British Columbia: FOIPPA
BC municipalities: your staff are already using AI. Your FOIPPA obligations don't wait for your policy.
BC's Freedom of Information and Protection of Privacy Act places clear obligations on local governments for how citizen data is handled, including when AI tools are involved. Spencer Morley Consulting helps BC municipalities build the governance program FOIPPA requires, and the AI capability their staff actually need.
FOIPPA Section 30.1 was repealed. The rule you think you have is gone.
Ask most BC municipal administrators what FOIPPA requires of an AI tool and you will hear that citizen data has to stay in Canada. That was s. 30.1, which required personal information to be stored and accessed only in Canada, subject to limited exceptions. It was repealed on 25 November 2021 by Bill 22 (SBC 2021, c. 39, s. 17), and the consolidated Act now reads “30.1–30.2 [Repealed 2021-39-17.]”. British Columbia no longer requires public bodies to keep personal information in Canada. Disclosure outside Canada is still regulated: under s. 33.1 and B.C. Reg. 294/2021, storing sensitive personal information outside Canada requires an assessment in your privacy impact assessment. What it does have is an obligation almost nobody is talking about: since 1 February 2023, s. 36.2 has required the head of every public body, municipalities included, to develop a privacy management program. If your staff are using AI on personal information, that is the gap, not where the server sits.
Key terms
FOIPPA
Freedom of Information and Protection of Privacy Act (BC)
Governs access to records and protection of personal information held by BC public bodies. A municipality is a “local government body” and therefore a local public body under Schedule 1. Since 1 February 2023, s. 36.2 requires the head of a public body to develop a privacy management program in accordance with the directions of the minister responsible for the Act, and s. 36.3 requires notice to affected individuals and the Commissioner when a breach could reasonably be expected to cause significant harm. Section 30 still requires reasonable security arrangements. Sections 30.1–30.2 (the old residency rule) are repealed; disclosure outside Canada now falls under s. 33.1.
OIPC BC
Office of the Information and Privacy Commissioner for BC
BC's independent oversight body. Investigates complaints, conducts investigations and audits of public bodies, and issues binding orders. Has published principles for generative AI with other Canadian privacy regulators.
UBCM
Union of BC Municipalities
Represents local governments across British Columbia and sets its policy positions through resolutions endorsed at its annual convention.
PIA
Privacy Impact Assessment
Section 69(1) defines a privacy impact assessment as an assessment to determine whether a current or proposed system, project, program or activity meets the requirements of Part 3 of FOIPPA, and s. 69(5.3) requires a municipality to conduct one in accordance with the minister’s directions. A BC municipality standing up any new AI tool, including a private LLM, is squarely in that definition. Spencer Morley Consulting supports PIA preparation as part of the policy and deployment work.
The problem in BC
Shadow AI is already in your municipality. FOIPPA makes it a compliance issue.
National research on Canadian public sector AI use applies directly to BC local governments. The numbers are not hypothetical. They describe what is almost certainly already happening in your organization.
Sources: KPMG Canada, 2025, survey of 349 public servants; MNP 2025 Municipal Report, survey of 282 municipal leaders
What we do for BC municipalities
Five services. One framework. Built around FOIPPA.
Every engagement is adapted to BC's specific legislative requirements, not a copy-paste Alberta template. Delivered remotely, available to any BC municipality regardless of size or location.
AI readiness assessment
A structured diagnostic of your municipality's current AI exposure, shadow AI risk, and FOIPPA compliance gaps, including where each tool in use stores personal information and whether a s. 33.1 assessment is needed. Delivers a plain-language roadmap your council can approve. The right starting point before any other investment.
Staff AI training & prompt engineering
Practical training on what BC municipal staff can and cannot use AI for under FOIPPA, specifically covering disclosure outside Canada, personal information handling, and breach reporting. Staff learn both the compliance framework and how to use sanctioned AI tools effectively. Available remotely or on-site anywhere in BC.
