5. Modernizing the Privacy Act’s relationship with Indigenous peoples in Canada

PDF Version

A technical engagement with experts about the future of the Privacy Act, Canada’s federal public sector privacy law

This discussion paper is being sent to expert stakeholders for their views and feedback on technical and legal considerations to consider in modernizing the Privacy Act. This targeted technical engagement will help the Government of Canada refine potential proposals for changes to the Privacy Act.

Taking into account the perspectives of Indigenous peoples in modernizing the Privacy Act

The Privacy Act is Canada’s federal public sector personal information statute. It governs the ways federal government institutions may collect, use, disclose, retain and dispose of personal information, and gives individuals the right to access their own personal information in the hands of federal government institutions. It also provides individuals with a right to complain to the Privacy Commissioner of Canada about a government institution’s personal information management practices.

Like other data protection regimes in Europe, North America, Australia and New Zealand, the Act focusses on the relationship between the state and the individual where personal information in the public sector is concerned. Rights are recognized at the level of the individual and, generally speaking, every individual is entitled to the same legal protections. However, the current provisions under subsection 8(2) of Canada’s Privacy Act allowing the disclosure of personal information to Indigenous groups recognize special interests of Indigenous peoples and the collective interests of Indigenous governments and groups to access personal information held by government institutions.

Since the Act was first enacted, there have been a number of significant developments that highlight the uniqueness of Indigenous interests in relation to personal information. For example, in 1998, the First Nations and Inuit Regional Health Survey National Steering Committee recognized the OCAP^® principles^{Footnote 1} – ownership, control, access and possession - to guide how First Nations’ data should be collected, protected, used and shared and to support First Nations’ conception of collective ownership of group information. In 2016, the Government of Canada announced its support for the United Nations Declaration of the Rights of Indigenous Peoples and committed to its implementation. This declaration recognizes the right of Indigenous peoples to enjoy rights and freedoms both as individuals and as a collective. More recently, the Government of Canada committed to the Principles respecting the Government of Canada’s relationship with Indigenous Peoples, which speak to recognition of Indigenous rights and Indigenous governments’ right to self-determination.

These developments will be relevant to updating some of the provisions of the Act that speak specifically to Indigenous peoples. The purpose of this document is to set out some of the main questions associated with modernizing the provisions of the Privacy Act that expressly pertain to Indigenous peoples. At this stage, we would like to know more about experts and users’ experience with these provisions and their perceptions of their usefulness and challenges, including potential barriers to obtaining access to personal information they need. We propose a list of questions at the end of this paper to help animate this discussion.

Privacy Act provisions specifically pertaining to Indigenous peoples

The Privacy Act does not apply to Indigenous governments and organizations. However, the Act addresses certain circumstances where Indigenous populations need to access personal information held by federal government institutions. Section 8 of the Privacy Act sets out the circumstances in which a federal institution is authorized to disclose personal information without the individual’s consent, where there is no other Act of Parliament that provides otherwise. Some provisions of section 8 authorize a federal institution to disclose personal information to particular Indigenous bodies in certain circumstances.

First, subsection 8(2) of the Act allows personal information to be disclosed pursuant to an authority set out in another federal Act or regulation. This could allow, for example, the government to establish a specific framework governing the disclosure of personal information to Indigenous populations and groups.

Second, subsection 8(2)(f) the Act provides an authority for disclosing personal information to various external entities for the purposes of administering or enforcing any law or carrying out a lawful investigation. Under subsection 8(2)(f) of the Act, personal information can be disclosed by the federal Government pursuant to an agreement or arrangement with the council of the Westbank First Nation, the council of a participating First Nation as defined in subsection 2(1) of the First Nations Jurisdiction over Education in British Columbia Act, or the council of a participating First Nation as defined in section 2 of the Anishinabek Nation Education Agreement Act.

Third, when Parliament adopted the Act, it recognized that Indigenous governments and groups may need access to personal information in order to advance historical claims and grievances. To this end, it adopted paragraph 8(2)(k), which authorizes government institutions to disclose personal information to any “aboriginal government, association of aboriginal people, Indian band, government institution or part thereof, or to any person acting on behalf of such government, association, band, institution or part thereof, for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada”. Disclosures under 8(2)(k) are not subject to other requirements, such as ensuring that the recipient is able to protect the personal information upon receipt.

To support paragraph 8(2)(k), subparagraphs 8(6), 8(7) and 8(8) were included to provide definitions for the terms “Indian bands”, “aboriginal government” and “the council of the Westbank First Nation”.

Given this current framework, the question is whether these provisions allowing government institutions to disclose personal information to Indigenous groups need to be revised and, if so, how. As well, it is necessary to explore whether these definitions in the Act pertaining to Indigenous groups should be modified and, if so, how.