The Privacy Act is federal legislation that protects the personal information of Canadians in the hands of the federal government. It is a key piece of Canada’s overall framework for protecting your privacy interests.
For private sector organizations, the Personal Information Protection and Electronic Documents Act (PIPEDA) sets out the ground rules for how organizations involved in a commercial activity can collect, use or share personal information.
The Privacy Act affects you in some obvious, and some less obvious, ways. For example, the Privacy Act applies when you:
The Act contains a set of rules for the Government’s treatment of personal information. It sets out the basic framework for how federal institutions collect, use, retain, and disclose your personal information.
For instance, a Government institution may only collect personal information that is directly related to one of their ongoing programs or activities. As well, if the information is used to make a decision that would directly affect you, it should be:
A government institution may use or disclose your personal information with your consent. In the absence of consent, the government institution may only use or share your personal information for:
If you are a Canadian citizen, or are physically present in Canada, the Act also gives you a right to request access to your own personal information held by a federal institution and request a correction to information if the information is inaccurate. The institution can refuse a request, however, in certain circumstances such as where the request:
The Privacy Act also created the Office of the Privacy Commissioner of Canada, an independent agent of Parliament that oversees compliance with both the Privacy Act and PIPEDA. The Privacy Commissioner has powers to receive and investigate complaints, including in cases where an individual’s request for access to their personal information has been refused by a government institution.