Privacy Act Extension Order No. 3 allows all individuals to request access to their personal information
July 13, 2022
Privacy Act Bulletins are intended to offer lessons learned, best practices and other important privacy news, trends and information related to privacy protection in the federal public sector. We encourage you to share this information with colleagues.
All individuals, whether they are within or outside Canada, now have a general right of access under the Privacy Act to their personal information that is held by federal government institutions, as Extension Order No. 3 comes into force on July 13.
While subsection 12(1) of the Privacy Act gave individuals the right to request access to their personal information under the control of a federal government institution, the right initially applied only to Canadian citizens and permanent residents. The first extension order conferred those rights on inmates in federal penitentiaries; the second to all people physically present in Canada not previously covered. Foreign nationals abroad did not have that right.
The Privacy Act had been an outlier both domestically and internationally, as universal access to personal information, regardless of geographical location, is the norm. We see this in provincial and territorial public sector access to information and privacy legislation, as well as in the U.K., most Commonwealth jurisdictions, and under the European Union’s General Data Protection Regulation.
Until now, foreign nationals outside Canada have generally had to employ an agent or mandatary (in civil law) to make a request for their information under federal access legislation (such as the Privacy Act or the Access to Information Act), often for a fee, and consent to have their information released to the agent.
The Privacy Commissioner of Canada has long advocated for the right of an individual to access their personal information under the Privacy Act to be extended. With the extension order coming into force, all foreign nationals abroad will be in a position to file a personal information access request under the Privacy Act to obtain their personal information held by federal government institutions, and to take steps to rectify any inaccuracies in such information as well as lodge a complaint with the Office of the Privacy Commissioner. As a result, the privacy principles of openness, fairness and accountability are both extended and enhanced.
The Office of the Privacy Commissioner has updated documents on its website to incorporate the these changes. See, in particular, the revisions we made to the individual access privacy principle in Expectations: OPC’s Guide to the Privacy Impact Assessment Process.
The extension order is expected to result in a significant increase in the number of requests for access to personal information across federal government departments and agencies subject to the Privacy Act. Federal institutions will need to ensure they have resources in place to respond to these requests in a timely manner.
Related documents
Privacy Act Extension Order No. 3
Expectations: OPC’s Guide to the Privacy Impact Assessment Process
Guidance on deemed denials under the Privacy Act
Sign up for future Privacy Act Bulletins by subscribing to our RSS feed.
- Date modified: