How Do You Make an Access Request Under the Privacy Act (Canada)? 

To make a formal request under the Privacy Act (Canada) for access to your personal information there are certain procedures to follow and you must get a Personal Information Request Form.

When you fill out the form, you should try to identify yourself in a way that ensures you can’t be confused with another individual with the same or similar name. One way to do that is to provide some unique proof of your identity that if possible relates to the information that you want, so the government institution can verify it.

If you are able to, it is helpful to identify the Personal Information Bank that has the information you want (see “What is Info Source and How Will It Help Me Make an Access Request”, below). Looking up the types of Personal Information Banks the government institution has can also help you think about what other information that institution might have that you want access to.

Government institutions are required to organize personal information into Personal Information Bank so it is retrievable by name or identifying number or symbol. Personal Information Banks provide a summary of the type of personal information held by government institutions.

If you don’t know which Personal Information Bank to reference, simply include enough description about the personal information you want so that the institution can identify the information within its records.

Then mail the form to the Access and Privacy Coordinator of the appropriate department or agency. Forms are not accepted by email.

How Do you Find Out Who to Send the Request To?

One way to find out the address of the Access and Privacy Coordinator is to look it up on Info Source. Info Source is a very handy tool that contains a lot of useful information for making requests for access.

Another way to find out the address of the Access and Privacy Coordinator is to check the website of the institution that you want to request personal information from. Government websites often have a link on the site marked “privacy” which provides information about the institutions Access and Privacy Coordinator, and the address and phone number. Sometimes you can find this information under the link “Important Notices”. Or you could simply use the search function on the website to search the term “access to information and privacy” or “atip”.

What is Info Source and How Will it Help You to Make an Access Request?

“Info Source” is the title of a series of publications about the Government of Canada, how it is organized and what kind of information it holds. It is a reference tool to use when you want to get information under the Privacy Act (Canada). Info Source is available at local libraries, federal government offices and municipal offices. It is also accessible online.

Info Source is made up of four publications:

Sources of Federal Government and Employee Information: this publication describes how information held by government institutions is organized and contains indexes of information banks.

Directory of Federal Government Enquiry Points: this publication is designed to be used both by the public and by government employees and has the contact information for approximately 250 government institutions. It is updated annually. Local and regional federal offices are not listed – for that information you should look in your local phone book.

Access to Information Act and Privacy Bulletin: This bulletin contains summaries of federal court cases and statistics of access requests. It is updated annually.

Using Info Source can be a bit confusing at first, but it does contain a lot of useful information. For example, if you have never been a government employee and you want access to your personal information held by a particular department but you don’t know what they might have, you could start with Sources of Federal Government Information.

The publication will have a separate chapter for each government institution, and each chapter includes a detailed list of all of the Personal Information Banks held by that institution and their contents.

A description of a Personal Information Bank is filled with a lot of useful information about the type of personal information in the bank and who it is about, and about what you need to say in your Personal Information Request Form to make sure you can get access to it (see the italicized portion, below). Here is an example:

Royal Canadian Mounted Police

Particular Personal Information Banks

Complaints Against the RCMP or a Member, Enquiries and General Assistance
Description: This bank contains Part VII RCMP Act investigations and criminal investigation reports, occurrence reports, voluntary statements of members, statements of witnesses and complainants, and related correspondence of members and complainants. In addition to the requirements indicated on the Personal Information Request Forms, individuals must provide their full name, date of birth, sufficient detail of the occurrence, and the geographic location where the information search is to be conducted. Individuals wishing to access only specific information should identify the material desired, to expedite the processing of their requests. Part VII RCMP Act investigations dealing with complaints from the public and which result in discipline against a member may be located in bank CMP PPE 805.

Class of Individuals: This bank contains personal information on individuals who have been involved in complaints against the RCMP or its members, general enquiries by the public concerning the RCMP, and cases of general assistance to the public by the RCMP.

Purpose: This information is used for the internal administration of the RCMP.

