Key takeaways
- On September 28, 2026, BC Information and Privacy Commissioner Michael Harvey marked Right to Know Week with a three-tiered transparency plan: transparency by default, proactive release of existing holdings, and a well-resourced FOI system with real oversight.
- Three weeks earlier, the BC OIPC launched a consultation on large-volume FOI requests, admitting that thousand-record files strain the 30-business-day deadline and piloting an interim framework with clearer extension communication, periodic applicant reporting, and phased releases.
- Private-sector privacy teams can map the same tiers onto DSAR work under Law 25 and PIPEDA: self-serve access where possible, data maps that make requests answerable, and a request desk that reports progress and releases records in phases instead of going silent past the 30-day clock.
A week of celebration, a system under strain
Right to Know Week 2026 started on September 28, the anniversary of the international Right to Know Day declared in Sofia in 2002. In Canada, the day has stretched into a full week, and this year the celebrations land in a rough moment for access rights. Newfoundland and Labrador’s OIPC is celebrating the week while the province’s access law, ATIPPA 2015, sits under statutory review, and the office openly notes that access rights “have faced setbacks in some parts of Canada.”
The most substantive marker of the week came from Victoria. In a statement released September 28, BC Information and Privacy Commissioner Michael Harvey said personal information rights are “under pressure from rapid advances in AI at a time of economic uncertainty, political polarization and a shifting world order,” and called access to information “a critical shield against misinformation and disinformation which can threaten civil society.”
His prescription was structural, not rhetorical. Harvey proposed a three-tiered approach: transparency by default, with systems designed so needed information is automatically available; proactive review of existing holdings to decide what can be released; and an effective, well-resourced FOI system with real oversight, inside sound information management.
That third tier is where the pressure shows. The federal, provincial, and territorial commissioners met in Ottawa on September 16 to discuss transparency and accountability “amid rapid technological change,” and two days ago CTV reported that Ontario’s IPC is seeing rising non-compliance with its orders while lacking the power to take institutions to court. Celebrating access rights while the machinery strains is not irony. It is the point of the week.
The large-volume problem, out in the open
On September 9, the BC OIPC launched a consultation on large-volume FOI requests that reads like a backlog confession. Under FIPPA, requests must be fulfilled within 30 business days unless exceptions apply, and files that run into thousands of records are one ground a public body can cite to request a time extension. The OIPC’s concern is that administering extensions has started to displace the actual work of processing records, so the OIPC is piloting an interim process: clearer communication about approvals, periodic reporting to applicants, and phased releases where possible.
That is the playbook privacy teams should notice. Every DSAR desk knows the large-volume problem. A customer access request touching backups, logs, support tickets, and a data warehouse is the private-sector twin of a thousand-record FOI file. The difference: public bodies can ask a regulator for more time, while private-sector teams under Law 25 and PIPEDA generally have 30 days to respond, with the information or a reasoned refusal, and a missed deadline is a flag no regulator ignores.
| FOI under BC FIPPA (public sector) | Access requests under Law 25 / PIPEDA (private sector) | |
|---|---|---|
| Who can request | Any person, for records held by a public body | The individual, for their own personal information |
| Statutory clock | 30 business days, with extensions for large volumes | Generally 30 days, with the information or a reasoned refusal |
| Volume problem | Thousands-of-records files; OIPC interim framework adds periodic reporting and phased releases | Requests spanning backups, logs, tickets, warehouses; no interim framework, just the deadline |
| Proactive tier | Harvey’s tiers one and two: default and proactive release | Self-serve downloads, published retention and access notices |
Translating the three tiers to DSAR operations
Tier one: transparent by default. Build customer-facing data access into the product: download-my-data buttons, account histories, and settings pages that answer the common requests before they are filed. Every request answered by self-serve never enters the queue, and the queue is where deadlines die.
Tier two: proactive review of what you hold. Keep the data map and retention schedule as living documents, not one-time PIA artifacts. You cannot phase-release records you cannot find, and you cannot find records you never mapped. The OIPC’s phased-release idea only works when search is cheap; in a DSAR program, cheap search is the data inventory.
Tier three: a well-resourced request system with oversight. The tier most programs fail. Track the 30-day clock per request, communicate early when a response will be late or partial, and borrow the interim framework’s mechanics: status updates and phased delivery instead of silence followed by a full dump. Regulators read silence as disrespect for the right. A partial release with a clear timeline reads as a program working in good faith.
Actionable takeaway: Run Harvey’s three tiers as a self-assessment this week. Count how many of last quarter’s requests could have been answered by self-serve, check whether your data inventory locates records within a day, and confirm every open request has a documented clock and a next-update date. Transparency is an operating discipline, not a ceremony, and Right to Know Week is the annual reminder that the discipline has a deadline.