Recent changes to Ontario’s Freedom of Information (FOI) laws are drawing sharp criticism from legal experts, transparency advocates, and journalists. According to reporting by Law360 Canada, these reforms have been described as “one of the most serious attacks on the public’s right to know in years.”

For businesses, organizations, and individuals across Ontario, these changes have real implications for accountability, access to information, and secure document handling practices.

What Are the FOI Changes in Ontario?

Ontario’s updated legislation alters how freedom-of-information requests apply to government records. Most notably, the changes:

• Exclude the Premier’s Office and ministers’ offices from FOI requirements
• Limit access to certain communications and records
• Were fast-tracked through the legislative process

Critics argue that this significantly reduces transparency in how decisions are made at the highest levels of government.

Key Concern

Reduced oversight: The public, journalists, and watchdog organizations may no longer be able to access critical records that were previously available.

Why Experts Are Sounding the Alarm

Legal and transparency experts cited in the Law360 Canada article warn that these changes could fundamentally weaken democratic accountability.

• The reforms are seen as shielding political decision-making from scrutiny
• They may set a precedent for further restrictions on access to public records
• Experts emphasize that FOI laws are a cornerstone of open government

In essence, limiting access to information can make it harder to understand how policies are formed, funded, and implemented.

Real-World Impact: What This Means for Ontarians

Recent reporting highlights how heavily redacted documents are already raising concerns. In some cases, government records released through FOI requests contain minimal usable information, reinforcing fears about declining transparency.

For Citizens

• Less visibility into government decisions
• Reduced ability to hold officials accountable

For Businesses

• Limited access to regulatory and policy insights
• Increased uncertainty when planning around government actions

For Media & Researchers

• Greater barriers to investigative reporting
• Potential gaps in public-interest journalism

Why Information Access Matters

Transparency isn’t just political—it’s operational.

Access to information supports:

• Ethical business practices
• Informed decision-making
• Public trust and compliance

When access is restricted, organizations must be even more diligent about their own internal information governance.

The Role of Secure Document Management

As public-sector transparency becomes more restricted, private organizations must ensure they are handling sensitive information responsibly.

At Norfolk Shredding, we emphasize:

1. Proper Document Retention Policies

Know what to keep—and for how long—to stay compliant while minimizing risk.

2. Secure Disposal of Confidential Records

Improper disposal can expose businesses to data breaches and legal liability.

3. Privacy Protection Best Practices

With less public oversight, internal accountability becomes even more critical.

Protect What You Can Control

While FOI laws govern government transparency, your organization controls its own data security.

Secure shredding and document management are essential safeguards in an evolving information landscape.

Looking Ahead: Transparency vs. Control

The debate over Ontario’s FOI changes is far from over. Advocacy groups, legal experts, and opposition leaders continue to push back, arguing that transparency is essential to democracy.

Whether these changes remain in place or are revised, one thing is clear:

Access to information is becoming more complex—and more valuable—than ever.

Conclusion

The recent FOI reforms in Ontario signal a significant shift in how government information is accessed and shared. As highlighted by Law360 Canada, experts view these changes as a serious challenge to public transparency.

For businesses and individuals, this evolving environment reinforces the importance of:

• Strong internal information governance
• Secure document handling
• Responsible data destruction

References

• Law360 Canada — “Ontario FOI changes ‘one of the most serious attacks on the public’s right to know’ in years: expert”
• Global News — “Ontario redacts almost every word…”

A Major Cybersecurity Incident Impacts Ontario’s Home Care System

A recent ransomware attack involving a vendor connected to Ontario’s publicly funded home care system has raised serious concerns about the protection of sensitive patient information. The incident, reported by Isaac Callan and Colin D’Mello of Global News, highlights how cyber threats can disrupt essential services and expose personal health data at scale.

According to the report, a vendor supporting Ontario Health atHome suffered a ransomware breach in 2025 that affected approximately 200,000 home-care patients. The attack reportedly locked access to critical systems and may have exposed personal information such as contact details and medical equipment records.

Timeline of the Ransomware Breach

Internal records reviewed by Global News show that unauthorized access to systems was first detected in March 2025, with the ransomware “payload” activated in April. It took weeks before the full scope of the breach became clear, and patients were not notified until months later.

Cybersecurity experts cited in the article stressed that early detection and rapid disclosure are essential. Once attackers steal sensitive data, the risk of identity theft or misuse increases significantly if affected individuals are not informed promptly.

