TOWNSHIP OF ESQUIMALT STAFF REPORT
MEETING DATE: November 3, 2025 Report No. ADM-25-058
TO: Council
FROM: Deb Hopkins, Director of Corporate Services
SUBJECT: Policy ADMIN-84 Privacy
RECOMMENDATION:
Recommendation
That Council approve Policy ADMIN-84 Privacy.
Body
EXECUTIVE SUMMARY:
Staff are working to modernize Esquimalt’s Privacy Management Program (PMP) to ensure the Township’s continued compliance with its legislative and regulatory obligations. During staff’s review of current policies and practices, staff noted the absence of a policy that establishes procedures for the appropriate collection, use, disclosure, access, storage, retention, and disposal of personal information in accordance with the Freedom of Information and Protection of Privacy Act, other statutes, and fair information practices. As a result, Policy ADMIN-84 Privacy is presented for Council’s consideration.
BACKGROUND:
In 2021, section 36.2 of the Freedom of Information and Protection of Privacy Act (FIPPA) was updated directing FOI Heads of all public bodies to develop a Privacy Management Program (PMP) effective February 1, 2023. Under FIPPA, all local governments are designated as public bodies. Within the regulation it was noted that requirements for a PMP were not intended to be burdensome and may comprise pre-existing policies and practices and it is assumed that this is how former staff initially proceeded. However, monitoring and updating of the program is required to ensure the PMP remains appropriate to the activities of the public body and in compliance with FIPPA. As a result of staff review and analysis, several necessary changes were identified.
As part of the PMP review and modernization work underway, staff are developing a suite of policies that outline Township responsibilities and procedures required to comply with the established regulatory framework around access to records and protection of privacy. The program consists of an evolving set of policies, procedures, references, and tools developed to ensure protection of privacy throughout the information lifecycle across the organization so that all interest holders understand their responsibilities and rights as it pertains to the protection of privacy while conducting municipal business.
ANALYSIS:
Development of a Privacy Policy is a compulsory part of a public body’s PMP. The PMP may consist of one or many policies and must reflect the ten principles of privacy protection developed by the BC Government including:
1. Be accountable
2. Identify the purpose
3. Obtain consent
4. Limit collection
5. Limit use, disclosure and retention
6. Be accurate
7. Use appropriate safeguards
8. Be open
9. Give individuals access
10. Provide recourse
Policy ADMIN-84 Privacy, which mandates behaviour for the consistent and responsible handling of personal information and protection of privacy, was developed based on these guiding principles. Additional resources were consulted including the BC government’s Guide to Good Privacy Practices, the Local Government Management Association’s Privacy Management Program Framework Guidance, numerous resources made available to public bodies through the Office of the Information and Privacy Commissioner, and a review of the programs and policies established across several BC local governments.
This policy, if approved, will assist the Township towards meeting the minimum required components of a PMP as mandated by Ministerial Direction including:
• Appointing a Privacy Officer;
• Documenting process for completing privacy impact assessments (PIAs) and information sharing agreements (ISAs);
• Documenting process for responding to privacy complaints and privacy breaches;
• Providing awareness activities for employees to ensure they are aware of their privacy obligations;
• Ensuring privacy policies and documented processes are available to employees, and where practicable, the public;
• Making service providers aware of their privacy responsibilities when processing personal information on behalf of the Township; and
• Developing process for monitoring the PMP and updating it as required to remain compliant with FIPPA.
As staff continue to work through the modernization initiative, existing policies remain in effect while new ones are developed, or they may be rescinded or revised if they no longer reflect the regulatory landscape.
The municipality needs to be responsive and agile to changing regulatory requirements, technology, and public expectation, and strategic in considering the context of the Township of Esquimalt. The long-term goal of the PMP modernization initiative is to move Esquimalt beyond minimum prescribed requirements by supplementing it over time with other privacy-supportive practices that serve to increase the public’s confidence in how the Township manages and protects personal information required to deliver all current and future public services. Approval of this policy will be the first major milestone attained in the initial phases of the initiative to modernize and build out the municipality’s comprehensive Privacy Management Program.
OPTIONS:
1. That Council approve Policy ADMIN-84 Privacy. [Recommended]
2. That Council revise and approve as amended Policy ADMIN-84 Privacy.
3. That Council refer Policy ADMIN-84 Privacy to staff for additional information.
4. That Council receive Staff Report No. ADM-25-057 for information.
COUNCIL PRIORITY:
Good Governance and Organizational Excellence
FINANCIAL IMPACT:
There are no financial implications associated with the approval of Policy ADMIN-84 Privacy.
COMMUNICATIONS/ENGAGEMENT:
Should Policy ADMIN-84 Privacy be approved, the policy will be provided to all municipal department heads for distribution and explanation to employees, elected officials, volunteers, agents, and service providers. In addition, the policy will be posted to the Township’s website to be accessible to the public.
TIMELINES & NEXT STEPS:
In addition to distributing this policy, staff will also be providing access to guidelines developed to date including policy notes, templates, and procedures for complying with the policy. Corporate Services staff are also developing accompanying privacy training for all municipal staff.
This policy will be subject to regular ongoing review and will be updated as required.
REPORT REVIEWED BY:
1. Ian Irvine, Director of Finance, Reviewed
2. Dan Horan, Chief Administrative Officer, Concurrence
LIST OF ATTACHMENTS:
1. Draft Policy ADMIN-84 Privacy