Canada’s Privacy Act, Federal Privacy Protection In Canada

Canada’s Privacy Act is a federal law passed in 1983 that protects the personal information that Canadian residents disclose to the Canadian government. While the Personal Information Protection and Electronic Documents Act or PIPEDA governs the collection of personal information from Canadian citizens within the private sector, it does not apply to information that is collected, used, or disclosed by the Canadian government. As such the Privacy Act sets forth various rules and regulations in relation to when and how the Canadian government can collect, use, and disclose the personal information of its citizens.

What are the requirements of the Privacy Act?

The Privacy Act lays out a basic framework concerning the means by which Canadian federal institutions are permitted to collect, use, retain, and disclose personal information. For example, a government institution within Canada is only permitted to collect personal information from Canadian citizens in relation to federal programs or activities. Moreover, any personal information that is collected by Canadian residents must meet the following criteria if said personal information has the potential to directly affect them:

• The personal information must be accurate.
• The personal information must be retained for a specified period.
• The personal information must be directly collected from a Canadian resident, subject to certain exceptions.

To this end, the Canadian government is prohibited from using or disclosing the personal information of any Canadian citizen with their expressed written consent. However, in the absence of such consent, a government institution is still permitted to use or share the personal information of Canadian citizens in the following ways:

• The purpose for which this information was originally obtained or compiled.
• Any other use that is consistent with the above-stated purpose.
• Various other purposes that are authorized by subsection 8(2) of the Privacy Act. (i.e. for the purpose of complying with a subpoena or warrant issued or order made by a court, person, or body with jurisdiction to compel the production of information or for the purpose of complying with rules of court relating to the production of information, or to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada.)

What rights do Canadian citizens have under the Privacy Act?

For Canadian citizens and individuals who are physically present within the country of Canada, the Privacy Act allows for both parties to request access to their own personal information that is being held by a federal institution, as well as request that corrections be made to this information if said information is proven to be inaccurate. Alternatively, federal law institutions can refuse such requests under the following circumstances:

• If the request for information interferes with the jurisdiction and responsibilities of the Canadian government, such as law enforcement investigations or issues relating to national defense.
• If the request for information is related to the personal information of someone other than the individual who made the request.
• If the personal information that has been requested is subject to solicitor-client privilege.
• If the request for personal information is related to an individual’s medical records, and it has been determined that accessing such records will not result in any benefit to said individual.

What are the penalties for violating the Privacy Act?

In addition to laying out stipulations and conditions for the collection of personal information from Canadian citizens, the Privacy Act also established the Office of the Privacy Commissioner of Canada or OPC, an independent government agency of the Canadian Parliament that both oversees and enforces the Privacy Act and the PIPEDA. The OPC has the authority and power to both receive and investigates complaints in relation to the Privacy Act, including cases in which a Canadian federal agency has refused a request for access on the part of a Canadian citizen. As such, the Privacy Act states the following in relation to obstruction of the law, as well as fines and penalties that can result from said obstruction:

• “No person shall obstruct the Privacy Commissioner or any person acting on behalf or under the direction of the Commissioner in the performance of the Commissioner’s duties and functions under this Act.”
• “Every person who contravenes this section is guilty of an offense and liable on summary conviction to a fine not exceeding one thousand dollars.”

While the definition of privacy has changed greatly since the Privacy Act was introduced in 1983, the law still serves to protect Canadian citizens from privacy violations in relation to government institutions. With legislation such as the Privacy Act, Canadian residents can have the peace of mind that any information that they disclose to the federal government will be protected in an appropriate manner. Furthermore, with Canada releasing draft legislation to both updates and modernize the country’s private sector privacy legislation, future laws that also update and modernize federal privacy legislation will more than likely be considered as well.