Why Healthcare Organizations Are Prime Targets

Healthcare providers are especially vulnerable to ransomware attacks due to the high value of medical data and the urgency of maintaining operational continuity. Attackers often encrypt systems and steal information simultaneously, using the threat of disruption and public exposure to pressure organizations into paying a ransom.

This incident demonstrates how third-party vendors can introduce cybersecurity risks into complex healthcare ecosystems. Even when public agencies are not directly compromised, their partners’ security practices can determine overall system resilience.

The Real Cost of a Data Breach

Beyond immediate operational disruption, ransomware attacks carry long-term consequences:

• Loss of public trust in healthcare institutions
• Potential legal and regulatory penalties
• Financial losses related to recovery and remediation
• Increased risk of identity theft for affected patients

The Ontario Health atHome incident also highlights the reputational risks organizations face when breach disclosure is delayed or incomplete. Transparency and proactive communication are now key expectations for maintaining stakeholder confidence.

Callout: Protecting Sensitive Information Requires a Multi-Layered Approach

Cybersecurity is only one piece of the data-protection puzzle.
Organizations must also ensure secure document handling, storage, and destruction processes to reduce the risk of exposure.

Lessons for Canadian Organizations

This ransomware event serves as a reminder that organizations across all sectors — not just healthcare — must strengthen their data protection strategies. Key takeaways include:

• Implement robust vendor risk management programs
• Maintain clear incident response and notification procedures
• Regularly audit cybersecurity and data-handling practices
• Ensure secure disposal of physical and digital records

How Secure Shredding Supports Compliance and Risk Reduction

While ransomware attacks focus on digital systems, physical documents remain a major source of data breaches. Improper disposal of sensitive records can expose organizations to similar risks, including regulatory fines and reputational damage.

Professional shredding services help businesses:

• Protect confidential information from unauthorized access
• Maintain compliance with Canadian privacy legislation
• Reduce exposure to identity theft and corporate espionage
• Support environmentally responsible document disposal

Final Thoughts

The Ontario Health atHome ransomware incident underscores the importance of comprehensive information security practices. Organizations must look beyond IT controls and adopt a holistic approach to protecting sensitive data — from digital cybersecurity to secure document destruction.

At Norfolk Shredding, we help organizations safeguard their information at every stage of the data lifecycle, ensuring compliance, security, and peace of mind.

References

Callan, Isaac & D’Mello, Colin. Ontario health agency vendor suffered major ransomware attack in 2025. Global News.

Source: https://globalnews.ca/news/11720041/ontario-health-athome-ransomware/

A Look at Ontario’s Proposed FOI Changes

Transparency isn’t just a political buzzword—it’s a fundamental part of a functioning democracy. A recent letter published by OrilliaMatters highlights growing concerns about proposed changes to Ontario’s Freedom of Information (FOI) laws and what they could mean for public accountability.

For businesses like Norfolk Shredding, which operate at the intersection of information security and responsible data management, this conversation is especially relevant.

What the Article Says (Quick Summary)

In the letter, Margaret Prophet outlines concerns about Ontario’s proposed FOI reforms:

• FOI laws currently allow the public to request government records such as emails, reports, and internal communications.
• Proposed changes would exempt political offices (including the Premier and cabinet members) from record searches.
• The coalition’s own FOI request took nearly a year and ~$1,000, with over 70% of documents redacted.
• Prophet argues that FOI is “a tool of the public to keep the government accountable.”

The central concern:

Limiting access to information reduces transparency and weakens democratic oversight.

Why This Matters to Businesses and the Public

1. Transparency Builds Trust

Whether it’s government or business, transparency is critical. FOI laws ensure that decisions made using public funds are open to scrutiny.

When access is restricted, trust erodes—something both public institutions and private organizations must avoid.

2. Information Access vs. Information Control

The article highlights a key tension:

Who controls information—and who has the right to access it?

FOI laws exist to ensure that information created in the public interest remains accessible to the public. Limiting that access shifts control away from citizens.

3. The Real Cost of Accessing Information

The coalition’s experience reveals that even today’s system can be:

• Time-consuming
• Expensive
• Heavily redacted

Adding further restrictions could make meaningful access nearly impossible.

The Connection to Secure Information Management

At first glance, FOI laws and document shredding may seem unrelated—but they are closely connected.

