OPC Guidance Documents

PDF Version

Safeguarding Your Personal Information

An Overview of Privacy Protections in the Federal Government

Introduction

Governments need information about their citizens in order to deliver programs and set public policies in vital areas such as health, transportation, public safety and national security.

At the same time, Canadians need to know that their personal information is being collected, used and disclosed only according to strict rules that preserve their right to privacy.

Without privacy, other fundamental rights – to speak, to assemble and to be free from unreasonable search and seizure – lack true meaning.

The Privacy Act, which came into force in 1983, ensures there are appropriate safeguards for the personal information that is gathered by the federal government.

In the intervening decades, several trends have emerged to make the need for such a law ever more acute.

In particular, the Internet, global positioning systems (GPS), wireless communications technologies, radio frequency identification (RFID) tags and miniaturized surveillance equipment have revolutionized the ways we create, store and share data on individuals.

And there are ever-growing amounts of personal information are being compiled, as governments address such modern-day concerns as threats to public safety and national security.

This brochure explains the public-sector privacy law, and how it protects your personal information in this challenging environment.

Where the Act Applies

The Privacy Act applies to the federal public sector, which includes about 250 departments, agencies and Crown corporations, ranging from Agriculture and Agri-Food Canada to the Yukon Surface Rights Board.

All provinces and territories have similar laws governing their own public sectors.

At the federal level, the Privacy Act applies to the government and the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to private-sector organizations.

The Privacy Commissioner, an independent officer of Parliament, is responsible for overseeing the implementation of both the Privacy Act and PIPEDA.

The Privacy Act

In passing the Privacy Act and appointing a Privacy Commissioner, Parliament asserted Canadians’ right to privacy.  It concluded that, while government needs to collect and use the personal information of Canadians, it must do so in a way that does not unduly interfere with people’s privacy.

The Privacy Act thus sets out the privacy rights of Canadians in their interactions with the federal government.

It obliges government institutions to respect the privacy of individuals by controlling the collection, use, disclosure, retention and disposal of recorded personal information.

Your Right to Privacy

The Canadian Charter of Rights and Freedoms does not specifically mention privacy or the protection of personal information. However, it does afford protection under Section 7 (the right to life, liberty and the security of the person), and Section 8 (the right to be secure against unreasonable search or seizure).

The Supreme Court of Canada has stated that the Privacy Act has “quasi-constitutional status”, and that the values and rights set out in the Act are closely linked to those set out in the Constitution as being necessary to a free and democratic society.

In particular it states that:

• the government can only collect personal information that relates directly to one of its operating programs or activities;
• wherever possible, the information should be collected directly from the person it is about and the individual should be informed about the purpose of the collection;
• the government should take all reasonable steps to ensure that the information it collects is accurate, up-to-date and complete;
• the government may only use the personal information for the purposes that it collected it, or for a use consistent with that purpose (unless the individual consents to other uses), and
• personal information may be disclosed by a government institution without an individual’s consent where permitted under the Act. For example, it can be disclosed for the purpose of complying with warrants or court orders; where the disclosure is authorized in federal legislation; where disclosure would clearly benefit the individual, or where the public interest in disclosure outweighs the invasion of privacy.

Personal Information

The Privacy Act offers protections for personal information, which it defines as any recorded information “about an identifiable individual.”

It can include your race or colour; national or ethnic origin; religion; age; marital status; blood type; fingerprints; medical, criminal or employment history; information on financial transactions; home address; and your Social Insurance Number (SIN), driver’s licence or any other identifying number assigned to you.

Access to your personal information

Under the Privacy Act, you also have the right to see the information that the government holds about you, and to request corrections to that information.

To do that, you should contact the Privacy Co-ordinator in the relevant government department or agency. To find out who that person is, refer to Info Source, which is a public directory of every department and agency of the federal government. It is available at public libraries, your MP’s constituency office, federal inquiries and service offices, and the Info Source website (see box).

Once you have located the correct contact, mail in a Personal Information Request Form, which is available in the same places as Info Source. Being as precise as possible in your request will help speed up the process.

There is no charge to request access to your personal records. Ordinarily, the government has 30 days to respond to your request, although this deadline may be extended under certain circumstances, such as when large quantities of documents are involved or if your documents require translation or conversion into a different format.

Once you have received and reviewed the information, you can reassure yourself that it is accurate and complete. If it is not, you may ask the department or agency to make the necessary corrections, additions or deletions.

Information on federal departments and agencies can be found in Info Source: http://www.infosource.gc.ca/index-eng.asp

Info Source includes a link to the Privacy Co-ordinators at all departments and agencies: http://www.tbs-sct.gc.ca/atip-aiprp/apps/coords/index-eng.asp

Personal Information Request Forms are available at: http://www.tbs-sct.gc.ca/tbsf-fsct/350-58-eng.asp

Complaints to the Privacy Commissioner

There may be instances where you are dissatisfied with the government’s response to your request to see or correct your personal information. We encourage you to try first to work out any disputes about your personal records directly with the department or agency where they are held.

However, you also have the right to complain to the Office of the Privacy Commissioner of Canada if, for example,

• you feel your personal information has been wrongfully collected, used or disclosed;
• you were refused access to your personal information, or
• you feel there was an unreasonable delay in getting access to your information.

There is no charge to make a complaint but we ask that you contact us by mail as the security of e-mailed correspondence cannot be assured. Please visit our web site for forms and other information that can help you through the complaints process.

The Privacy Commissioner serves as an ombudsman who tries to resolve issues. The Commissioner may recommend that the department or agency take specified steps to resolve the issue. The Commissioner reports back to you on the results of the investigation.

Privacy Impact Assessments

Another important way that the personal information in the hands of the federal government is protected is through Privacy Impact Assessments, or PIAs.

PIAs, which are required under federal policy, are a type of risk-assessment exercise that helps reassure Canadians that privacy issues are thoroughly taken into account during the design or redesign of federal programs or services. They also help to avoid or mitigate the risk that the privacy of Canadians could be compromised when a program is developed or substantially changed.
 
Institutions must submit their PIAs to the Privacy Commissioner of Canada, who may advise institutions on ways to address potential privacy risks. Institutions have to publish summaries of their PIA results so that Canadians can see how privacy issues have been addressed in the design of a program or service.

For more information

Please visit our website at www.priv.gc.ca
or call us Monday to Friday from 8:30 a.m. to 4:30 p.m. ET.

Toll-free: 1 (800) 282-1376
Tel: (613) 947-1698
TTY/TDD: (613) 992-9190
Fax: (613) 947-6850

To submit a complaint under the Privacy Act, write to us at:

Office of the Privacy Commissioner of Canada
Place de Ville, Tower B, 3^rd Floor
112 Kent Street
Ottawa ON
K1A 1H3

Please include your name, address and telephone number, and provide as much detail as possible about your complaint. Note that we do not process complaints sent by e-mail, as security cannot be assured.

Cat. No. IP54-24/2009
ISBN 978-0-662-06649-1

April 2009