Privacy Act

This Act may be cited as the Privacy Act.

The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that provide individuals with a right of access to that information.

In this Act,

administrative purpose, in relation to the use of personal information about an individual, means the use of that information in a decision making process that directly affects that individual; (fins administratives)

alternative format, with respect to personal information, means a format that allows a person with a sensory disability to read or listen to the personal information; (support de substitution)

Court means the Federal Court; (Cour)

designated Minister means a person who is designated as the Minister under subsection 3.1(1); (ministre désigné)

government institution means

any department or ministry of state of the Government of Canada, or any body or office, listed in the schedule, and

any parent Crown corporation, and any wholly-owned subsidiary of such a corporation, within the meaning of section 83 of the Financial Administration Act; (institution fédérale)

head, in respect of a government institution, means

in the case of a department or ministry of state, the member of the Queen’s Privy Council for Canada who presides over the department or ministry, or

in any other case, either the person designated under subsection 3.1(2) to be the head of the institution for the purposes of this Act or, if no such person is designated, the chief executive officer of the institution, whatever their title; (responsable d’institution fédérale)

personal information means information about an identifiable individual that is recorded in any form including, without restricting the generality of the foregoing, but, for the purposes of sections 7, 8 and 26 and section 19 of the Access to Information Act, does not include

information relating to the race, national or ethnic origin, colour, religion, age or marital status of the individual,

information relating to the education or the medical, criminal or employment history of the individual or information relating to financial transactions in which the individual has been involved,

any identifying number, symbol or other particular assigned to the individual,

the address, fingerprints or blood type of the individual,

the personal opinions or views of the individual except where they are about another individual or about a proposal for a grant, an award or a prize to be made to another individual by a government institution or a part of a government institution specified in the regulations,

correspondence sent to a government institution by the individual that is implicitly or explicitly of a private or confidential nature, and replies to such correspondence that would reveal the contents of the original correspondence,

the views or opinions of another individual about the individual,

the views or opinions of another individual about a proposal for a grant, an award or a prize to be made to the individual by an institution or a part of an institution referred to in paragraph (e), but excluding the name of the other individual where it appears with the views or opinions of the other individual, and

the name of the individual where it appears with other personal information relating to the individual or where the disclosure of the name itself would reveal information about the individual,

information about an individual who is or was an officer or employee of a government institution that relates to the position or functions of the individual including,

the fact that the individual is or was an officer or employee of the government institution,

the title, business address and telephone number of the individual,

the classification, salary range and responsibilities of the position held by the individual,

the name of the individual on a document prepared by the individual in the course of employment, and

the personal opinions or views of the individual given in the course of employment,

the fact that an individual is or was a ministerial adviser or a member of a ministerial staff, as those terms are defined in subsection 2(1) of the Conflict of Interest Act, as well as the individual’s name and title,

information about an individual who is or was performing services under contract for a government institution that relates to the services performed, including the terms of the contract, the name of the individual and the opinions or views of the individual given in the course of the performance of those services,

information relating to any discretionary benefit of a financial nature, including the granting of a licence or permit, conferred on an individual, including the name of the individual and the exact nature of the benefit, and

information about an individual who has been dead for more than twenty years; (renseignements personnels)

personal information bank means a collection or grouping of personal information described in section 10; (fichier de renseignements personnels)

Privacy Commissioner means the Commissioner appointed under section 53; (Commissaire à la protection de la vie privée)

sensory disability means a disability that relates to sight or hearing. (déficience sensorielle)

For greater certainty, any provision of this Act that applies to a government institution that is a parent Crown corporation applies to any of its wholly-owned subsidiaries within the meaning of section 83 of the Financial Administration Act.

For greater certainty, the Canadian Race Relations Foundation and the Public Sector Pension Investment Board are parent Crown corporations for the purposes of this Act.

Paragraph (j.1) of the definition personal information in section 3 applies only to records created on or after the day on which that paragraph comes into force.

The Governor in Council may designate a member of the Queen’s Privy Council for Canada to be the Minister for the purposes of any provision of this Act.

The Governor in Council may, by order, designate a person to be the head of a government institution, other than a department or ministry of state, for the purposes of this Act.

No personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.

A government institution shall, wherever possible, collect personal information that is intended to be used for an administrative purpose directly from the individual to whom it relates except where the individual authorizes otherwise or where personal information may be disclosed to the institution under subsection 8(2).

A government institution shall inform any individual from whom the institution collects personal information about the individual of the purpose for which the information is being collected.

Subsections (1) and (2) do not apply where compliance therewith might

result in the collection of inaccurate information; or

defeat the purpose or prejudice the use for which information is collected.

Personal information that has been used by a government institution for an administrative purpose shall be retained by the institution for such period of time after it is so used as may be prescribed by regulation in order to ensure that the individual to whom it relates has a reasonable opportunity to obtain access to the information.

A government institution shall take all reasonable steps to ensure that personal information that is used for an administrative purpose by the institution is as accurate, up-to-date and complete as possible.

A government institution shall dispose of personal information under the control of the institution in accordance with the regulations and in accordance with any directives or guidelines issued by the designated minister in relation to the disposal of that information.

Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except

for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose; or

for a purpose for which the information may be disclosed to the institution under subsection 8(2).

Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this section.

Subject to any other Act of Parliament, personal information under the control of a government institution may be disclosed

for the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose;

for any purpose in accordance with any Act of Parliament or any regulation made thereunder that authorizes its disclosure;

for the purpose of complying with a subpoena or warrant issued or order made by a court, person or body with jurisdiction to compel the production of information or for the purpose of complying with rules of court relating to the production of information;

to the Attorney General of Canada for use in legal proceedings involving the Crown in right of Canada or the Government of Canada;

to an investigative body specified in the regulations, on the written request of the body, for the purpose of enforcing any law of Canada or a province or carrying out a lawful investigation, if the request specifies the purpose and describes the information to be disclosed;

for the purpose of administering or enforcing any law or carrying out a lawful investigation, under an agreement or arrangement between the Government of Canada or any of its institutions and any of the following entities or any of their institutions:

the government of a foreign state,

an international organization of states or an international organization established by the governments of states,

the government of a province,

the council of the Westbank First Nation,

the council of a participating First Nation as defined in subsection 2(1) of the First Nations Jurisdiction over Education in British Columbia Act,

the council of a participating First Nation as defined in section 2 of the Anishinabek Nation Education Agreement Act,

a First Nation Government or the Anishinabek Nation Government, as defined in section 2 of the Anishinabek Nation Governance Agreement Act, or an Anishinaabe Institution, within the meaning of section 1.1 of the Agreement, as defined in section 2 of that Act,

the Whitecap Dakota Government, as defined in section 2 of the Self-Government Treaty Recognizing the Whitecap Dakota Nation / Wapaha Ska Dakota Oyate Act;

to a member of Parliament for the purpose of assisting the individual to whom the information relates in resolving a problem;

to officers or employees of the institution for internal audit purposes, or to the office of the Comptroller General or any other person or body specified in the regulations for audit purposes;

to the Library and Archives of Canada for archival purposes;

to any person or body for research or statistical purposes if the head of the government institution

is satisfied that the purpose for which the information is disclosed cannot reasonably be accomplished unless the information is provided in a form that would identify the individual to whom it relates, and

obtains from the person or body a written undertaking that no subsequent disclosure of the information will be made in a form that could reasonably be expected to identify the individual to whom it relates;

to any aboriginal government, association of aboriginal people, Indian band, government institution or part thereof, or to any person acting on behalf of such government, association, band, institution or part thereof, for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada;

to any government institution for the purpose of locating an individual in order to collect a debt owing to Her Majesty in right of Canada by that individual or make a payment owing to that individual by Her Majesty in right of Canada; and

for any purpose where, in the opinion of the head of the institution,

the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or

disclosure would clearly benefit the individual to whom the information relates.

Subject to any other Act of Parliament, personal information under the custody or control of the Library and Archives of Canada that has been transferred there by a government institution for historical or archival purposes may be disclosed in accordance with the regulations to any person or body for research or statistical purposes.

