Search Lethbridge.ca

Protection of Privacy & Access to Information

The City of Lethbridge strives for excellence in public access to information, transparency and accountability. Our commitment to upholding the public’s right of access to information and protecting personal privacy in accordance with the Access to Information Act (ATIA) and the Protection of Privacy Act (POPA) shapes our decisions and defines our interactions with the public as we work every day to earn the trust, respect and confidence of our community.

The Access to Information Act (ATIA) allows access to records held by public bodies in Alberta and is the cornerstone of an open, accessible and accountable public body. It aims to strike a balance between the public’s right to know information and protecting confidential information required to ensure effective operations of government and public bodies.

For information and resources for the ATIA visit the Government of Alberta’s website.

The Protection of Privacy Act (POPA) in Alberta establishes the laws that public bodies must follow when they collect, use, or disclose personal information. It requires that public bodies protect personal information and controls how public bodies can create, use and disclose non-personal data.

POPA ensures a balance between facilitating efficient public services and safeguarding individual privacy rights.

For information and resources for the POPA visit the Government of Alberta’s website.

FOIP is short for the Freedom of Information and Protection of Privacy Act (POPA).

On June 11, 2024, the Access to Information Act (ATIA) and the Protection of Privacy Act (POPA) were proclaimed and the FOIP Act was repealed.

As a member of the public, you have a powerful right to access records held by public bodies under the Access to Information Act (ATIA). You can ask for existing records that a public body already has. This includes documents, emails, reports, data files, photos, videos, and more. 

The ATIA does not require a public body to:

  • Answer a question.
  • Create a new document or report for you.
  • Provide an opinion or analysis.

The ATIA recognizes that it can be challenging to know exactly what records exist or how to describe them. That's why each public body has an ATIP Coordinator whose job it is to help you gain access to the City’s records. If you're unsure how to phrase your request or what specific records might exist, you should contact the City’s Access and Privacy Office (APO) by email APO@lethbridge.ca or calling 311 or 403-320-3111 (if outside of Lethbridge). 

You can make an access to information request by completing the Access to Information Request Form.

No, not always!

Lots of information held by the city is already available to everyone without needing to make a special request. This is called "routine disclosure" or "proactive disclosure."

For example, things like:

  • Meeting minutes from city council
  • Budgets or financial reports
  • Policies and bylaws
  • Maps and datasets

If you can’t find the information you’re looking for on our website, you can also ask the department or person who deals with that information.

You usually only need to make a formal ATI request when the information you want isn't already available to the public, or if it contains personal information. It's always a good idea to ask first if you can get the information without a formal request! It might save you time and money.

You can make an access to information request by completing the Access to Information Request Form

No, you don't have to tell us why you're asking for information.

However, sometimes if you share why you're interested, the Access and Privacy Office (APO) might be able to help you find exactly what you're looking for more easily within all the city's records.

Think of it like this: if you tell a librarian what kind of book you want, they can help you find it faster!

The cost of an access to information request in Alberta depends on what kind of information you are asking for:

For your own personal information:
There is no initial application fee to request information about yourself.
However, you may be required to pay the cost of making copies of your records if the total is more than $10, If fees are required, we’ll let you know before we process your request. 

For general information (not your own personal information):
There is an initial $25 application fee for general information requests. This fee must be paid before we start processing your request. 

Additional fees may apply to some requests. This includes costs for:

  • Searching for and finding the records.
  • Producing records from electronic files.
  • Making copies (photocopies, printouts, etc.).
  • Producing copies of other media like audio or video.
  • Converting files into a redactable format.

If the total estimated cost for processing your request is more than $150, we will provide you with a fee estimate. You will be asked to pay a 50% deposit of that estimated fee before we continue processing your request. Once processing is complete, you are provided with the actual fees for your request. Any outstanding balance must be paid before you are given the information. If the actual amount is less than the deposit amount you will receive a refund with the difference. 

Fee waivers: 
In some cases, fees might be reduced or waived entirely if you can't afford them, or if the disclosure of the information is considered to be in the public interest. If you would like to request a fee waiver, please contact the Access and Privacy Office (APO) by email APO@lethbridge.ca or by calling 311 or 403-320-3111 (if outside of Lethbridge).

Once you send in your request and the initial fees are paid, we will usually respond to your request within 30 business days. 

However, sometimes it can take a bit longer. This might happen if:

  • We need to search through a lot of records.
  • We need to talk to other people or organizations before they can release the information (for example, if the information is about someone else and they need to ask that person for permission).

If we need longer than 30 business days to respond to your request, we’ll provide you with an updated timeline and let you know why we need to extend the deadline. 

If you believe that personal information about you in City of Lethbridge records is incorrect, incomplete, or misleading, you have the right to ask for a correction under Alberta's Protection of Privacy Act (POPA).

To make a request to correct your personal information please contact the Access and Privacy Office (APO) by email APO@lethbridge.ca or calling 311 or 403-320-3111 (if outside of Lethbridge). 

The City of Lethbridge Access & Privacy Office (APO@lethbridge.ca) can assist you if you with any questions or concerns you have about how your personal information is collected, used or shared by the City of Lethbridge. 

You can also make a complaint to Alberta’s Office of the Information & Privacy Commissioner (OIPC) if you believe the City of Lethbridge has violated your rights under the Access to Information Act (ATIA) or the Protection of Privacy Act (POPA).

While your consent is generally required before the City can share your personal information, the Protection of Privacy Act (POPA) provides specific exceptions where your personal information can be disclosed without getting your consent.

Examples of specific situations where the City can disclose personal information without your consent are:

  • To help with a law enforcement investigation that is likely to lead to a legal proceeding (like a criminal charge).
  • To comply with a subpoena, warrant, or court order.
  • In an emergency, a public body can share the least amount of personal information required to prevent or minimize serious harm to your health, safety, or the health or safety of another person without your consent.

