research page. We do not name any institution.

Why it matters now

• It is in force today. Unlike assessments and breach reporting, this duty does not wait for January 1, 2027.
• It is what a review looks at. From January 1, 2027, when the Commissioner reviews an institution’s information practices, the Act says the review checks whether the requirements of Part II, “including requirements with respect to notice”, have been met (s. 38.1(4)(b)).
• It is the first thing residents see. A clear notice tells a parent signing up a child, or a resident reporting a problem, exactly why you are asking and who to call.

A notice that covers every part

One standard block, reused on every form, fixes most of the gap. For example:

Personal information on this form is collected under the authority of [statute or by-law, with section if known] and will be used to [purpose]. Questions about this collection can be directed to the [position title], [institution], [business address], [business phone].

Four practical tips:

• Put the notice on the form itself, before the submit button, not only on a separate privacy page.
• Name the statute or by-law that authorizes the program. MFIPPA sets the rules for collecting personal information; on its own it is not usually the authority for a particular program.
• Use a position title rather than a person’s name, so the notice survives staff changes.
• Check fillable PDF forms and forms hosted by vendors, such as booking or payment services, as well as your own web pages.

An afternoon’s work

List your public forms, write one standard block with the right authority and purpose for each, add it, and check each form once more after it goes live. Then keep the list: from January 1, 2027, the same forms are where your privacy impact assessments start.