On June 11, 2025, new public sector privacy legislation came into force. The two new Acts – the Protection of Privacy Act (POPA) and the Access to Information Act (AIA) - replace the Freedom of Information and Protection of Privacy Act which has been repealed.
These two pieces of privacy legislation apply to records and private information that is in the custody or control of a public body, which includes:
- A department, branch or office of the Government of Alberta
- An agency, board, commission, corporation, office or other body designated as a public body in the regulations, (e.g. the Worker’s Compensation Board)
- A local public body, (e.g., a school or school board)
The purposes of the Protection of Privacy Act are:
- To control the collection, use and disclosure of personal information by a public body,
- To allow individuals a right to request corrections to personal information about themselves that is held by a public body,
- To control the creation, use and disclosure of data derived from personal information and nonpersonal data by a public body, and
- To provide for independent reviews of decisions made by public bodies under this Act and the resolution of complaints under this Act.
Protection of Privacy Act, Section 2
The purpose of the Access to Information Act is:
- To allow any person a right of access to the records in the custody or under the control of a public body subject to limited and specific exceptions as set out in this Act,
- To allow individuals, subject to limited and specific exceptions as set out in this Act, a right of access to personal information about themselves that is held by a public body, and
- To provide for independent reviews of decisions made by public bodies under this Act and the resolution of complaints under this Act.
Access to Information Act, Section 2
The Protection of Privacy Act includes provisions related to practices including data matching, use of “synthetic data”, and use of private information in automated decision making. These are new considerations for privacy legislation in Alberta. Physiotherapists who work in public sector settings subject to these two pieces of legislation are encouraged to become familiar with the provisions of the new legislation.
As the legislation is applicable to public bodies, registrants are directed first to the privacy officer of the public body for whom they work if they have questions about the requirements and application of the new legislation to their day-to-day work. Additional information is found in the revised Privacy Guide for Alberta Physiotherapists 2025.
The College reminds registrants that physiotherapists are currently subject to up to five pieces of privacy legislation depending on the context of their practice:
Personal Information Protection Act (PIPA)
PIPA applies to personal information and personal employee information collected, used and disclosed by physiotherapists in the private sector. For example, in the context of a private practice clinic or when private services are provided under contract to the Alberta Workers’ Compensation Board (WCB).
Health Information Act (HIA)
HIA applies to health information collected in connection with the provision of a health service if/when the health care provider is employed by, or contracting services to, AHS, a hospital or nursing home, or another custodian subject to the Act.
Personal Information Protection and Electronic Documents Act (PIPEDA)
PIPEDA applies in limited circumstances where personal information is being transferred across provincial boundaries (e.g., when delivering cross-border physiotherapy services, communicating with a third-party insurer in another province).
Protection of Privacy Act (POPA) and Access to Information Act (AIA)
POPA and AIA apply to information collected, used and disclosed when a physiotherapist is employed by a public body as defined under the Act.
The College will notify registrants of changes to privacy legislation relevant to their practice if/when they arise.