When another law in Alberta or Canada specifically allows or requires the disclosure of your personal information to law enforcement or other parties without your consent.

Law enforcement agencies can request the disclosure of personal information under section 13 of POPA by completing the Law Enforcement Disclosure Request Form

After submitting the form, a City of Lethbridge employee will contact you as soon as possible after your form is submitted, usually within 1 business day of receiving your request. The City of Lethbridge may require additional documentation to confirm your identity and authority before records containing personal information are released.

If you're not happy with the City's decision about your access to information request, you can ask for help from an independent office called the Office of the Information and Privacy Commissioner (OIPC) of Alberta.

The OIPC is separate from the City and their job is to make sure that public bodies comply with the Access to Information Act (ATIA) and the Protection of Privacy Act (POPA).

You can ask the Commissioner to review decisions about things like:

  • Information the City refused to give to you.
  • If they redacted or removed from the information given to you.
  • The amount of time it took to respond to your request. 
  • If you think they collected, used, or shared your personal information in the wrong way.

You usually have a certain amount of time (often 60 days) after you get the City's decision to ask the OIPC for a review. You can find more information and forms on the OIPC website.

City of Lethbridge Privacy Management Program

Under Alberta’s Protection of Privacy Act (POPA), every public body in the province must have a clear and comprehensive privacy management program (PMP). This includes written policies, procedures and governance practices that explain how personal information is collected, used, protected and shared within the organization.

The City of Lethbridge is enhancing our existing PMP to fully align with these provincial requirements. Once complete, our full program will be publicly available on this City’s website.

Why does a privacy management program matter

A strong, easy‑to‑understand PMP helps ensure that your personal information is treated with care, respect and transparency. It also helps us identify and manage privacy risks before they become issues. Strengthening public trust and meeting our legal responsibilities are priorities for the City, and this work is an important part of that commitment.

The following is an overview of the City of Lethbridge’s privacy management program.

Privacy Governance

POPA requires public bodies to designate someone responsible for privacy oversight. The City’s Privacy Officer:

  • Serves as the main contact for privacy questions
  • Maintains the City’s privacy policies
  • Supports staff in meeting POPA requirements
  • Ensures responsible handling of personal information

Correcting Your Personal Information

POPA requires public bodies to provide a way to request corrections.

If your information is inaccurate:

  • Submit a written request to the Privacy Officer
  • The City reviews and decides whether a correction is appropriate
  • If corrected, third parties who received incorrect information in the past year are notified
  • If not corrected, a note is added to your file
  • You will receive a response within 30 business days
  • Routine updates to personal information should still be directed to the relevant department (e.g., updates to mailing or email address, phone numbers, etc.)

Responding to Privacy Incidents

POPA requires public bodies to respond to privacy incidents.

A privacy incident includes loss, unauthorized access or unauthorized disclosure of personal information.

When an incident occurs:

  • Staff report it immediately to the Privacy Officer
  • The City contains the incident and investigates
  • If there is a real risk of significant harm, the City notifies the Minister, the Office of the Information and Privacy Commissioner (OIPC) and affected individuals
  • The City documents the incident and takes steps to prevent recurrence

Privacy Complaints

POPA requires public bodies to provide a way to raise privacy concerns.

If you have a concern:

  • Submit a written complaint to the Privacy Officer
  • The City acknowledges and reviews
  • A written response is provided within 30 business days
  • If unsatisfied, you may contact the OIPC
  • The City keeps a record of all complaints and outcomes

Non‑Personal Data (De‑Identified Information)

POPA requires public bodies to document how non‑personal data is created and ensure individuals cannot be identified.

The City:

  • Creates non‑personal data only when permitted
  • Documents how and why data is de‑identified
  • Confirms individuals cannot be identified or re‑identified
  • Uses methods that are clear and reproducible for audit purposes

Automated Systems and Artificial Intelligence

POPA requires safeguards and transparency when personal information is used in automated systems.

When the City uses automated tools:

  • Individuals are notified if personal information collected after June 11, 2025, is used
  • Safeguards such as encryption, access controls and multi‑factor authentication are applied
  • Human oversight reviews system outputs
  • Systems are monitored for bias, fairness and emerging privacy risks

Security Classification System

POPA requires public bodies to classify information based on sensitivity.

The City’s classification system applies to:

  • Personal information
  • Data derived from personal information
  • Non‑personal data

This ensures each type of information receives appropriate protection.

Safeguards

POPA requires administrative, physical and technical safeguards to protect personal information.

  • Administrative: privacy policies, limited access, staff training, confidentiality in contracts
  • Physical: secure storage, proper disposal (e.g., shredding), controlled visitor access
  • Technical: encryption, multi‑factor authentication, access audits, timely security updates

Mandatory Employee Training

POPA requires all City employees - including volunteers, contractors, appointees and service providers - to complete privacy training.

Training covers:

  • The Act and privacy rights
  • City privacy policies and procedures
  • How to identify and report privacy incidents
  • How to respond to correction requests

Public Transparency

POPA requires public bodies to make their privacy management program (PMP) available upon request.

  • The City provides the PMP upon written request to the Privacy Officer
  • Copies may be redacted to remove technical or security‑sensitive information

Questions

The City of Lethbridge’s Access and Privacy Office (APO) can work with you to clarify and simplify your request which can help make the request process more efficient. You can contact the City’s APO office by emailing APO@lethbridge.ca or calling 311 or 403-320-3111 (if outside of Lethbridge). 

Contact Us

City Hall
910 4 Avenue South
Lethbridge, AB T1J 0P6

Phone: 311
or 403-320-3111 (if outside of Lethbridge)