PRIVACY IMPACT ASSESSMENT TOOL · FIPPA AND PHIA · BC and Manitoba · September 2026

Public bodies are adopting AI faster than they can assess it. Fipp walks the privacy assessment, stage by stage.

Two provincial Acts read at the source, 32 checks modelled with the provision named on each, and one widely cited section found repealed. Six stages in the order a coordinator thinks, a residency alert the moment data leaves Canada, and a sealed dossier at the end. Worked examples are fictional; the tool is research assistance, not legal advice.

SPEC · FP001

Role: Solo Designer & Developer
Timeline: September 2026 (two days)
Stack: Next.js 16 · React 19 · Claude · Make
Constraint: NOTHING LEAVES THE BROWSER

PROVISIONS VERIFIED AT SOURCE 32 / 32 →

MY ROLE002

Solo build. The statute model came first: the Acts, the regulations and the directions read at the primary source, each section checked for whether it is still in force, before any product code. Then the tool, a code review, a design audit, and a final pass where Fipp assessed its own AI feature. Built for the coordinator who has just been handed an AI tool and a blank template.

Team

Solo (1 person)

Modelled user

FIPPA coordinator, BC or MB (not yet tested with one)

FIG. 01SEPTEMBER 2026

PROBLEM → SOLUTION003

The Problem vs. The Solution

A public body adopting a tool that touches personal information owes a privacy impact assessment. The person assigned is rarely a lawyer, and AI tools ask questions the old template never did.

BEFORE003.A

A blank template and a deadline

P-01

The PIA is mandatory, the help isn’tFIPPA s. 69 requires it before the initiative proceeds. The coordinator holding the pen is not a privacy lawyer.

P-02

The law is scattered, and partly deadAn Act, two regulations, three directions, and repealed sections still circulating in old templates.

P-03

AI tools ask questions the form can’tModel APIs outside Canada, automated decisions about people, deidentification timing. No row for any of it.

AFTER003.B

A walk instead of a form

S-01

Six stages, one spineAnswer in walking order; the statute work happens underneath. Four worked examples show a finished assessment first.

S-02

Citations only from a verified modelEvery question names its provision. Repealed sections were never modelled, so nothing dead can be cited.

S-03

Live flags, sealed outputA residency alert (the build calls it the Marmot) fires the moment a flow leaves Canada. The dossier prints to letter and carries a reproducible SHA-256 seal.

READING THE ACTS004

The statute work came first

Before any product code, both Acts were read at the source and every check in the tool was traced to a provision that is in force. This is the part of the build a privacy office would examine, so it is the part shown first.

METHOD004.A

Sources, in the order they were read

The Acts, on the official consolidationsBC FIPPA; Manitoba FIPPA (C.C.S.M. c. F175) and PHIA (C.C.S.M. c. P33.5).

Regulations and directionsB.C. Reg. 294/2021 and the ministerial directions, read against the sections they modify.

Guidance, labelled as guidanceManitoba Ombudsman PIA Tool (2015), the Province’s PIA page, FIPPA Resource Manual ch. 6. Cited as policy, never as statute.

Currency, section by sectionRepealed sections were never modelled, so nothing dead can be cited. BC’s s. 30.1 is the one most templates still carry.

JUDGEMENT004.B

Two calls a coordinator would recognise

J-01

Find where the duty actually livesHalf the internet cites BC s. 30.1 for data residency. It is repealed. The gate now sits in s. 33 with B.C. Reg. 294/2021, and that is what the tool cites.

J-02

Manitoba tells the truth about itselfNeither FIPPA nor PHIA requires a PIA, so the item says “expected by policy, not required by the Act” with three sources behind it. Provincial PIA policy binds government departments; for a city or a school division the expectation rests on Ombudsman guidance and local practice, which is why the label says policy.

J-03

No residency rule, so route it through s. 44.1Manitoba has no statutory data-residency section. Storage or processing by an outside provider runs through the information manager agreement, with the information deemed to stay in the public body’s custody and control.

Fipp stage 3 for the Manitoba worked example, a city clerk records-request triage tool: the checklist header says twelve items apply under Manitoba rules, and the first items cite FIPPA sections 36, 37, 38 and 40 with a plain-language reason for each — FIG. 02Stage 3, Manitoba worked example: a city clerk’s records-request triage tool. Every item names its section and says why it is asked.

