Under Alberta’s Protection of Privacy Act (POPA), every public body in the province must have a clear and comprehensive privacy management program (PMP). This includes written policies, procedures and governance practices that explain how personal information is collected, used, protected and shared within the organization.
The City of Lethbridge is enhancing our existing PMP to fully align with these provincial requirements. Once complete, our full program will be publicly available on this City’s website.
Why does a privacy management program matter
A strong, easy‑to‑understand PMP helps ensure that your personal information is treated with care, respect and transparency. It also helps us identify and manage privacy risks before they become issues. Strengthening public trust and meeting our legal responsibilities are priorities for the City, and this work is an important part of that commitment.
The following is an overview of the City of Lethbridge’s privacy management program.
Privacy Governance
POPA requires public bodies to designate someone responsible for privacy oversight. The City’s Privacy Officer:
- Serves as the main contact for privacy questions
- Maintains the City’s privacy policies
- Supports staff in meeting POPA requirements
- Ensures responsible handling of personal information
Correcting Your Personal Information
POPA requires public bodies to provide a way to request corrections.
If your information is inaccurate:
- Submit a written request to the Privacy Officer
- The City reviews and decides whether a correction is appropriate
- If corrected, third parties who received incorrect information in the past year are notified
- If not corrected, a note is added to your file
- You will receive a response within 30 business days
- Routine updates to personal information should still be directed to the relevant department (e.g., updates to mailing or email address, phone numbers, etc.)
Responding to Privacy Incidents
POPA requires public bodies to respond to privacy incidents.
A privacy incident includes loss, unauthorized access or unauthorized disclosure of personal information.
When an incident occurs:
- Staff report it immediately to the Privacy Officer
- The City contains the incident and investigates
- If there is a real risk of significant harm, the City notifies the Minister, the Office of the Information and Privacy Commissioner (OIPC) and affected individuals
- The City documents the incident and takes steps to prevent recurrence
Privacy Complaints
POPA requires public bodies to provide a way to raise privacy concerns.
If you have a concern:
- Submit a written complaint to the Privacy Officer
- The City acknowledges and reviews
- A written response is provided within 30 business days
- If unsatisfied, you may contact the OIPC
- The City keeps a record of all complaints and outcomes
Non‑Personal Data (De‑Identified Information)
POPA requires public bodies to document how non‑personal data is created and ensure individuals cannot be identified.
The City:
- Creates non‑personal data only when permitted
- Documents how and why data is de‑identified
- Confirms individuals cannot be identified or re‑identified
- Uses methods that are clear and reproducible for audit purposes
Automated Systems and Artificial Intelligence
POPA requires safeguards and transparency when personal information is used in automated systems.
When the City uses automated tools:
- Individuals are notified if personal information collected after June 11, 2025, is used
- Safeguards such as encryption, access controls and multi‑factor authentication are applied
- Human oversight reviews system outputs
- Systems are monitored for bias, fairness and emerging privacy risks
Security Classification System
POPA requires public bodies to classify information based on sensitivity.
The City’s classification system applies to:
- Personal information
- Data derived from personal information
- Non‑personal data
This ensures each type of information receives appropriate protection.
Safeguards
POPA requires administrative, physical and technical safeguards to protect personal information.
- Administrative: privacy policies, limited access, staff training, confidentiality in contracts
- Physical: secure storage, proper disposal (e.g., shredding), controlled visitor access
- Technical: encryption, multi‑factor authentication, access audits, timely security updates
Mandatory Employee Training
POPA requires all City employees - including volunteers, contractors, appointees and service providers - to complete privacy training.
Training covers:
- The Act and privacy rights
- City privacy policies and procedures
- How to identify and report privacy incidents
- How to respond to correction requests
Public Transparency
POPA requires public bodies to make their privacy management program (PMP) available upon request.
- The City provides the PMP upon written request to the Privacy Officer
- Copies may be redacted to remove technical or security‑sensitive information