Terms of Reference

Terms of Reference

The Access to Information and Protection of Privacy Act, 2015, SNL2015, c.A-1.2 (“ATIPPA, 2015”)  was adopted in June 2015, replacing the original 2002 legislation.

Pursuant to section 117 of ATIPPA, 2015, the Minister Responsible for Access to Information and Protection of Privacy Office is required to refer the legislation to a committee for a comprehensive review every five years.

This 2025 review is being undertaken in the context of significant global and local developments in privacy law, digital governance, and public expectations regarding the protection of personal information.

Mandate

The Committee shall conduct a comprehensive review of the provisions and operation of ATIPPA, 2015, with a particular emphasis on the protection of privacy. The review will include, but not be limited to, the following areas:

1. Review of 2020 Recommendations
   1. Consideration of the 2020 Statutory Review recommendations issued by the Honourable David B. Orsborn for applicability or revision.
2. Access to Information Provisions
   1. Review exceptions to access, timelines for response, and the effectiveness of current administrative procedures and the current cost schedule.
3. Privacy Safeguards and Emerging Technologies
   1. Evaluate whether ATIPPA, 2015 adequately addresses risks associated with newly evolving technologies, including but not limited to:
      1. artificial intelligence;
      2. biometric data; and
      3. surveillance technologies.
4. Personal Information Protection
   1. Examine whether current definitions and protections for personal information are sufficient considering evolving data collection practices and technology;
   2. Consider the need for enhanced safeguards for sensitive categories of data;
   3. Consider whether clarification is required around the rights of a minor in accessing or protecting their personal information.
5. Privacy Breach Management
   1. Review the effectiveness of current privacy breach notification requirements and timelines;
   2. Assess the adequacy of public body obligations for breach prevention, response, and reporting.
6. Public Body Practices and Accountability
   1. Evaluate the privacy management frameworks of public bodies, including the role of Privacy Impact Assessments and mandatory training;
   2. Consider whether additional oversight or enforcement mechanisms are needed.
7. Public and Public Body Experience
   1. Gather feedback on the experience of individuals and public bodies in their experience operating under ATIPPA, 2015.
8. Schedule A Review
   1. Review the list of provisions in Schedule A to determine the necessity of their continued inclusion.

Committee Composition

The Committee reviewing the legislation shall consist of Keri-Lynn Power LLB (Hons), LLM who shall complete the review independent of the Government of Newfoundland and Labrador.

Public Engagement

The Committee may receive written submissions and conduct consultations/hearings with interested entities, including but not limited to:

• The general public;
• The Office of the Information and Privacy Commissioner;
• Academic experts;
• Indigenous organizations;
• Government Departments, Agencies, Boards and Commissions and any Public Body subject to the Act; and
• The ATIPP Office.

Public consultation/hearing methods may include in-person sessions (where feasible), online questionnaires and feedback, and virtual engagement sessions to ensure broad and inclusive participation.

Sessions may be scheduled at the discretion of the Committee. Consideration will be given to the use of alternate methods of consultation that promote the engagement of interested parties, regardless of regional location (e.g. online questionnaires, etc.).

Timeline

The Committee shall complete its work and deliver its final report to the Minister Responsible for Access to Information and Protection of Privacy Office on or before January 31, 2027.