Access to Personal Information and the federal Privacy Act

Every day, public bodies, including governments of every level, hospitals, educational institutions and many more organizations, generate huge amounts of information in the course of their daily work. They collect and store information about individuals, businesses and other organizations. Businesses and organizations in the private sector do too.

As a member of the public, you may want information about what the government has been up to in a particular area of interest to you. In that case, you may make an application under Canada’s Access to Information Act.

Alternatively, you may want to know what information has been generated and stored about you by both public institutions and the private sector.   In other words, you want to have access to your personal information: what has been created and stored about you and how this information is being used. Most importantly, you may want to be sure that the personal information collected about you is correct.

March 2016

Yes, there are laws at both the federal government level and the provincial government level. There are two laws at the federal level. They are the Privacy Act and the Personal Information Protection and Electronic Documents Act, often referred to as PIPEDA. This series of faqs will focus on these two federal laws only. There also laws in every province and territory that protect privacy and access to information.

March 2016

The Privacy Act covers the personal information handling processes of the Government of Canada, its departments and agencies. The Act sets out what information is covered, sets out an individual’s rights to access their information and to correct their personal information if necessary. The Privacy Act does not apply to political parties or political representatives.

The Personal Information Protection and Electronic Documents Act (PIPEDA)covers Canada’s private sector organizations carrying on business across Canada, except in the provinces of British Columbia, Alberta, Quebec, and the health care sector of Ontario, New Brunswick, and Newfoundland and Labrador. These provinces have their own comparable provincial legislation. However, even in those provinces PIPEDA continues to apply to federally-regulated private sector organizations such as telecommunications, banking and transportation. PIPEDA does not apply to charities, not-for-profit organizations, associations, or political parties, unless they are carrying on a commercial activity.

March 2016

In the federal Privacy Act, personal information is defined as:

• information relating to the race, national or ethnic origin, colour, religion, age or marital status of an individual;
• information relating to the education or the medical, criminal or employment history or history of financial transactions of an individual;
• any identifying number, symbol or other particular assigned to an individual;
• the address, fingerprints or blood type of an individual;
• the personal opinions or views of an individual, except where they are about another individual, or about a proposal for a grant, an award or a prize to be made to another individual by a government;
• correspondence sent to a government institution by an individual that is implicitly or explicitly of a private and confidential nature, and replies to such correspondence that would reveal the contents of the original correspondence;
• the views or opinions of another individual about the individual; and
• many more categories.

In PIPEDA, personal information is defined as information about an identifiable individual, but does not include the name, title, business address or telephone number of an employee of a private sector organization.

March 2016

Yes, there are some exceptions. For example, the government can refuse to disclose records that contain personal information:

• about a person other than the person making the request;
• obtained in confidence from another government (foreign, provincial, municipal or regional)
• that might harm federal/provincial affairs;
• related to international affairs and defence;
• prepared by the RCMP about policing services;
• relating to criminal or law enforcement matters;
• about medical records where the information would be damaging to the requesting individual;
• covered by solicitor-client privilege ;
• contained in personal information banks which have been exempted by government order;
• that might threaten the safety of individuals;
• related to those sentenced for an offence; and
• related to security clearances;
• and other exceptions.

March 2016

Under the Privacy Act you will need to:

• determine which federal agency currently holds the personal information you wish to access. You can do this by consulting InfoSource,  which is a public directory of federal government agencies;
• fill out a Personal Information Request Form, available on the InfoSource site;
• identify yourself so the government can be sure it is you making the request and not some other person asking for your personal information;
• specify the personal information you want, as precisely as you can;
• send your form to the Privacy Co-ordinator of the agency you think has your personal information.

Infosource is available at public libraries, constituency offices of Members of Parliament and offices of Canada Employment and Immigration.   Explanatory brochures and application forms can also be found at Service Canada information centres.

Requests can be made online and by mail. As of February 2016, the application fee is $5.00.

March 2016

Under PIPEDA, you will need to send a written request to the organization holding your personal information. You must provide enough detail to allow the organization to identify the information you want. Organizations must provide the requested information with in a reasonable time and at no or minimal cost.

