Privacy Act Modernization: Engagement with Indigenous Partners – What We Have Learned (so far) and Next Steps

Annex A. Backgrounder document provided to support bilateral engagement sessions

Privacy Act Modernization Engagement: Taking into Account the Perspectives of First Nations, Inuit and Métis Peoples

What is the Privacy Act?

What are the goals of modernizing the Privacy Act?

What is the purpose of this engagement?

Some of the specific questions on which we would like to engage

  1. Recognizing the diversity of Indigenous governments
    The Privacy Act provides a definition of “Indian Band” and “aboriginal government” which identify specific Indigenous governments to which personal information may be disclosed (see ss. 8(2)(k), 8(2)(f), 8(6), 8(7) and 8(8)).
    • How can a modernized Privacy Act best recognize a broader and more inclusive approach to these information-sharing partnerships consistent with a renewed nation-to-nation, government-to-government, and Inuit-Crown relationships?
  2. Continued disclosures for claims research while mitigating impacts on individual privacy
    Subsection 8(2)(k) of the Privacy Act authorizes government institutions to disclose personal information, notably to “any aboriginal government” (as defined under paragraph 8(7)), “association of aboriginal people”, “Indian band” (as defined by paragraph 8(6)) or to any person acting on behalf of them “for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada”.
    • While advancing collective claims can require and justify the disclosure of personal information, is there a need to mitigate impacts on individual privacy through new legal, policy or governance measures?
    • To what extent should personal information be disclosed to an Indigenous entity with which the subject individual is not associated in any way?
  3. New and more flexible information-sharing partnerships
    Paragraph 8(2)(f) of the Privacy Act facilitates information-sharing agreements with specific First Nation governments for law enforcement purposes or lawful investigations.
    • Should this provision be reviewed to ensure that all Indigenous governments, whether they are First Nation, Inuit or Métis, have the same opportunities to access federal personal information for not only law enforcement or lawful investigations, but potentially other purposes?
  4. New governance mechanisms
    Decisions with respect to the protection of and access to the personal information of Indigenous peoples can be particularly complex. For instance, Indigenous organizations and governments want to exercise a measure of control over these decisions, notably in the research context.
    • Is there a need for new governance tools supporting a consultative approach that could assist federal institutions in discharging their stewardship obligations in a way that meets the expectations of Indigenous peoples, and if so, what are the preferred options?
  5. Protecting collective-based interests in autonomous Indigenous data governance
    Individual and collective Indigenous privacy interests are intertwined, and are impacted by the federal government’s relationship with Indigenous peoples.
    • Is there a need to modify the Privacy Act to ensure protection for Indigenous peoples as individuals and as members of distinct Indigenous collectivities, whether personal information is de-identified or not and, if so, how could that be achieved?