Privacy Act Modernization: Engagement with Indigenous Partners – What We Have Learned (so far) and Next Steps

Executive Summary

The Department of Justice Canada is leading efforts to modernize the federal Privacy Act, which isa key piece of Canada’s legal framework for protecting privacy interests. The Act governs how federal public bodies may collect, use, disclose, retain, dispose of, and protect personal information. It also sets out the rights of individuals to access their own personal information from federal public bodies.

While the Privacy Act focuses on protecting the personal information of all individuals held by federal public bodies, it also has specific impacts on Indigenous peoples in Canada. For instance, the Act currently sets out a list in the definition of “Indian band” and “aboriginal government”. In addition, some of the provisions allowing the disclosure of personal information may not reflect the variety of reasons for which Indigenous governments and organizations may require disclosure of personal information.

The Privacy Act first came into force in 1983 and our world has changed dramatically since then. After decades of technological advances and societal change, Canadians’ expectations of how federal public bodies collect, use, disclose, store and protect their personal information have evolved. There have also been significant developments that highlight the uniqueness of Indigenous interests in relation to personal information. For example, in 1998, the First Nations and Inuit Regional Health Survey National Steering Committee recognized the OCAP® principlesFootnote 3 of data ownership, control, access, and possession. In 2018, the Government of Canada committed itself to the Principles respecting the Government of Canada’s relationship with Indigenous Peoples, which include recognition of Indigenous rights and of Indigenous governments’ right to self-determination. On June 21, 2021, the United Nations Declaration on the Rights of Indigenous Peoples Act received Royal Assent and immediately came into force.

In this context, Justice Canada sought to engage with governments and organizations representing the distinct perspectives of First Nations, Inuit and Métis in the context of modernizing the Privacy Act. Part 1 of this report summarizes what we have learned so far from the bilateral engagement sessions with participating Indigenous governments and organizations, which took place from spring 2020 to spring 2021.

During these initial engagement discussions, we learned that not all questions related to Privacy Act modernization raise the same concerns among Indigenous partners or have the same level of complexity. Because of this, Justice Canada is proposing a multi-stage approach for moving forward. The goal of this approach is to ensure that all questions related to Privacy Act modernization and its impact on First Nations, Inuit and Métis are given appropriate consideration while ensuring momentum forward in modernizing the Privacy Act.

Building on the feedback received, Part 2 of the report sets out the next steps for engaging with Indigenous partners and invites them to provide input on ideas for modernizing the Privacy Act’s foundational principles and rules on information sharing between federal public bodies and Indigenous governments and organizations. These ideas reflect input received from Indigenous partners so far, and include:

Following discussions on these issues, Justice Canada is proposing to then focus discussions on the more detailed rules that may be required to ensure the appropriate implementation of any initial changes made to modernize the Privacy Act, as well as a number of other complex questions. This step is outlined in Part 3 of the report.

Justice Canada is sharing this report with all the Indigenous governments and organizations that were invited to participate in this engagement, whether they have participated yet or not. It is also being shared with additional Indigenous partners so that all modern treaty and self-government agreement holders are part of the discussion going forward.

To continue the discussion, Justice Canada has included the following questions throughout the report to support Indigenous partners in providing their views and reflections. References to the discussion on each issue within the report are included.

Indigenous partners are invited to share their input with the Privacy Act modernization team, through a virtual engagement session, in writing, or both, as preferred before April 30, 2022. To schedule a meeting or to provide written comments, please send an email to the Privacy Act modernization team at: You may also contact us by postal mail at:

Privacy Act Modernization Initiative
Department of Justice Canada
284 Wellington Street
Ottawa, ON
K1A 0H8