No, the Canadian Charter of Rights and Freedoms does not guarantee access to information. The Charter also does not contain an explicit guarantee of privacy rights. However, Canada’s courts, including the Supreme Court of Canada have interpreted sections 7 and 8 as guarding against unreasonable privacy invasions. Section 7 provides for the right to life, liberty and security of the person, and the right not to be deprived of these except through due process. Section 8 protects against unreasonable search and seizure. There have been calls, including by House of Commons Committees, to entrench privacy rights explicitly in the Canadian Constitution.

However, Canadians can freely call upon the Office of the Privacy Commissioner of Canada for information and assistance.

March 2016

The Office of the Privacy Commissioner oversees compliance of the two federal information and privacy laws, the Privacy Act and PIPEDA. The Office:

• reports to Parliament on issues about the privacy rights of Canadians;
• answers public inquiries and responds to complaints;
• conducts reviews of the privacy practices and policies of the federal government and private companies and advises them on their obligations under the Acts;
• conducts and commissions research;
• engages in public education and outreach;
• may take cases to the Federal Court of Canada; and
• Is responsible for enforcing certain parts of Canada’s Anti-Spam legislation.

Under the Privacy Act, the Office of the Privacy Commissioner protects an individual’s right to see and correct personal information that the Government of Canada holds about them or the Government’s collection and use of that information.

Under PIPEDA, the Office oversees the collection, use or disclosure of personal information by organizations engaged in commercial activities and the individual’s right to access and correct their information.

If you think that your privacy rights have been violated, you should first determine which Act covers your situation. The Privacy Act covers the federal government; PIPEDA covers organizations in the private sector that are federally regulated or that operate across provincial borders. It may be that your concern falls under laws in the province in which you live. In that case, you should look at your province’s access to information and privacy laws.

If your concern falls under the Privacy Act, you should then contact the department, agency or organization to see if you can resolve the problem. Most Government of Canada departments and agencies will have an Access to Information and Privacy Co-ordinator who will help you.

If your concern falls under PIPEDA, you should contact the person within the organization who is responsible for handing privacy and access to information requests to try to work out a solution. If you are not satisfied with the response that you get, you can try to contact the organization’s industry association, ombudsman or complaint office.

If these steps fail, you may want to consider filing a complaint.

March 2016

If your complaint involves a matter that falls under the Privacy Act, you should first try to resolve the problem with the Access to Information and Privacy (ATIP) Co-ordinator with the department or agency. A list of ATIP Co-ordinators can be found at: http://www.tbs-sct.gc.ca/atip-aiprp/apps/coords/index-eng.asp. You can also call toll-fee to 1-800-282-1376.

If your problem is not resolved, you can file a complaint by downloading and filling out the Online Complaint Form. You may either file the complaint electronically or mail it to

Office of the Privacy Commissioner
30 Victoria Street
Gatineau, Quebec K1A 1H3

If you wish to file a complaint under PIPEDA, you should try to first resolve the problem directly with the organization involved. The Office of the Privacy Commissioner recommends that you take a look at the Guide to the Complaint Process. You may also call the Office toll-free at 1-800-282-1376.

If your problem is not resolved, then you can file a complaint by downloading and filling in the Online Complaint Form and sending it either electronically or by mail to the above address. There is no charge for filing a complaint under either the Privacy Act or PIPEDA.

March 2016

Every case is different, so it is difficult to predict how long the complaints procedure will take. Some matters are more easily resolved than others. The Office of the Privacy Commissioner states that the procedure usually takes several months.

March 2016

A typical investigation results in a Report of Findings. This report sets out whether or not there has been a violation of your privacy rights. If there has been a contravention, the Office tries to address your concerns and prevent a recurrence. Under the Privacy Act, however, the Commissioner cannot force an institution to take any specific action. The Office cannot levy fines, seek damages for an individual or initiate criminal or civil proceedings.

March 2016

The Office of the Privacy Commissioner of Canada has a wealth of information available on its website. Visit https://www.priv.gc.ca/index_e.ASP

March 2016