The head of a government institution shall retain a copy of every request received by the government institution under paragraph (2)(e) for such period of time as may be prescribed by regulation, shall keep a record of any information disclosed pursuant to the request for such period of time as may be prescribed by regulation and shall, on the request of the Privacy Commissioner, make those copies and records available to the Privacy Commissioner.

The head of a government institution shall notify the Privacy Commissioner in writing of any disclosure of personal information under paragraph (2)(m) prior to the disclosure where reasonably practicable or in any other case forthwith on the disclosure, and the Privacy Commissioner may, if the Commissioner deems it appropriate, notify the individual to whom the information relates of the disclosure.

In paragraph (2)(k), Indian band means

a band, as defined in the Indian Act;

the band, as defined in subsection 2(1) of the Naskapi and the Cree-Naskapi Commission Act;

the shíshálh Nation, as defined in subsection 2(1) of the shíshálh Nation Self-Government Act; or

a first nation named in Schedule II to the Yukon First Nations Self-Government Act.

The expression aboriginal government in paragraph (2)(k) means

Nisga’a Government, as defined in the Nisga’a Final Agreement given effect by the Nisga’a Final Agreement Act;

the council of the Westbank First Nation;

the Tlicho Government, as defined in section 2 of the Tlicho Land Claims and Self-Government Act;

the Nunatsiavut Government, as defined in section 2 of the Labrador Inuit Land Claims Agreement Act;

the council of a participating First Nation as defined in subsection 2(1) of the First Nations Jurisdiction over Education in British Columbia Act;

the Tla’amin Government, as defined in subsection 2(2) of the Tla’amin Final Agreement Act;

the Tsawwassen Government, as defined in subsection 2(2) of the Tsawwassen First Nation Final Agreement Act;

the Cree Nation Government, as defined in subsection 2(1) of the Cree Nation of Eeyou Istchee Governance Agreement Act or a Cree First Nation, as defined in subsection 2(2) of that Act;

a Maanulth Government, within the meaning of subsection 2(2) of the Maanulth First Nations Final Agreement Act;

Sioux Valley Dakota Oyate Government, within the meaning of subsection 2(2) of the Sioux Valley Dakota Nation Governance Act;

the Whitecap Dakota Government, as defined in section 2 of the Self-Government Treaty Recognizing the Whitecap Dakota Nation / Wapaha Ska Dakota Oyate Act;

the council of a participating First Nation as defined in section 2 of the Anishinabek Nation Education Agreement Act; or

a First Nation Government or the Anishinabek Nation Government, as defined in section 2 of the Anishinabek Nation Governance Agreement Act, or an Anishinaabe Institution, within the meaning of section 1.1 of the Agreement, as defined in section 2 of that Act.

The expression council of the Westbank First Nation in paragraphs (2)(f) and (7)(b) means the council, as defined in the Westbank First Nation Self-Government Agreement given effect by the Westbank First Nation Self-Government Act.

The head of a government institution shall retain a record of any use by the institution of personal information contained in a personal information bank or any use or purpose for which that information is disclosed by the institution where the use or purpose is not included in the statements of uses and purposes set forth pursuant to subparagraph 11(1)(a)(iv) and subsection 11(2) in the index referred to in section 11, and shall attach the record to the personal information.

Subsection (1) does not apply in respect of information disclosed pursuant to paragraph 8(2)(e).

For the purposes of this Act, a record retained under subsection (1) shall be deemed to form part of the personal information to which it is attached.

Where personal information in a personal information bank under the control of a government institution is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled by the institution but the use is not included in the statement of consistent uses set forth pursuant to subparagraph 11(1)(a)(iv) in the index referred to in section 11, the head of the government institution shall

forthwith notify the Privacy Commissioner of the use for which the information was used or disclosed; and

ensure that the use is included in the next statement of consistent uses set forth in the index.

The head of a government institution shall cause to be included in personal information banks all personal information under the control of the government institution that

has been used, is being used or is available for use for an administrative purpose; or

is organized or intended to be retrieved by the name of an individual or by an identifying number, symbol or other particular assigned to an individual.

Subsection (1) does not apply in respect of personal information under the custody or control of the Library and Archives of Canada that has been transferred there by a government institution for historical or archival purposes.