AI adoption policy & procedures
A formal AI adoption policy grounded in FOIPPA and designed for BC council adoption. Covers sanctioned tools and how they are assessed, prohibited uses involving citizen personal information, breach reporting obligations under FOIPPA, and staff expectations. Written so that a CAO without legal background can implement it, and that the OIPC BC would recognize as a genuine governance program. Delivered as two documents: the AI Adoption Policy council adopts, and a companion AI Adoption Procedures document setting out how staff request and approve tools, what is logged, and the exact steps when a breach is suspected, so administration can revise procedures as tools change without returning to council each time.
See the AI adoption policy for public bodiesPrivate AI options
Some municipalities want AI that can work with sensitive information without using a public platform. We can explore whether a privately hosted option fits your situation. Any build would be scoped as a custom project, so we make no commitments until we understand what you need.
Agentic workflows
Municipal administrative automation: meeting minutes, council agendas, bylaw drafting, permit correspondence, report generation, ratepayer communications, built privacy-by-design and with explicit human oversight. Every workflow is scoped to comply with FOIPPA data handling requirements for BC local governments.
BC municipality FAQ
Questions from BC CAOs and municipal administrators
Doesn’t FOIPPA require citizen data to stay in Canada?
Not any more, and this is the single most common misunderstanding in BC local government. Section 30.1 did require it, subject to limited exceptions, and it was repealed on 25 November 2021 by Bill 22 (SBC 2021, c. 39, s. 17). The consolidated Act now shows ss. 30.1–30.2 as repealed. What replaced it is narrower: under s. 33.1 and B.C. Reg. 294/2021, storing sensitive personal information outside Canada requires an assessment in your privacy impact assessment. What still applies: s. 30 (reasonable security arrangements), s. 36.2 (a privacy management program, required since 1 February 2023), s. 36.3 (notification when a breach could reasonably be expected to cause significant harm) and s. 69(5.3) (privacy impact assessments). Where a tool sends data is still a real security question; it is just not a prohibition, and a policy built on the wrong section will not survive scrutiny.
Our municipality already uses Microsoft 365 with Copilot. Are we compliant with FOIPPA?
Compliance here is not a question about where the data sits. Since s. 30.1 was repealed, a Canadian data centre is not what makes Copilot compliant and a US one is not what makes it non-compliant. The questions that decide it: do you have the privacy management program s. 36.2 has required since February 2023; was a PIA completed under s. 69(5.3) before deployment, including the s. 33.1 assessment if sensitive personal information is stored outside Canada; are the security arrangements reasonable under s. 30; and do staff know what they may and may not put into it. The AI Readiness Assessment establishes what is actually in use and which of those are missing.
We're a small BC municipality (District of X with 3 staff). Is this service appropriate for us?
Yes. Small municipalities are exactly who this service is built for. Large BC municipalities (Metro Vancouver member cities, City of Victoria, etc.) have legal counsel and dedicated privacy officers. Small district municipalities, villages, improvement districts, and rural communities typically don't, and generic enterprise-level compliance templates don't work for a three-person office. Spencer Morley Consulting's Municipal AI Framework is designed for small teams, delivered remotely, and sized appropriately.
Has Spencer Morley Consulting worked with BC municipalities before?
We work with municipalities anywhere in Canada and deliver every engagement remotely, so your location changes nothing about how the work runs. Our record is Alberta, including wildfire response for the Municipality of Jasper, crisis plans and staff training for the County of Grande Prairie No. 1, and emergency management training for the County of Minburn. You get the same team and the same method, written to FOIPPA and to BC's Office of the Information and Privacy Commissioner.
What is the UBCM's position on AI governance for BC municipalities?
UBCM sets its positions through resolutions at its annual convention. We have not found UBCM guidance on municipal AI policy, so the obligations that matter are FOIPPA's: a privacy management program under s. 36.2, privacy impact assessments under s. 69(5.3), and reasonable security arrangements under s. 30.
Further reading
BC municipalities
FOIPPA compliance isn't optional. Neither is acting now.
Your staff are using AI today. FOIPPA’s accountability requirements apply regardless of whether a policy exists. Let's talk about where your municipality stands.