Privacy rules in the child and youth sector
Learn about the rules for personal information in the child and youth sector. These rules are outlined in Part X of the Child, Youth and Family Services Act, 2017.
On this page Skip this page navigation
Privacy legislation in the child, youth and family service sector is complex.
Agencies and programs can be governed by the:
- Freedom of Information and Protection of Privacy Act, 1990 (FIPPA)
- Municipal Freedom of Information and Protection of Privacy Act, 1990 (MFIPPA)
- Personal Health Information Protection Act, 2004 (PHIPA) (for example, mental health, complex special needs)
Before Part X (personal information) came into force as part of the Child, Youth and Family Services Act, 2017 (CYFSA), other ministry-funded agencies (e.g. children’s aid societies) were not governed by any legislation regarding the collection and handling of personal information held by those agencies.
Part X of the CYFSA, which came into effect on January 1, 2020, established new rules for the collection, use, disclosure of and access to personal information held by ministry-funded and licensed service providers that are not subject to other privacy legislation like PHIPA, FIPPA or MFIPPA. It now provides more consistent protections and rights for children, youth, and families related to their personal information.
Personal information and the Child, Youth and Family Services Act, 2017
Part X of the CYFSA outlines:
- privacy rights for individuals
- obligations for service providers with respect to safeguarding personal information
- clarified authorities for the ministry for collecting and using personal information including for research and service system planning
- oversight by the Information and Privacy Commissioner
For individuals receiving services under the CYFSA you have:
- the right to request access and correction to your records of personal information in the custody or control of a service provider
- control over how your personal information is shared among service providers, with the ability to provide consent based on capacity, not age
- the right to a complaints process and an independent review mechanism related to the collection, use and sharing of personal information
- transparency in how service providers handle your personal information
Service providers have:
- clear rules for collecting, using and sharing personal information
- requirements to protect the privacy of individuals
- rules for improved transparency and accountability (for example, requirements to provide notice of privacy breaches)
- oversight from the Information and Privacy Commissioner as to how service providers handle and share personal information
We have the:
- clarified authority to access, use and share personal information for system planning, managing, evaluating and delivering ministry-funded or provided services
- requirement to protect privacy when collecting, using or disclosing personal information
Submitting a request for a record of your personal information
There are limited exceptions to the right of access in Part X. For example, individuals do not have a right to access personal information if another law or a court order would prohibit its disclosure to the individual. Individuals also do not have a right to access personal information if granting access could reasonably be expected to result in a risk of serious harm to any individual.
To get access to your record of personal information, you must contact the service provider directly to request it.
Service providers include:
- the Minister
- a licensee, including a residential licensee
- a person or entity, including a children’s aid society or an Ontario Autism Program service provider, that provides a service funded under the CYFSA
- a prescribed person or entity set out in regulations as a service provider, but not a foster parent
Service providers must respond to a request within 30 calendar days of receipt, with a possible extension in limited circumstances of up to 90 days. The provider must provide written notice of the extension, the length of the extension and the reason for it.
Service providers are not permitted to charge you fees to access your records.
Records requests to children’s aid societies
If you’re looking to access your record of personal information from a children’s aid society, you must contact the specific children’s aid society that you received a service from to request the information. Submit your request via mail or online.
If you are uncertain about which children’s aid society dealt with your case, make your request to more than one society, focusing on societies within the general geographic location where you previously resided when you were receiving services.
Records requests to residential licensees
If you’re looking to access your personal information from a residential licensee, you may contact the residential licensee directly or the ministry’s regional office where the licensed residential setting is located. Residential settings can include children’s residences, staff-model homes and foster care agencies. The ministry’s regional office can help you by contacting the residential licensee where you were receiving residential care to access your personal information.
For information about Part X of the CYFSA or for general privacy inquiries, contact the Information and Privacy Commissioner at
You can also read the legislation and regulation: