Key takeaways
- On October 14, 2026, Information and Privacy Commissioner Kerry Hatfield released the OIPC’s submission to the statutory review of the Access to Information and Protection of Privacy Act, 2015, the five-year review that section 117 of the Act requires, led by committee chair Keri-Lynn Power.
- The submission says the law’s core framework works and should be preserved, then names four targeted fixes: clarifying oversight of solicitor-client privilege claims, strengthening privacy protection for information held by political parties, addressing emerging issues associated with artificial intelligence, and expanding oversight mechanisms.
- Hatfield calls ATIPPA, 2015 “one of Newfoundland and Labrador’s great success stories” and the strongest access law in Canada. When the top-ranked regime files a fix list, privacy teams elsewhere should read it as a preview of their own province’s next review round.
The submission in one paragraph
On October 14, 2026, the Office of the Information and Privacy Commissioner of Newfoundland and Labrador published its submission to the statutory review of the Access to Information and Protection of Privacy Act, 2015. The review is required by section 117 of the Act; Keri-Lynn Power, appointed by the Minister of Justice and Public Safety, chairs it. After more than eleven years under the law, the Commissioner’s verdict is direct: the framework works, preserve it. Then comes the fix list, and that is where the interesting reading starts.
Privilege claims are where access requests go to stall
First on the fix list: clarifying oversight relating to solicitor-client privilege claims. Anyone who has filed an access request and watched records vanish behind an untestable privilege claim knows why this matters. The problem is not that the shield exists. It is that an institution can raise it and the requester has almost no way to check whether the claim was legitimate.
Read the ask for what it is. “Clarifying oversight” is commissioner language for wanting a clearer path to inspect those claims. Practitioners discussing the issue online describe over-claimed privilege as routine, an institutional habit of excluding first and justifying later. Their recommended counter is the same one commissioners use: force a record-by-record justification instead of accepting blanket labels. For private-sector privacy teams, the parallel is your own privilege log discipline. If a regulator ever comes asking, can you show which documents counsel actually advised on, and why? Keep that log current.
Political parties: the data operation nobody regulates
Second: strengthening privacy protections for information held by political parties. This one deserves a pause, because it is the strangest gap in Canadian privacy law. Federal political parties are not subject to the Privacy Act or PIPEDA. The OPC’s own research says so plainly, and a Senate committee report restated it this year. Their obligations live in the Canada Elections Act: a published privacy policy is required, but no minimum standards govern how voter data is actually handled, and data collected from other sources sits almost entirely outside regulation.
So the organizations running the most sophisticated voter analytics in the country operate under lighter rules than a corner store’s loyalty program, and Newfoundland’s commissioner wants to start closing that gap at the provincial level. The public mood is already there. Voters and practitioners discussing the gap online treat the exemption as self-dealing by design: every party benefits, so no party in power has an incentive to close it. If your organization works with political data, campaigns, or advocacy analytics, watch this file. The exemption era is getting harder to defend.
AI gets named, in writing
Third: addressing emerging issues associated with artificial intelligence. One line in the release, no detail, but its placement matters. When ATIPPA, 2015 was written, government use of automated decision-making was rare. Today a public body buying an AI triage tool for benefit applications is a routine procurement decision. Every privacy statute written before the current AI wave has the same hole: no language for algorithmic decision-making, no rules for training data drawn from public records.
Naming AI in a statutory review submission is the commissioner’s way of telling lawmakers the patch can no longer wait. If you procure or deploy AI in a public-sector context, assume the next review in your province will ask the same question, and have your AI governance file ready before it does.
The four asks, translated for your province
| The ask | What it targets | Your takeaway |
|---|---|---|
| Clarify oversight of solicitor-client privilege claims | Records shielded behind privilege claims nobody can test | Audit your own privilege logs; scrutiny is increasing |
| Strengthen privacy protection for political party data | Voter data held under minimal rules | If you touch campaign or advocacy data, the gap is closing |
| Address emerging AI issues | A 2015 statute silent on automated decision-making | Public-sector AI governance files should be review-ready now |
| Expand oversight mechanisms | Commissioner tools that have not kept pace with the technology | Expect regulators to ask for sharper powers in every province |
Why a review in St. John’s matters in Toronto
Statutory reviews are the leading indicator in Canadian privacy law. The reviews surface the pressure points, the commissioners’ submissions name the fixes, and the amendments follow a cycle or two later. Hatfield’s framing is worth sitting with: this is the law she calls the strongest access regime in Canada, and even she wants it updated for AI, party data, and privilege oversight.
When the best-ranked system files a repair list, the rest should not wait for their own review to start the work. The themes rhyme across provinces. Read the N.L. submission when it is posted and hold it against your own gap analysis.
Actionable takeaway: Pull your gap analysis against the four N.L. asks this week. Can you defend every privilege claim in your access files? Do you hold or process any political or advocacy data? Is your public-sector AI inventory current? Two of the four probably need work. Start there. The review that asks about them in your province is already scheduled. It just has not been announced yet.