Appearance before the Standing Senate Committee on Indigenous Peoples

February 27, 2024

Ottawa, Ontario

Opening statement by Philippe Dufresne

Privacy Commissioner of Canada

(Check against delivery)

---

Thank you, Mr. Chair and Members of the Committee for this invitation to appear as part of your examination of the federal government’s constitutional, treaty, political and legal responsibilities to First Nations, Inuit and Métis peoples.

I would like to acknowledge that the land on which we are gathered today is part of the traditional unceded territory of the Algonquin Anishnaabeg people.

Let me begin by discussing my role.

The Office of the Privacy Commissioner of Canada is mandated to oversee compliance with both the Privacy Act, which applies to federal institutions, and the Personal Information Protection and Electronic Documents Act, or PIPEDA, Canada’s federal private-sector privacy law.

The Privacy Act sets out the circumstances under which personal information may be disclosed, and to whom.

In general, federal institutions may only disclose personal information with the consent of the individual. However, subsection 8(2) of the Privacy Act specifies how federal public bodies can disclose personal information without the consent of the person to whom the information relates.

Several provisions are potentially relevant to the disclosure of personal information relating to Indigenous peoples, including subsection 8(2)(k), which authorizes federal public bodies to disclose personal information for specific purposes to entities including aboriginal governments, associations of aboriginal people, or Indian Bands for the purpose of researching or validating Indigenous claims, disputes or grievances.

Paragraph 8(2)(f) allows a government institution to disclose personal information to specific types of entities for the purpose of administering or enforcing a law or carrying out a lawful investigation as long as there is an agreement or arrangement in place. The governing entities of several First Nations are identified as potential recipients under that provision. 

Other provisions are broader in nature, such as 8(2)(j), which allows for disclosure to any person or body for research or statistical purposes in certain circumstances, and 8(2)(m) that allows for disclosure for any purpose where, in the opinion of the head of the institution, the public interest in the disclosure clearly outweighs any invasion of privacy that could result,  or where the disclosure would clearly benefit the individual to whom the information relates.

The Privacy Act also allows for the disclosure of the personal information of an individual who has been dead for more than 20 years.

In relation to residential school records, I will note that in January 2022, my Office received a notification of an 8(2)(m) disclosure that was to be made by Crown-Indigenous Relations and Northern Affairs Canada (CIRNAC) to the National Centre for Truth and Reconciliation (NCTR). In that case, my Office was satisfied that the department had carefully weighed the factors and that their justification analysis was comprehensive and thorough.

I will conclude with a few remarks on the need to modernize our privacy laws.

Recognizing the uniqueness of Indigenous interests in relation to personal information, the federal Department of Justice has been engaging with governments and organizations representing the distinct perspectives of First Nations, Inuit and Métis in the context of modernizing the Privacy Act.

Among feedback received, in its recent Report on Engagement with Indigenous Partners, the Department of Justice outlined that indigenous partners have emphasized that disclosure provisions and associated definitions in the Privacy Act should be expanded and that the Act should acknowledge the diversity of Indigenous governments in Canada and the various legal regimes under which they operate.

Indigenous partners have also highlighted the need for Indigenous sovereignty over their data. This would require Indigenous peoples to be directly involved in the decision-making process related to how their information is used and disclosed.

I am encouraged by the engagement that the Department has had with Indigenous peoples, and I fully support their commitment to further engagement on potential changes to the Privacy Act. Issues affecting Indigenous peoples will need to be carefully considered when the federal government moves forward with much-needed modernization of public sector privacy legislation.

I would be pleased to take your questions.