Privacy Legislation in Canada
Two federal laws
Canada has two federal privacy laws, the Privacy Act and the Personal Information Protection and Electronic Documents Act.
The Privacy Act took effect on July 1, 1983. This Act imposes obligations on some 250 federal government departments and agencies to respect privacy rights by limiting the collection, use and disclosure of personal information. The Privacy Act gives individuals the right to access and request correction of personal information about themselves held by these federal government organizations.
Individuals are also protected by the Personal Information Protection and Electronic Documents Act (PIPEDA) that sets out ground rules for how private sector organizations may collect, use or disclose personal information in the course of commercial activities. The law gives individuals the right to access and request correction of the personal information these organizations may have collected about them.
Initially, PIPEDA applied only to personal information about customers or employees that was collected, used or disclosed in the course of commercial activities by the federally regulated private sector, organizations such as banks, airlines, and telecommunications companies. The Act now applies to personal information collected, used or disclosed by the retail sector, publishing companies, the service industry, manufacturers and other provincially regulated organizations. The Act does not apply to the personal information of employees of these provincially regulated organizations.
The federal government may exempt organizations or activities in provinces that have their own privacy laws if they are substantially similar to the federal law. PIPEDA will continue to apply in those provinces to the federally regulated private sector and to personal information in inter-provincial and international transactions by all organizations engaged in commercial activities.
Oversight of both federal Acts rests with the Privacy Commissioner of Canada who is authorized to receive and investigate complaints.
Provincial and Territorial Laws
Every province and territory has privacy legislation governing the collection, use and disclosure of personal information held by government agencies. These acts provide individuals with a general right to access and correct their personal information.
Oversight is through either an independent commissioner or ombudsman authorized to receive and investigate complaints.
How privacy is protected in the private sector
PIPEDA applies to all organizations engaged in commercial activities unless the federal government exempts an organization or activity in a province that has substantially similar legislation to the Act.
British Columbia, Alberta and Quebec are the only provinces with laws recognized as substantially similar to PIPEDA. These laws regulate the collection, use and disclosure of personal information by businesses and other organizations and provide individuals with a general right of access to, and correction of, their personal information. Ontario, New Brunswick, and Newfoundland and Labrador meanwhile, have adopted privacy legislation to protect personal health information which has been recognized as substantially similar.
Sector-Specific Legislation Dealing with Privacy
Several provinces have passed legislation to deal specifically with the collection, use and disclosure of personal health information by health care providers and other health care organizations.
Several federal and provincial sector specific laws include provisions dealing with the protection of personal information. The federal Bank Act, for example, contains provisions regulating the use and disclosure of personal financial information by federally regulated financial institutions. Most provinces have legislation dealing with consumer credit reporting. These acts typically impose an obligation on credit reporting agencies to ensure the accuracy of the information, place limits on the disclosure of the information and give consumers the right to have access to, and challenge the accuracy of, the information. Provincial laws governing credit unions typically have provisions dealing with the confidentiality of information relating to members' transactions. There are a large number of provincial acts that contain confidentiality provisions concerning personal information collected by professionals.
For more information, contact:The Office of the Privacy Commissioner of Canada
30 Victoria Street
Phone: (819) 994-5444
Fax: (819) 994-5424
TTY: (819) 994-6591
Revised in March 2009