The 2024-25 Annual Report and Service Plan includes feature articles on key themes from the last fiscal year, highlights of the work of the office, and statistics breaking down the number of files received by the OIPC, the types of complaints received, the outcomes of complaints and requests for reviews, and much more. The service plan outlines the office's goals, strategies, and performance metrics.

To view the full annual report and service plan: https://www.oipc.bc.ca/documents/budget-annual-report-service-plans/2796

To read a short overview of the report: https://www.oipc.bc.ca/documents/infographics/2795

Commissioner's message

I am pleased to present the Annual Report and Service Plan of the Office of the Information and Privacy Commissioner for British Columbia for the fiscal year 2024/25.

When I was appointed to this role in May 2024, I was honoured to join this office and to serve as part of this province’s robust and enviable framework of independent oversight. That appreciation for the transparency and accountability that oversight provides has only deepened over the period covered in
this report.

During this time, we saw rising economic uncertainty, global alignment shifts, and increasing polarization in society, along with the continued expansion of artificial intelligence (AI) technologies. These are developments that jolt us out of complacency.

They demand responses. They require us to stand firm in defence of our shared values and fundamental rights to ensure our democracy remains strong and resilient. They call on us to find ways to not only survive these challenges, but to thrive in the face of them.

Our access and privacy rights are essential to that effort because they build trust.

However, trust is not earned through platitudes or principles on paper that aren’t put into practice. It’s about doing the work, even – or especially – during challenging times and amid intense, competing demands.

Building trust one access request at a time

Two of our investigation reports over this past year spoke to that theme.

In September, we released an investigation report that highlighted major failings in Vancouver Coastal Health Authority’s duty to assist applicants under the Freedom of Information and Protection of Privacy Act (FIPPA). You can read more about the outcome of that investigation on page 16.

Our 2025 investigation report into the records disclosure practices of 160 municipalities across British Columbia also highlighted lost opportunities to build trust and strengthen democracy at the local level.

Among the report’s findings were inconsistent approaches to records disclosures, a significant knowledge gap when it came to FIPPA’s requirements, and a need to improve proactive disclosure. Details of that report can be found on page 20.

This report highlights that transparency under FIPPA is not just about freedom of information requests, but about how public bodies can proactively make information available to the public. Freedom of information will always be acritical backstop for transparency, but at a time when public bodies are under growing operational pressure, the sheer volume of information held is constantly on the rise, and resource issues are real and growing, we need to think more broadly.

Growing transparency, and thus trust, requires thinking about how to make information available from the moment that a statute, policy, or program is conceived.

This notion, of how to transform our public bodies so that they are inherently more transparent, is the theme of an important resolution that I agreed upon with my Federal, Provincial and Territorial colleagues this year – the idea of transparency by default.

Dignity and rights in the digital age

This period also called on us to question outdated conceptions of privacy as being about what we want to “hide” from others.

That framing no longer works when we consider what it means to live in our digital society. Privacy today is about choosing what we share and expressing our individuality through those choices. We should be able to do so without being manipulated with the illusion of choice, or having to accept
uses of our information we never could have foreseen, let alone agreed to.

This year’s Global Privacy Enforcement Network (GPEN) Sweep showed just how far we need to go to achieve that ideal. Nearly all Canadian websites and apps had features of deceptive design, aimed at manipulating users into making choices that result in providing more information than necessary.
The OIPC and other Canadian regulators found many of these platforms targeted children with their deceptive tactics. More information about this work is on page 18.

AI brings a paradigm shift in privacy. AI applications require enormous amounts of data to train algorithms. How can this be squared with the privacy principle of collecting and using the minimum amountof data for a specific purpose? Where is this data going to come from and what is the legal authorization for its collection and use?

In December, the Supreme Court of British Columbia upheld our order for the facial recognition company Clearview AI to cease its operations in BC and delete all of the thousands of images of British Columbians it scraped without anyone’s consent. The Court ruling said that we do not exhaust our rights to privacy when we go online.

In that spirit, I call on government to revisit our private sector privacy law, the Personal Information Protection Act, to ensure that it is fit for purpose to stand up for these rights in the
age of AI.

It has been a remarkable first year in office. I look forward to working with public bodies, private organizations, and the people of British Columbia in the years ahead to strengthen our democratic institutions and protect individual rights. Trust earned through transparency, accountability, and respect for privacy is the foundation of this work and it is my privilege to serve in advancing it.

Michael Harvey
Information and Privacy Commissioner for British Columbia