Privacy Act (Canada)

The Privacy Act is Canadian federal legislation that came into effect on July 1, 1983.^[1] The act sets out rules for how institutions of the federal government must deal with personal information of individuals. Some salient provisions of the legislation are as follows:

• A government institution may not collect personal information unless it relates directly to an operating program or activity of the institution (section 4).
• With some exceptions, when a government institution collects an individual's personal information from the individual, it must inform the individual of the purpose for which the information is being collected (section 5(2)).
• With some exceptions, personal information under the control of a government institution may be used only for the purpose for which the information was obtained or for a use consistent with that purpose, unless the individual consents (section 7).
• With some exceptions, personal information under the control of a government institution may not be disclosed, unless the individual consents (section 8).
• Every Canadian citizen or permanent resident has the right to be given access to personal information about the individual under the control of a government institution that is reasonably retrievable by the government institution, and request correction if the information is inaccurate (section 12).
• The Privacy Commissioner of Canada receives and investigates complaints, including complaints that an individual was denied access to his or her personal information held by a government institution (section 29).

Case law

An individual who has been refused access to personal information may ultimately apply to the Federal Court for a review of the matter, pursuant to section 41 of the Act. The Court may order the head of the government institution to disclose the information to the individual (sections 48 and 49). Decisions of the Federal Court on such matters may be appealed to the Federal Court of Appeal, and, if leave is granted, further appealed to the Supreme Court of Canada. Some important court decision concerning the Privacy Act are:

• Canada (Information Commissioner) v. Canada (Commissioner of the Royal Canadian Mounted Police), 2003 SCC 8 (considering the definition of "personal information" in section 3 of the Privacy Act)
• Ruby v. Canada (Solicitor General), 2002 SCC 75 (holding that section 51(2)(a) of the Privacy Act is unconstitutional because it requires that the entire hearing of certain applications to Federal Court be held in camera)
• Lavigne v. Canada (Office of the Commissioner of Official Languages), 2002 SCC 53 (holding that the Privacy Act is 'quasi-constitutional' legislation, and considering section 22(1)(b), the exemption for information the disclosure of which could be injurious to the conduct of lawful investigations)
• Privacy Act (Can.) (Re), 2001 SCC 89 (holding that the Privacy Act was not violated by a program whereby Canada Customs gave information about travellers to the Canada Employment Insurance Commission, to identify those who received employment insurance benefits while outside Canada)
• Dagg v. Canada (Minister of Finance), [1997] 2 S.C.R. 403 (the first major Supreme Court of Canada decision to consider the Privacy Act)

References

• Privacy Act
• Supreme Court of Canada decisions on privacy
• Federal Court Reports - subject: privacy

External links

• The Canadian Privacy Law Blog: A regularly updated blog on issues related to Canadian privacy law written by David T.S. Fraser, a Canadian privacy lawyer.

See also

• Privacy law
• Information Privacy Laws
• Data privacy
• Access to Information Act
• Personal Information Protection and Electronic Documents Act
• Info Source - repository of information available through Privacy Act and Access to Information Act