Information Lifecycle Matters

Every document—whether physical or digital—has a lifecycle:

1. Creation
2. Storage
3. Access (FOI / retrieval)
4. Destruction

Organizations must balance:

• Transparency (what should be accessible)
• Privacy & security (what must be protected)

Why Proper Document Destruction Still Matters

Even as governments debate access to information, businesses must ensure:

• Sensitive data is securely destroyed when no longer needed
• Compliance with privacy laws is maintained
• Risks of data breaches are minimized

That’s where professional services like Norfolk Shredding play a critical role.

A Broader Trend: Tightening Access to Information

The concerns raised in this letter are not isolated. Across Ontario:

• Proposed legislation could expand exemptions for political offices
• Timelines for FOI responses may increase
• Some changes could even apply retroactively

Critics argue this could:

• Limit investigative journalism
• Reduce public oversight
• Make government decisions less transparent

Key Takeaway

Freedom of Information laws are more than administrative tools—they are cornerstones of accountability.

As highlighted by Margaret Prophet, weakening these laws risks creating a system where:

• Information becomes harder to access
• Public trust declines
• Oversight is diminished

Final Thoughts for Norfolk Shredding Readers

In today’s information-driven world, two principles must coexist:

✔️ Transparency – The public’s right to know
✔️ Security – The responsibility to protect sensitive data

While governments debate where to draw that line, businesses must stay focused on:

• Responsible data handling
• Secure document destruction
• Compliance with evolving regulations

References

• OrilliaMatters — “Greenbelt coalition calls FOI changes ‘disappointing’” by Margaret Prophet (March 27, 2026)
• Ontario FOI legislative context and proposed changes

Canadian voter privacy is under growing scrutiny as new federal legislation could reshape how political parties collect, use, and protect personal data. A recent analysis by Sara Bannerman (McMaster University) highlights concerns about Bill C-4, which may exempt federal political parties from privacy laws that apply to businesses and government organizations.

This development has significant implications for data protection, accountability, and transparency, making it essential for Canadians — and organizations handling sensitive information — to understand what’s at stake.

The Privacy Gap in Political Data Collection

Political parties in Canada routinely gather and analyze sensitive personal information about voters, often without explicit consent. This information can be used to:

• Target or exclude individuals in campaign messaging
• Influence advertising strategies and outreach efforts
• Build detailed voter profiles through data analytics partnerships

Unlike most organizations, federal political parties are not clearly bound by comprehensive privacy frameworks at the national level. This gap has led to a multi-year legal battle over whether provincial privacy laws apply.

The 2024 B.C. Court Decision and Its Impact

In 2024, the British Columbia Supreme Court ruled that the province’s Personal Information Protection Act (PIPA) does apply to federal political parties. The case stemmed from complaints filed by residents who claimed parties failed to disclose how their personal data was collected and used.

Justice Gary Weatherill concluded that federal and provincial privacy regimes could coexist, meaning political parties could comply with both without undermining their objectives.

However, this decision is currently under appeal — and new legislation could make the case moot.

Bill C-4: Retroactive Privacy Exemptions

Bill C-4, introduced by the federal government, would:

• Prevent provincial and territorial privacy laws from applying to federal political parties
• Apply these exemptions retroactively to the year 2000
• Remove requirements for compliance with basic privacy principles or independent oversight

If passed, federal parties could operate without the same privacy accountability frameworks required of businesses or public institutions.

“Imagine if organizations could go back in time to exempt themselves from laws that hold them accountable — that’s effectively what Bill C-4 proposes.”

The Senate’s Role and the Sunset Clause

While most Members of Parliament supported the bill, the Senate added a sunset clause that could reverse privacy exemptions after three years.

This provision aims to pressure political parties to establish a meaningful national privacy framework. However, critics argue that it still allows years of unregulated data collection and use.

Why Voter Privacy Matters

The ability of political parties to collect and analyze personal information without oversight raises critical concerns:

• Lack of transparency in how personal data is used
• Potential misuse of sensitive information
• Reduced public trust in democratic processes

For Canadians, this issue highlights a broader truth: privacy protections must evolve alongside data-driven technologies.