The Manitoba PIA checklist item labelled expected by policy, not required by the Act, citing the Manitoba Ombudsman PIA Tool, the Province of Manitoba PIA page and the FIPPA Resource Manual chapter 6, with a named remedy to complete a PIA before launch — FIG. 03The PIA item says policy, not Act, and cites the three sources a Manitoba coordinator would.

The Fipp dossier for the Manitoba example: privacy impact assessment for a vendor tool that suggests routing and deadlines for incoming records requests, jurisdiction Manitoba, PIA basis expected by policy, aggregate status conditional, tool and program details, two data-flow hops inside Canada and the residency posture under section 44.1 — FIG. 04The dossier for the same example. Aggregate status: conditional, because the PIA is still underway.

Not covered, on purpose: access requests, the 30-day clock, extensions, fees, exceptions and Ombudsman complaints. Fipp is the privacy-protection side of the job only, and it is not legal advice.

THE IMPACT005

The Impact

Fipp is a live demo, so the numbers are about legal credibility. In a compliance tool a wrong citation is the whole product failing.

Statute checks modelled

15 BC and 17 Manitoba items, PHIA overlay included, each verified at the source.

Repealed section caught

0 · s. 30.1

BC’s best-known data-residency section is dead. The research pass caught it before it could be cited.

Manitoba items, labelled by source

Twelve FIPPA sections, five PHIA sections, and one PIA expectation labelled policy, not Act.

THE JOURNEY006

Blank Template vs. Guided Walk

The old path loops: draft, submit, get it back, rework. Fipp’s path is a line, because the checking happens while you answer.

BEFORE · THE TEMPLATE LOOP006.A

AFTER · THE SIX STAGES006.B

EVERY QUESTION NAMES ITS PROVISION · THE FLAGS FIRE WHILE YOU TYPE

KEY DECISIONS007

Key Design Decisions

Three more calls shaped the product. The thread through all of them: in a tool about the law, honesty is the design system.

DEC-01

The journey is the product

Not a smarter template. Six stages in the order a coordinator thinks, a spine that holds your place, four worked examples, and nothing leaving the browser.

Why

A blank form transfers anxiety. A walk transfers process.

DEC-02

The seal is deterministic

The dossier text is hashed, then the whole payload is hashed again with the time of the check. Same assessment, same engine, same dossier hash every time; the certificate hash moves with the timestamp, and the document says so. The instruction to re-run the check is printed on it.

Why

A reviewer does not have to trust the tool. They can re-run it and watch the hash come back.

DEC-03

The AI cites from a closed pack

The second opinion never writes a citation. It picks ids from a pack the browser built, and an unknown id drops the whole finding.

Why

Courts are fining lawyers for invented citations. The fix is an interface where inventing one is impossible.

THE AI SECOND OPINION008

An AI Lane That Can’t Invent Law

The engine flags what checkboxes can prove; a Make.com webhook carries the draft to Claude for judgment on the prose. The design problem was making a language model legally citable.

THE CLOSED PACK008.A

Sequence diagram of the AI review lane: coordinator confirms, Fipp builds a statute pack and posts to the Make webhook, a quota store counts the day, Haiku returns findings with pack ids only, Fipp resolves the ids and shows findings without saving them — FIG. 06One round trip. Ids in, ids out, unknown ids dropped.

C-01ids only

Citations travel as pack ids

The pack is filtered by the same applicability rules as the on-screen checklist, so PHIA cannot be cited on an assessment with no health data.

C-02consent

One honest dialog

The button breaks Fipp’s nothing-leaves-the-browser promise on purpose, so real drafts get a plain-words confirm first. Capped at forty reviews a day.

Findings are ephemeral: never persisted, never hashed into the seal, never printed.

FIPP ON FIPP008.B

The lane failed its own assessment. Good.

Before shipping, the AI lane went through Fipp’s six stages as the tool under assessment.

Two residency alerts on the Fipp self-assessment, both under FIPPA s. 33.1 — FIG. 07Two residency alerts, s. 33.1.

The ax-clearance seal block on the Fipp self-assessment dossier — FIG. 08Sealed, verdict included.

V-01verdict

Aggregate status: Not ready

Two alerts where data leaves Canada, six gaps, three with owners and dates. The sharpest: no agreement binds the vendors’ staff to the Act.

We asked our privacy tool about its own AI feature. It said no. Read the sealed dossier →

UNDER THE HOOD009

Inner Workings

Three views of the same machine: what is on the page, how one answer becomes a sealed dossier, and the states an assessment moves through.

