Municipal Privacy Desk
Free readiness check: Township of Example
Sample
Fictional
Summary Sample
We found five things worth fixing before January 1, 2027. Two of them are already required today and are quick to fix.
| # | Finding | When to act |
|---|---|---|
| 1 | 9 of 14 online forms are missing part or all of the notice of collection | Now |
| 2 | The privacy page describes rules that changed on July 1, 2026 | Now |
| 3 | Camp registration collects children’s health details through an outside booking service | Before Jan. 1, 2027 |
| 4 | No breach contact or protocol is visible | Before Jan. 1, 2027 |
| 5 | The newsletter sign-up asks for more than it needs | When convenient |
Findings Sample
9 of 14 online forms are missing part or all of the notice of collection
- What we found
-
Five forms carry a complete notice. Nine are missing at least one of the three required parts.
Notice of collection on each online form (fictional) Form Legal authority Purpose Contact Camp and program registration No Yes No Burn permit request No No No Facility rental request No Yes Partly Newsletter sign-up No No No Report a road problem No No No Contact the township No No Partly Volunteer application No Yes No Special event permit Yes Yes No Lottery licence application No Yes Partly Dog licence application Yes Yes Yes Building permit application Yes Yes Yes Marriage licence appointment Yes Yes Yes Access to information request Yes Yes Yes Employment application Yes Yes Yes “Partly” means the form gives an email address but not the title, business address and phone number of someone who can answer questions.
- Why it matters
- This is not new. MFIPPA already requires every collection to tell people the legal authority, the main purpose, and the title, business address and phone number of someone who can answer questions (MFIPPA s. 29(2) on e-Laws). A missing notice is the easiest gap for anyone to see.
- What to do
- Add one standard notice to each form. For example:
Personal information on this form is collected under the authority of [by-law or statute] and will be used to [purpose]. Questions about this collection can be directed to the [title], Township of Example, [business address], [business phone].
The privacy page describes rules that changed on July 1, 2026
- What we found
- The “Access and Privacy” page, last updated in 2019, says access requests are answered within 30 days and directs residents to a directory of personal information banks.
- Why it matters
- Since July 1, 2026, institutions generally have 45 business days to respond, and the requirement to keep personal information banks has been removed, although the IPC still encourages a published index (IPC table of changes). An out-of-date page sets the wrong expectations for residents.
- What to do
- Update the response time, decide whether to keep the index, and add a “last reviewed” date to the page.
Camp registration collects children’s health details through an outside booking service
- What we found
- The summer camp registration asks for each child’s allergies, medical conditions and medications. The form is run by an outside booking service. We found no public information on how that data is protected or where it is stored. Assessments do not have to be published, so you may already have one.
- Why it matters
- From January 1, 2027, a written privacy impact assessment is required before collecting personal information. It must cover who can access the information, the safeguards and how long it is kept (MFIPPA s. 28(3) on e-Laws). Children’s health details held by a vendor are exactly the kind of information where a breach could create a real risk of significant harm.
- What to do
- Make this your first assessment. Check what the vendor contract says about where data is stored, who can see it and how fast the vendor must tell you about a breach.
No breach contact or protocol is visible
- What we found
- No page tells residents how to report a privacy concern or a suspected breach, and there is no privacy contact other than the general clerk’s office email. A breach protocol does not have to be published, so you may already have one internally.
- Why it matters
- From January 1, 2027, a breach that creates a real risk of significant harm must be reported to the IPC and the people affected must be notified, as soon as feasible (MFIPPA s. 30.1 on e-Laws). Staff need to know in advance who decides, and how.
- What to do
- Adopt a breach protocol with a short decision guide, name who decides, start a breach log, and add a “report a privacy concern” line to the privacy page.
The newsletter sign-up asks for more than it needs
- What we found
- The newsletter form asks for date of birth and home address. Only an email address is needed to send a newsletter.
- Why it matters
- The Act allows a collection only when it is authorized by statute, used for law enforcement, or necessary to a lawfully authorized activity (MFIPPA s. 28(2) on e-Laws). Every extra field is more to protect and more to cover in an assessment.
- What to do
- Remove the date of birth and address fields.
What this check does not cover Sample
- Internal policies, systems and paper records.
- Vendor contracts, and whether assessments already exist internally.
- Security testing of any system.
- Whether a statute or by-law authorizes each collection. That is a question for your solicitor.
Next steps Sample
Findings 1, 2 and 5 are quick wins your staff can fix this month. We are happy to answer questions about this check at no cost.
If you would like help with the rest, the Bill 97 Readiness Pack covers findings 3 and 4 and the documents behind them: assessment policy and template, a first completed assessment, breach protocol and decision guide, notice templates, breach log, safeguards register, personal information inventory and briefings. One fixed price, published on our home page, delivered in about 3 weeks.
Prepared by Municipal Privacy Desk, operated by 1414618 B.C. Ltd., Vancouver, British Columbia. Based only on public web pages. Practical guidance, not an audit and not a legal opinion.