Consistent Uses: The RCMP External Review Committee and the RCMP Public Complaints Commission may use the information respectively to enquire into grievances and investigate complaints against the RCMP or its members. Information in this bank is also used for research, planning, evaluation, press releases and statistical purposes. This Information may be linked with the Human Resources Management Information System (HRMIS).

Retention and Disposal Standards: Information in this bank is retained for a minimum of two calendar years. Where the record has been designated as having archival or historical value, the record shall be transferred to the control of the Library and Archives Canada; and where the record has not been so designated, it shall be destroyed.

RDA Number: 89/025, 96/023, 96/024
Related PR#: CMP ADM 002
TBS Registration: 001011
Bank Number: CMP PPU 08

How is Access Granted?

You are allowed to see the information or receive a copy and you may choose to receive the information in either English or French. In certain circumstances you can receive the information in an alternative format (such as if you have a disability and cannot see a paper record). If you want to receive the information in an alternative format, you should let the Access and Privacy Coordinator know that in your information request.

Does it Matter Who You Are or Why You Want the Information?

You must prove your identity in order to get access to your personal information. But the reasons why you want the information are generally irrelevant and your rights are generally not affected by what you want to do with the information (but see the exceptions to access, listed below).

The government’s Policy on Privacy Protection says that the fact you requested access to your personal information is confidential and should not be disclosed except when there is specific legal authorization and there is a clear need to know to perform duties and functions related to the Privacy Act.

What are the Time Limits for Replying?

Under the law, all or most of the information you ask for should be disclosed within 30 days of receiving the request. If a time extension is required, you should be notified within the first 30 days and told why up to another 30 days may be needed.

What If They Don’t Reply Within the Time Limits?

If the government institution fails to reply in time it will be deemed to have refused to give access. But remember that the time limits do not start to run until you have made a request that is detailed enough for the institution to understand what you are looking for. Make your request as clear as you can, so that the 30 day period will start when the institution receives your initial request.

When Can Your Request for Access be Refused?

The Privacy Act (Canada) includes several grounds for refusing a request for access contained in sections 18-28 and in section 69 which applies to libraries, museums and archives, and section 70 which applies to the Privy Council and Cabinet.

These are some of the situations in which the government is allowed to refuse to give you access to your personal information:

  1. The personal information was obtained in confidence from another government (s. 19);
  2. Granting access would be injurious to the conduct of federal-provincial affairs, international affairs, the defence of Canada or the enforcement of a law of Canada  (s. 20 – 22);
  3. The information was prepared or obtained in the context of a criminal or national security investigation (s. 20);
  4. The information is subject to solicitor-client privilege (s. 27) (i.e., the information is part of legal advice or is needed for a court case);
  5. The personal information relates to the physical or mental health of the person who made the request and it would be contrary to his or her best interests to see the information (s. 28) (this is intended for rare circumstances);
  6. The personal information is in an “exempt personal information bank” (s. 18);
  7. If disclosure would threaten the safety of an individual (s. 25);
  8. If the information is personal information about another individual (s. 26).

What Does the Refusal Have to Say?

The government institution is not required to tell you whether the information exists or not if they refuse your request for access. However, it does have to tell you what grounds it would have for refusing your request if the information did exist, and that you can make a complaint to the Privacy Commissioner about the refusal if you wish.

The Right To Request Correction

If you believe the information that a federal institution has on file about you is untrue or misleading, you may ask to have it corrected.
Normally the request for correction is made after you have requested and received access to your personal information, so that you could first confirm the information the government institution had on file and decide whether it is accurate or not, and then make your correction request specific and clear.

What If They Refuse to Make the Correction?

Even if the department or agency does not agree to change this information, it must make a note that you have asked for the change and attach it to the file.

What If the Incorrect Information Has Been Given to Another Government Agency or Department?

You also have a right to require that any person or body who received the personal information for an administrative purpose for two years before your request is told of your request for correction, and whether the information was corrected or not.

If it was a government institution that received the information, it must also make the correction, or make a note of the request, in its record.