Information architecture map: shell with header, spine, rail and continue bar; six stages in order; dossier outputs including print, text export, preview with seal and the AI review panel; a data layer of presets, versioned localStorage and jurisdiction profiles feeding the derive engine — FIG. 09Information architecture. One page, four layers.

FIG. 10One answer, start to seal.

State diagram: a checklist item moves from unanswered to meets or gap, gap to mitigated with an owner and date; the whole assessment moves between not ready, conditional and ready to file — FIG. 11What flips the verdict.

Open the FigJam board ↗

LIVE PROTOTYPE010

Try it

The production build, embedded. Load a worked example, walk the stages, print the dossier. Nothing you type leaves your browser; it is not legal advice.

fipp.vercel.app fipp.vercel.app ↗

Read the Fipp-on-Fipp dossier →

INSIDE THE APP011

Inside the App

Real captures from the production build. Every image opens full size.

Stage 1 of Fipp: the describe-the-tool form with four worked-example presets — FIG. 12Stage 1. Four worked examples, or start blank.

Stage 2 of Fipp: the data flow drawn hop by hop with residency alerts — FIG. 13Stage 2. Hops drawn one by one; the residency alert fires when data leaves Canada.

Stage 3 of Fipp: the statutory checklist with citations and status controls — FIG. 14Stage 3. Every item carries its citation.

The AI review panel showing eight findings with severity tags and resolved citations — FIG. 15The second opinion. Every citation resolved from the pack.

The Fipp-on-Fipp self-assessment dossier with the Not ready aggregate status — FIG. 16Fipp on Fipp. Aggregate: Not ready.

The Fipp dossier on a 390px mobile viewport — FIG. 17The dossier at 390px.

SINCE THE CASE STUDY012

What shipped after the first cut

A review of the overnight prototype lane found the same four moves recurring: an exportable receipt, a rationale next to every override, plain language beside the citation, and the status logic made visible. Fipp had most of them. These four closed the gaps in a day, measured by the same tests.

Stage 1 with a Load from a file control beside Start blank, and the four worked examples — FIG. 18An assessment travels as a file. Export it from the dossier, load it on another computer from stage 1, same decode path as the browser store.

Stage 2 with one hop opened to show what moves, where it is stored, the purpose and the residency reason — FIG. 19Every hop opens to show what moves, where it lands, and why the residency tag reads the way it does.

Stage 5 with a popover showing the citation and the why-we-ask sentence above a mitigation note — FIG. 20Before a mitigation note is written, the provision and the reason it is asked appear on hover or focus.

Stage 6 listing the four aggregate-status gates in order, three met and one open — FIG. 21The four checks behind the aggregate status, written out. Nothing new is enforced; the arithmetic is shown.

Also shipped: a consent dialog on every AI review, including the worked examples; a Clear this assessment control on the dossier; a records stamp block on the printed page. 125 engine tests, the sealed hashes unchanged.

DESIGN PROCESS013

Design Process

Research first, because in this product the law is the material. Then three rounds of layout options, reviewed and cut between each. Then build, then verify.

THE LAYOUT ROUNDS013.A

Round 1 · five directionsone chosen

Round 1 candidate: Institutional Canada, the one chosen

Round 2 · three layouts on the chosen directionsplit workbench won

Round 2 candidate: split workbench, the one chosen

Round 3 · polish on the winnerratified, then built

Round 3: the polished split workbench that became the build reference

01 Research. Two earlier FIPPA builds folded into one brief; statute model verified at the source; s. 30.1 caught.
02 Layout rounds. Three rounds, each banked as one commit.
03 Build. Pure engine, profiles as data, six screens in parallel, static export.
04 Verify. Code review, design audit, then Fipp assessed itself.

REFLECTION014

We asked our privacy tool about its own AI feature. It said no.

The AI lane breaks Fipp’s core promise on purpose. The easy move was to bury that. Instead the lane went through Fipp’s own six stages, the engine returned Not ready, and the sealed dossier shipped with the product, gaps and owners included. A compliance tool earns trust the day you watch it refuse to flatter its maker.

NEXT CASE STUDY

ClauseGuard

▸

Available for Work

Let's build something impactful.

I’m currently open to access and privacy, records and information, and GovTech roles, and to product design work in the public sector.

Drop me an email Connect on LinkedIn