The designated Minister shall cause to be published on a periodic basis not less frequently than once each year, an index of

all personal information banks setting forth, in respect of each bank,

the identification and a description of the bank, the registration number assigned to it by the designated Minister pursuant to paragraph 71(1)(b) and a description of the class of individuals to whom personal information contained in the bank relates,

the name of the government institution that has control of the bank,

the title and address of the appropriate officer to whom requests relating to personal information contained in the bank should be sent,

a statement of the purposes for which personal information in the bank was obtained or compiled and a statement of the uses consistent with those purposes for which the information is used or disclosed,

a statement of the retention and disposal standards applied to personal information in the bank, and

an indication, where applicable, that the bank was designated as an exempt bank by an order under section 18 and the provision of section 21 or 22 on the basis of which the order was made; and

all classes of personal information under the control of a government institution that are not contained in personal information banks, setting forth in respect of each class

a description of the class in sufficient detail to facilitate the right of access under this Act, and

the title and address of the appropriate officer for each government institution to whom requests relating to personal information within the class should be sent.

The designated Minister may set forth in the index referred to in subsection (1) a statement of any of the uses and purposes, not included in the statements made pursuant to subparagraph (1)(a)(iv), for which personal information contained in any of the personal information banks referred to in the index is used or disclosed on a regular basis.

The designated Minister shall cause the index referred to in subsection (1) to be made available throughout Canada in conformity with the principle that every person is entitled to reasonable access to the index.

Subject to this Act, every individual who is a Canadian citizen or a permanent resident within the meaning of subsection 2(1) of the Immigration and Refugee Protection Act has a right to and shall, on request, be given access to

any personal information about the individual contained in a personal information bank; and

any other personal information about the individual under the control of a government institution with respect to which the individual is able to provide sufficiently specific information on the location of the information as to render it reasonably retrievable by the government institution.

Every individual who is given access under paragraph (1)(a) to personal information that has been used, is being used or is available for use for an administrative purpose is entitled to

request correction of the personal information where the individual believes there is an error or omission therein;

require that a notation be attached to the information reflecting any correction requested but not made; and

require that any person or body to whom that information has been disclosed for use for an administrative purpose within two years prior to the time a correction is requested or a notation is required under this subsection in respect of that information

be notified of the correction or notation, and

where the disclosure is to a government institution, the institution make the correction or notation on any copy of the information under its control.

The Governor in Council may, by order, extend the right to be given access to personal information under subsection (1) to include individuals not referred to in that subsection and may set such conditions as the Governor in Council deems appropriate.

A request for access to personal information under paragraph 12(1)(a) shall be made in writing to the government institution that has control of the personal information bank that contains the information and shall identify the bank.

A request for access to personal information under paragraph 12(1)(b) shall be made in writing to the government institution that has control of the information and shall provide sufficiently specific information on the location of the information as to render it reasonably retrievable by the government institution.

Where access to personal information is requested under subsection 12(1), the head of the government institution to which the request is made shall, subject to section 15, within thirty days after the request is received,

give written notice to the individual who made the request as to whether or not access to the information or a part thereof will be given; and

if access is to be given, give the individual who made the request access to the information or the part thereof.

The head of a government institution may extend the time limit set out in section 14 in respect of a request for by giving notice of the extension and the length of the extension to the individual who made the request within thirty days after the request is received, which notice shall contain a statement that the individual has a right to make a complaint to the Privacy Commissioner about the extension.

a maximum of thirty days if

meeting the original time limit would unreasonably interfere with the operations of the government institution, or

consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit, or

such period of time as is reasonable, if additional time is necessary for translation purposes or for the purposes of converting the personal information into an alternative format,

Where the head of a government institution refuses to give access to any personal information requested under subsection 12(1), the head of the institution shall state in the notice given under paragraph 14(a) and shall state in the notice that the individual who made the request has a right to make a complaint to the Privacy Commissioner about the refusal.

that the personal information does not exist, or

the specific provision of this Act on which the refusal was based or the provision on which a refusal could reasonably be expected to be based if the information existed,

The head of a government institution may but is not required to indicate under subsection (1) whether personal information exists.

