Overview
The Protection of Privacy Act, commonly known as POPA, enhances and builds on the protection of privacy rules that were in the former FOIP Act.
POPA introduces a privacy by design approach to programs and services delivered by public bodies, has the strictest penalties in Canada for the misuse of Albertan’s personal information, and supports more effective delivery of programs and services across public bodies by allowing for common and integrated programs.
The purpose of POPA is to:
- provide guidance to the collection, use, and disclosure of personal information by public bodies
- allow individuals the right to request corrections to their personal information held by a public body
- enable public bodies to data match and allow the creation, use, and disclose of non-personal data and data derived from personal information
- require public bodies to protect personal information including when data matching, and creating, using, and disclosure of data derived from personal information and non-personal data
- allow for independent review of decisions made and resolution of complaints made against public bodies
POPA prohibits the selling of personal information in any circumstances or for any purpose, including for marketing or advertising.
Governance
Protection of Privacy Act
Establishes the legislative framework by which public bodies may collect, use, or disclose personal information and establishes requirements on the protection of personal information held by public bodies. It also establishes a requirement for public bodies to create, use and disclose non-personal data in limited circumstances.
Regulations
The Protection of Privacy Regulation provides definitions for terms captured in the Protection of Privacy Act, and the Protection of Privacy (Ministerial) Regulation provides specific requirements for concepts captured in the Act, like the privacy management program and privacy impact assessments.
The Act and regulations work together to provide detailed, practical guidance to help public bodies implement the new rules.
Proclamation of law
The Protection of Privacy Act (POPA) and regulation came into force June 11, 2025. Upon proclamation, the Freedom of Information and Protection of Privacy Act was repealed.
Printed copies of the POPA and regulation can be downloaded from Alberta King’s Printer.