Your Rights Under the Privacy Act (Canada)
What Does the Privacy Act (Canada) Apply To?
The Privacy Act (Canada) applies to every federal “government institution” listed in the Schedule to the Act,
These include:
- Canadian ministries and departments;
- Canadian agencies, foundations, boards, commissions, tribunals;
- Canada Border Services (through the Ministry of Public Safety);
- Federal law enforcement agencies such as CSIS and the RCMP.
All the listed institutions are also subject to the Privacy Regulations
Sometimes you may find a link on the website of the institution that will provide information about the institution’s privacy policy and how to contact the Access to Information and Privacy (“ATIP”) Coordinator. In other circumstances you may need to look on the website of the Ministry which has authority over the agency.
The Privacy Act controls how the government will collect, use, store, disclose and dispose of personal information. However, it applies only to recorded personal information – it does not protect personal information that is not in a record. Examples of information that are not in a record include when biological samples (such as DNA) or real-time information (such as live video surveillance that is not recorded) are collected, used and disclosed.
The government of Canada has issued policies that all federal government institutions listed in the Schedule must follow to meet the requirements of the Privacy Act. (see Treasury Board – Policy Suite Renewal – Policy Framework for Information and Technology Management – Policy On Privacy Protection (April 8, 2008).
What Are My Rights Under the Privacy Act (Canada)?
The Privacy Act (Canada) gives you the right to access your personal information held about by the federal government.
You also have the right to request that a correction be made to your personal information.
When Can the Canadian Government Collect Personal Information?
The Privacy Act (Canada) permits a government institution to collect personal information so long as it relates directly to the institution’s activities or programs.
Personal information is supposed to be collected directly from you wherever possible, except if you consent to collection from another source, or if the purpose for the collection is listed in the Privacy Act.
The government institution must give you notice of the purpose of collection unless doing so would defeat the purpose of the collection or result in the collection of inaccurate information. This is why, for example, when you apply for a passport, the form includes the following notice, which specifies the reasons for collecting your personal information, how it will be used and who it will be disclosed to:
Personal information provided on this application form is protected and used in accordance with the provisions of the Privacy Act (Personal Information Bank No. FAI PPU 030). This information is collected under the Canadian Passport Order to determine your current and ongoing entitlement to a Canadian passport, to administer passport services and to provide information to the Consular Affairs Bureau of Foreign Affairs and International Trade Canada in the event that you require assistance while travelling abroad. The information provided, including the photo, is subject to routine verifications and security queries. To further strengthen Canadian passport security, your photo is stored on an alphanumeric template and incorporated into the passport as a digital image.
Passport Canada may use the services of third parties to receive passport applications submitted in person and to process the return of incomplete passport applications. In the performance of these services, personal information will be protected and used in accordance with the provisions of the Privacy Act.
Passport Canada may contact you to solicit feedback about passport services.
How is the Canadian Government Allowed to Use and Disclose Personal Information?
The Privacy Act says that personal information is allowed to be used and disclosed only for:
- the purposes that you consent to; or
- the purpose for which it was obtained or compiled or for a use consistent with that purpose; or
- the purposes listed in the Act. These may be summarized as:
- as authorized by any Canadian law, or by a subpoena or warrant issued or court order;
- for legal proceedings involving the Crown in right of Canada or the Government of Canada;
- for specific types of lawful investigations;
- to a member of Parliament for the purpose of assisting you to resolve a problem;
- for audit purposes;
- for archival purposes, and for research or statistical purposes, but only if certain conditions are met;
- for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada;
- to collect a debt owing to the Crown or pay a debt owed by the Crown.
Personal information can also be disclosed for any purpose where the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or where disclosure would clearly benefit the individual to whom the information relates.
It is worth noting that although the list in the Privacy Act is supposed to limit how the government can use or disclose your personal information without consent, the reality is that the list is so broad, there is very little to stop government institutions from using or disclosing your personal information in ways which you may not have contemplated when your information was originally collected.
How Long Can the Canadian Government Keep Personal Information?
Personal information that has been used by a government institution for an administrative purpose must be kept long enough to ensure the individual has a reasonable opportunity to get access to it. A time period will often be specified in a law or regulation that applies to the institution or to the information.
A government institution must take reasonable steps to ensure that personal information used for an administrative purpose is as accurate, complete and up-to-date as possible. The institution must dispose of the information securely.
Who Makes Sure the Canadian Government is Following the Privacy Act (Canada)?
The Office of the Privacy Commissioner of Canada has the power to oversee decisions made by institutions under the Privacy Act (Canada).
The Privacy Commissioner can investigate the circumstances of the matter, but can only make recommendations – she has no power to order the government to do anything. If an institution refuses to provide access even after the Privacy Commissioner has investigated and recommended that you get access, all you can do is apply to the Federal Court for a judge to review the decision of the government institution.
Not surprisingly, it is very rare for people to go to Federal Court, because it is expensive and takes a long time.
If you are unhappy with a refusal of a government institution to give you access to personal information under the Privacy Act (Canada), here is more information about how to ask the Privacy Commissioner for a review.