Ontario’s New Digital Security and Privacy Framework: What Public Buyers Need to Know

Picture this…. It’s 2024. Ontario’s public sector has been dealing with a steady stream of cybersecurity attacks disrupting essential public services, exposing sensitive information, and creating major costs for taxpayers. Hospitals, municipalities, colleges, school boards, utilities, and other public organizations are all heavily dependent on digital systems and third-party service providers but there was a growing realization that many organizations did not have clear or consistent cybersecurity governance practices in place.

At the same time, artificial intelligence (AI) is suddenly all the rage. Hardly a day goes by without another headline about AI tools, AI risks, or AI opportunities. Public sector organizations are beginning to explore AI-enabled technologies and services without a clear legal or governance framework to guide them.

By 2024, Ontario is lagging behind other Canadian and international jurisdictions when it comes to cybersecurity and digital governance measures.  Ontario’s response to these emerging issues came in two important forms.

First, in May 2024, the Information and Privacy Commissioner of Ontario (IPC) released new guidance for public sector contracting. Then later that year, the Province introduced Bill 194, which enacted:

1. the Enhancing Digital Security and Trust Act, 2024; and
2. amendments to the Freedom of Information and Protection of Privacy Act (“FIPPA”).

Together, these developments signalled the emergence of a broader ruleset governing how Ontario public sector organizations are expected to manage digital information, cybersecurity risks, privacy obligations, and AI systems.

IPC Guidance: Privacy and Access in Public Sector Contracting with Third Party Service Providers

The most relevant resource for procurement professionals is the IPC guidance document: Privacy and Access in Public Sector Contracting with Third Party Service Providers. The document focuses on procurement and contracting situations where service providers collect, store, access, process, or otherwise handle institutional records or personal information on behalf of a public body. In other words, almost every modern SaaS, ERP, or digital technology procurement.

The IPC guidance provides recommendations relating to a host of issues in procurement and contracting, including subcontracting controls, breach response planning, reservation of audit rights and access-to-information obligations. For procurement professionals, it provides a roadmap for the kinds of questions and contractual protections that should now be considered in procurements involving digital systems and service providers.

Enhancing Digital Security and Trust Act, 2024

The Enhancing Digital Security and Trust Act, 2024 focuses on two major themes:

• cybersecurity and the protection of digital information and systems; and
• artificial intelligence.

Interestingly, the legislation itself does not yet contain detailed operational rules. Instead, it creates a framework that allows Ontario to introduce regulations in the future dealing with cybersecurity and AI governance. As of the date of this article, no regulations have yet been released under the Act.

FIPPA Amendments – Personal Information

The second part of Bill 194, the amendments to FIPPA, has a more immediate operational impact on organizations collecting and storing personal information.

Many people focus on the “FOI” portion of FIPPA, but it’s important to remember that the “PP” stands for “Protection of Privacy.” FIPPA governs the protection of personal information, which is only a subset of the broader category of digital information contemplated under the Enhancing Digital Security and Trust Act.

The FIPPA amendments require impacted organizations to undertake privacy impact assessments (PIA) before implementing certain programs or systems involving the collection of personal information. It is notable that these kinds of privacy governance requirements have existed at the federal government level for many years. Ontario is now catching up with practices already familiar within federal privacy and possibly other Canadian frameworks.

Importantly, FIPPA does not apply to municipalities. That means these statutory requirements have not formally flowed down to the municipal sector. However, privacy impact assessments and related governance practices should increasingly be viewed as a public sector best practice regardless of whether they are expressly required by legislation.

Why does all of this matter to procurement professionals?

Procurement teams are often on the front lines of digital risk management when working with vendors. Many procurements involve cloud services, SaaS platforms, third-party hosting arrangements, and vendors handling sensitive organizational data and therefore trigger the requirements of this new ruleset.

Procurement professionals don’t need to become cybersecurity or AI experts. But they do need a working understanding of Ontario’s emerging digital governance framework and the ability to ensure that client departments are considering these issues when structuring procurements that involve digital information.

Procurement professionals should have a good understanding of the IPC guidance and ensure it’s actively considered during procurement planning and contract drafting activities. As cybersecurity incidents continue to increase, it may become increasingly difficult for organizations to defend procurement and contracting decisions where widely publicized IPC recommendations were ignored and a resulting incident occurs.

Ontario’s digital governance framework is still evolving. But the direction is clear: public sector organizations are being expected to become more sophisticated in how they procure, govern, and oversee digital systems, cybersecurity protections, service providers, and AI-related technologies.

***

Coffee with Counsel: Ontario Bill 194 in Practice: What Public Sector Buyers Must Do Now on Cybersecurity, Privacy and AI

To learn more about this evolving area, join me at the next OPBA Coffee with Counsel session on June 9, where we’ll discuss Ontario’s emerging suite of rules governing digital information management, cybersecurity, privacy, and AI — and what procurement professionals should be doing now to prepare. Register here