The Privacy Act

The Privacy Act is Canadian federal legislation that came into effect on July 1, 1983. The act sets out rules for how institutions of the federal government must deal with personal information of individuals. Some salient provisions of the legislation are as follows:
▪ A government institution may not collect personal information unless it relates directly to an operating program or activity of the institution (section 4).
▪ With some exceptions, when a government institution collects an individual's personal information from the individual, it must inform the individual of the purpose for which the information is being collected (section 5(2)).
▪ With some exceptions, personal information under the control of a government institution may be used only for the purpose for which the information was obtained or for a use consistent with that purpose, unless the individual consents (section 7).
▪ With some exceptions, personal information under the control of a government institution may not be disclosed, unless the individual consents (section 8).
▪ Every Canadian citizen or permanent resident has the right to be given access to personal information about the individual under the control of a government institution that is reasonably retrievable by the government institution, and request correction if the information is inaccurate (section 12).
▪ The Privacy Commissioner of Canada receives and investigates complaints, including complaints that an individual was denied access to his or her personal information held by a government institution (section 29).

Two federal laws

Canada has two federal privacy laws, the Privacy Act and the Personal Information Protection and Electronic Documents Act.

The Privacy Act took effect on July 1, 1983. This Act imposes obligations on some 150 federal government departments and agencies to respect privacy rights by limiting the collection, use and disclosure of personal information. The Privacy Act gives individuals the right to access and request correction of personal information about themselves held by these federal government organizations.

Individuals are also protected by the Personal Information Protection and Electronic Documents Act (PIPEDA) that sets out ground rules for how private sector organizations may collect, use or disclose personal information in the course of commercial activities. The law gives individuals the right to access and request correction of the personal information these organizations may have collected about them.

Initially, PIPEDA applied only to personal information about customers or employees that was collected, used or disclosed in the course of commercial activities by the federally regulated private sector, organizations such as banks, airlines, and telecommunications companies. The Act now applies to personal information collected, used or disclosed by the retail sector, publishing companies, the service industry, manufacturers and other provincially regulated organizations. The Act does not apply to the personal information of employees of these provincially regulated organizations.

The federal government may exempt organizations or activities in provinces that have their own privacy laws if they are substantially similar to the federal law. PIPEDA will continue to apply in those provinces to the federally regulated private sector and to personal information in inter-provincial and international transactions by all organizations engaged in commercial activities.

Oversight of both federal Acts rests with the Privacy Commissioner of Canada who is authorized to receive and investigate complaints.

Provincial and Territorial Laws

Every province and territory has privacy legislation governing the collection, use and disclosure of personal information held by government agencies. These acts provide individuals with a general right to access and correct their personal information.

Oversight is through either an independent commissioner or ombudsman authorized to receive and investigate complaints.

How privacy is protected in the private sector


PIPEDA applies to all organizations engaged in commercial activities unless the federal government exempts an organization or activity in a province that has substantially similar legislation to the Act.

British Columbia, Alberta and Quebec are the only provinces with laws recognized as substantially similar to PIPEDA. These laws regulate the collection, use and disclosure of personal information by businesses and other organizations and provide individuals with a general right of access to, and correction of, their personal information.

Sector-Specific Legislation Dealing with Privacy

Alberta, Saskatchewan, Manitoba and Ontario have passed legislation to deal specifically with the collection, use and disclosure of personal health information by health care providers and other health care organizations.

Several federal and provincial sector specific laws include provisions dealing with the protection of personal information. The federal Bank Act, for example, contains provisions regulating the use and disclosure of personal financial information by federally regulated financial institutions. Most provinces have legislation dealing with consumer credit reporting. These acts typically impose an obligation on credit reporting agencies to ensure the accuracy of the information, place limits on the disclosure of the information and give consumers the right to have access to, and challenge the accuracy of, the information. Provincial laws governing credit unions typically have provisions dealing with the confidentiality of information relating to members' transactions. There are a large number of provincial acts that contain confidentiality provisions concerning personal information collected by professionals.

For more information contact:

The Office of the Privacy Commissioner of Canada
112 Kent Street, Ottawa, ON K1A 1H3
www.privcom.gc.ca
1-800-282-1376

Send To a Friend

< Back