Notice of collection: the duty already in force, and what we found on 1,503 public forms

What the Act requires on every form

When personal information is collected on behalf of an institution, MFIPPA s. 29(2) says the head must tell the person:

1. the legal authority for the collection;
2. the principal purpose or purposes for which the information is intended to be used; and
3. the title, business address and business telephone number of an officer or employee who can answer questions about the collection.

That is three parts, and part (c) holds three pieces of contact information, so we checked five items on each form. The exceptions are narrow: information the head could refuse to disclose for law enforcement reasons, a waiver by the Minister, or a case the regulations exempt (s. 29(3)). The duty covers forms a vendor runs for you, because the information is still collected on your institution’s behalf.

From January 1, 2027, when the IPC reviews an institution’s information practices, the Act says it checks whether the requirements “with respect to notice” have been met (s. 38.1(4)(b)).

Which parts were missing

Share of the 1,503 forms on which each item appeared, on the form or in a collection notice linked from it.

• Legal authority for the collection27%
• Principal purpose50%
• Title of a contact38%
• Business address of that contact17%
• Business phone of that contact23%

One pattern stood out in the legal authority. On 306 forms (20%) the notice named MFIPPA itself as the authority. MFIPPA sets the rules for collecting personal information; it does not, on its own, authorize a particular program, so we counted those as missing. If they were counted as giving the authority, 90% of forms (1,349) would still leave out at least one part.

By type of institution

Library forms were the most likely to carry no notice at all. Police and school board forms were the most likely to have a notice that names only MFIPPA as the authority (43% and 28% of forms). Small groups give less certain percentages: the police, conservation authority and board of health figures rest on 50 to 75 forms each.

Municipalities by size

Share of forms missing at least one part, by 2021 Census population: small (under 10,000), mid-sized (10,000 to 99,999) and large (100,000 or more).

• Small96%613 forms from 240 municipalities; 51% had no part at all
• Mid-sized91%342 forms from 133 municipalities; 36% had no part at all
• Large84%89 forms from 42 municipalities; 25% had no part at all

Larger municipalities did better on every item, but even among the largest, five in six forms left something out.

Website checks

For each institution we also searched the public website for three things. “Found” means we could find it; a breach protocol does not have to be published, and assessments are usually internal, so the last two rows say what residents can see, not what exists inside the office.

Among municipalities, size mattered most here: a privacy policy was visible on 49% of small, 82% of mid-sized and all 44 large municipal websites, and a breach protocol or reporting route on 2%, 10% and 39%.

Why most forms miss them

The numbers above are counts. This section is our reading of the forms behind them, not a measured result.

• The Act is named instead of the program’s authority. One form in five named MFIPPA as the authority. The fix is to name the statute or by-law that authorizes the program, with a section if you know it.
• A privacy page stands in for a notice. Many sites have a general privacy statement, but s. 29(2) asks for the notice when the information is collected. A link in the website footer rarely gives the purpose of a specific form.
• The contact is an inbox, not a position. Forms often give an email address or a general phone line, but not the title and business address of someone who can answer questions. The business address was the item most often missing.
• Forms come from many places. Departments build their own forms, fillable PDFs are copied from older versions, and booking or payment vendors supply their own pages with no space for a notice.
• It has never been checked. Notice of collection sits on every form, so it is easy to assume someone else checked it.

A notice that covers every part

One standard block, reused on every form with the right authority and purpose filled in, fixes most of the gap:

Personal information on this form is collected under the authority of [statute or by-law, with section if known] and will be used to [purpose]. Questions about this collection can be directed to the [position title], [institution], [business address], [business phone].

• Put it on the form itself, before the submit button.
• Use a position title rather than a person’s name, so it survives staff changes.
• Check fillable PDFs and vendor-run forms as well as your own web pages.
• Keep the list of forms you fixed: from January 1, 2027 it is also where your privacy impact assessments start.

Our free check applies this method to your own public forms and sends the results, form by form, as a one-page PDF.

Method

Who. Municipalities: every one on the Province’s list of Ontario’s 444 municipalities; we could check 441. Local boards: 233 boards we listed from public sources, namely 74 public library boards, 31 police service boards, 61 school boards and 6 school authorities, 29 conservation authorities and 32 boards of health. Some boards of health merged and share one website, so the boards sit on 226 websites. The boards are a list we built, not a complete census or a random sample. We left out 13 OPP detachment boards, whose only forms were their town’s.

Which forms. On each official website we looked for up to five public online forms that collect personal information: permit and licence applications, service requests, contact forms, recreation and program registrations, bookings and complaints. Fillable PDF forms counted. We skipped anything behind a login or an account.

What we counted. We looked at 1,806 forms and counted only the 1,503 we could read in full, from 623 institutions (415 municipalities and 208 boards). We left out 178 forms we could only partly read, 117 we could not read from the public page without interacting with them, and 8 that were not the institution’s own collection, such as a provincial form hosted on a local site. None of these is in any percentage. A form that appeared under two institutions, for example on a website two merged boards of health share, is counted once.

How we coded. For each form we checked five items: the legal authority, the principal purpose, and the title, business address and business phone number of a contact. An item counted as present if it was on the form or in a collection notice linked from the form. A general website footer did not count as the contact. A notice naming only MFIPPA did not count as the legal authority. When unsure, we marked an item missing and noted why.

Website checks. For each institution we searched its website for a privacy policy or statement, a privacy breach protocol or a page telling residents how to report a breach, and any mention of privacy impact assessments.

When and how. All pages were read on October 13 and 14, 2026, including our first, smaller sample of 40 municipalities and 115 forms from October 13. We did not submit any form, log in, or contact any institution. We keep the underlying data privately and do not name any institution in public. An institution can ask us for its own results.

Limits

• This is a review of public web pages, not a legal audit. A notice can also be given on a paper form, at a counter or in a confirmation email, which we could not see.
• Some collections do not need a notice (s. 29(3)). We did not assess exemptions, so a few forms we counted as missing parts may be exempt.
• The number of forms per institution varies, and the boards are a list we built, so the results describe these forms, not every Ontario institution.
• Forms we could not read in full are left out. If they differ from the forms we could read, the results would change.
• Coding involves judgment, especially for the contact’s title and for authorities that name a statute loosely. When unsure we marked an item missing, which may overstate gaps slightly.
• The forms were coded in several batches to the same written rules; we did not code every form twice.
• Websites change. A form may have been updated since October 14, 2026.