Where the head of a government institution fails to give access to any personal information requested under subsection 12(1) within the time limits set out in this Act, the head of the institution shall, for the purposes of this Act, be deemed to have refused to give access.

Subject to any regulations made under paragraph 77(1)(o), where an individual is to be given access to personal information requested under subsection 12(1), the government institution shall

permit the individual to examine the information in accordance with the regulations; or

provide the individual with a copy thereof.

Where access to personal information is to be given under this Act and the individual to whom access is to be given requests that access be given in a particular one of the official languages of Canada,

access shall be given in that language, if the personal information already exists under the control of a government institution in that language; and

where the personal information does not exist in that language, the head of the government institution that has control of the personal information shall cause it to be translated or interpreted for the individual if the head of the institution considers a translation or interpretation to be necessary to enable the individual to understand the information.

Where access to personal information is to be given under this Act and the individual to whom access is to be given has a sensory disability and requests that access be given in an alternative format, access shall be given in an alternative format if

the personal information already exists under the control of a government institution in an alternative format that is acceptable to the individual; or

the head of the government institution that has control of the personal information considers the giving of access in an alternative format to be necessary to enable the individual to exercise the individual’s right of access under this Act and considers it reasonable to cause the personal information to be converted.

The Governor in Council may, by order, designate as exempt banks certain personal information banks that contain files all of which consist predominantly of personal information described in section 21 or 22.

The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that is contained in a personal information bank designated as an exempt bank under subsection (1).

An order made under subsection (1) shall specify

the section on the basis of which the order is made; and

where a personal information bank is designated that contains files that consist predominantly of personal information described in subparagraph 22(1)(a)(ii), the law concerned.

Subject to subsection (2), the head of a government institution shall refuse to disclose any personal information requested under subsection 12(1) that was obtained in confidence from

the government of a foreign state or an institution thereof;

an international organization of states or an institution thereof;

the government of a province or an institution thereof;

a municipal or regional government established by or pursuant to an Act of the legislature of a province or an institution of such a government;

the council, as defined in the Westbank First Nation Self-Government Agreement given effect by the Westbank First Nation Self-Government Act;

the Whitecap Dakota Government, as defined in section 2 of the Self-Government Treaty Recognizing the Whitecap Dakota Nation / Wapaha Ska Dakota Oyate Act;

the council of a participating First Nation as defined in subsection 2(1) of the First Nations Jurisdiction over Education in British Columbia Act; or

a First Nation Government or the Anishinabek Nation Government, as defined in section 2 of the Anishinabek Nation Governance Agreement Act, or an Anishinaabe Institution, within the meaning of section 1.1 of the Agreement, as defined in section 2 of that Act.

The head of a government institution may disclose any personal information requested under subsection 12(1) that was obtained from any government, organization or institution described in subsection (1) if the government, organization or institution from which the information was obtained

consents to the disclosure; or

makes the information public.

The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) the disclosure of which could reasonably be expected to be injurious to the conduct by the Government of Canada of federal-provincial affairs.

The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) the disclosure of which could reasonably be expected to be injurious to the conduct of international affairs, the defence of Canada or any state allied or associated with Canada, as defined in subsection 15(2) of the Access to Information Act, or the efforts of Canada toward detecting, preventing or suppressing subversive or hostile activities, as defined in subsection 15(2) of the Access to Information Act, including, without restricting the generality of the foregoing, any such information listed in paragraphs 15(1)(a) to (i) of the Access to Information Act.

The head of a government institution may refuse to disclose any personal information requested under subsection 12(1)

that was obtained or prepared by any government institution, or part of any government institution, that is an investigative body specified in the regulations in the course of lawful investigations pertaining to if the information came into existence less than twenty years prior to the request;

the detection, prevention or suppression of crime,

the enforcement of any law of Canada or a province, or

activities suspected of constituting threats to the security of Canada within the meaning of the Canadian Security Intelligence Service Act,

the disclosure of which could reasonably be expected to be injurious to the enforcement of any law of Canada or a province or the conduct of lawful investigations, including, without restricting the generality of the foregoing, any such information