What This Means for Businesses and Organizations

While political parties debate privacy obligations, businesses remain subject to strict regulations. Organizations must:

• Implement robust data governance policies
• Ensure secure document retention and destruction practices
• Stay compliant with federal and provincial privacy laws

Professional shredding and secure information destruction remain essential tools for reducing privacy risks and maintaining compliance.

Norfolk Shredding’s Perspective

At Norfolk Shredding, we understand that privacy protection is fundamental to public trust — whether in government, business, or everyday transactions.

Secure document destruction ensures that sensitive information does not fall into the wrong hands, helping organizations demonstrate accountability and compliance in an increasingly data-driven world.

Key Takeaway

As federal political parties move toward exempting themselves from privacy legislation, the debate underscores the importance of consistent privacy standards across all sectors. Canadians deserve transparency and accountability in how their personal data is collected, stored, and used.

Need help protecting sensitive information in your organization?

Contact Norfolk Shredding today to learn about secure document destruction and privacy compliance solutions.

References

Bannerman, Sara. “Canada’s three main federal political parties are working together to fight voter privacy rights.”
The Conversation (republished by Yahoo News). March 11, 2026.
Source: https://ca.news.yahoo.com/canada-three-main-federal-political-115921782.html

Information and Privacy Commissioner of Ontario

Public trust in government depends heavily on transparency, accountability, and proper information management. A recent article published by Law Times highlights how Ontario’s Information and Privacy Commissioner (IPC) is continuing to push for meaningful improvements in how government records are created, stored, and disclosed—particularly in relation to the high-profile Greenbelt land decisions.

For businesses, municipalities, and residents across Norfolk County and Southwestern Ontario, this discussion reinforces a critical truth: how information is handled matters.

Ontario IPC Expects Continued Progress on Greenbelt Recommendations

According to Law Times journalist Bernise Carolino, Ontario’s Information and Privacy Commissioner, Patricia Kosseim, has stated that she expects the provincial government to make steady and measurable progress in implementing recommendations arising from investigations into Ontario’s Greenbelt boundary changes.

The IPC spent much of 2024 and 2025 dealing with access-to-information appeals connected to the Greenbelt controversy. These appeals raised serious concerns about how government records were created, retained, and accessed—issues that sit at the heart of public accountability.

Key takeaway: Transparency is not optional. Clear, traceable records are essential when decisions impact public land, environmental protection, and taxpayer trust.

Key Transparency and Record-Keeping Issues Identified

The IPC’s recommendations focus on improving how information is documented and preserved within government operations. Among the most notable concerns highlighted in the article are:

Use of Code Words and Informal Language

Special or coded language in official communications can undermine freedom-of-information requests and make it harder to understand how decisions were made.

Personal Emails and Devices

The IPC reiterated that government business should never be conducted on personal email accounts or devices, as this practice increases the risk of lost records and incomplete disclosure.

Weak Records Management Practices

Incomplete documentation and poor information governance can leave gaps that prevent accurate review, oversight, and accountability.

These issues are not unique to government. They mirror challenges faced by private businesses, healthcare organizations, and professional offices that handle sensitive or regulated information.

The Role of Secure Document Destruction

One of the final (and often overlooked) steps in responsible information governance is secure document shredding. Holding onto sensitive documents longer than necessary creates unnecessary risk.

At Norfolk Shredding, we help businesses and residents across Norfolk County and surrounding areas:

• Securely destroy confidential paper records
• Stay compliant with privacy and data-protection best practices
• Reduce the risk of unauthorized access or data leaks
• Demonstrate accountability and professionalism

Whether it’s outdated financial records, employee files, medical paperwork, or archived government-related documents, secure shredding ensures information cannot be reconstructed or misused.

Building Trust Through Better Information Practices

The IPC’s ongoing work serves as a reminder that transparency doesn’t happen by accident. It’s the result of deliberate, consistent, and responsible information management; from record creation to final destruction.

For organizations of all sizes, best practices include:

• Keeping clear, well-documented records
• Using approved systems and channels for official communication
• Following defined retention schedules
• Securely shredding records that are no longer required

Learn More About Secure Shredding in Norfolk County

If your organization is reviewing its records management or looking to reduce risk, Norfolk Shredding is here to help with reliable, compliant document destruction services.

Protect your information. Protect your reputation. Request a Quote

References

Carolino, B. (2026, January 5). IPC says it expects steady government progress in implementing recommendations on Ontario Greenbelt. Law Times.
Source: Law Times – Privacy and Data Law Section