Canada’s Privacy Act

The Privacy Act is federal legislation that protects the personal information of Canadians in the hands of the federal government. It is a key piece of Canada’s overall framework for protecting your privacy interests.

For private sector organizations, the Personal Information Protection and Electronic Documents Act (PIPEDA) sets out the ground rules for how organizations involved in a commercial activity can collect, use or share personal information.

The Government’s treatment of personal information

The Privacy Act affects you in some obvious, and some less obvious, ways. For example, the Privacy Act applies when you:

  • leave or enter Canada at a border, port, or airport
  • seek a government service
  • participate in a federal public opinion survey or research project
  • pay your taxes

The Act contains a set of rules for the Government’s treatment of personal information. It sets out the basic framework for how federal institutions collect, use, retain, and disclose your personal information.

For instance, a Government institution may only collect personal information that is directly related to one of their ongoing programs or activities. As well, if the information is used to make a decision that would directly affect you, it should be:

  • accurate
  • retained for a specific period
  • collected directly from you, subject to certain exceptions

A government institution may use or disclose your personal information with your consent. In the absence of consent, the government institution may only use or share your personal information for:

  • the purpose for which the information was obtained or compiled
  • a use consistent with that purpose
  • a purpose authorized by subsection 8(2) of the Act

If you are a Canadian citizen, or are physically present in Canada, the Act also gives you a right to request access to your own personal information held by a federal institution and request a correction to information if the information is inaccurate. The institution can refuse a request, however, in certain circumstances such as where the request:

  • interferes with the responsibilities of the government, such as national defense and law enforcement investigations
  • contains the personal information of someone other than the individual who made the request
  • is subject to solicitor-client privilege
  • is for an individual's own medical records and there is no benefit to the individual in reading it

The Office of the Privacy Commissioner of Canada

The Privacy Act also created the Office of the Privacy Commissioner of Canada, an independent agent of Parliament that oversees compliance with both the Privacy Act and PIPEDA. The Privacy Commissioner has powers to receive and investigate complaints, including in cases where an individual’s request for access to their personal information has been refused by a government institution.

Related links

Date modified: