News release

Commissioner encouraged by proposals to modernize the public sector Privacy Act

March 24, 2021 – The Office of the Privacy Commissioner of Canada (OPC) today released a submission containing key recommendations in response to the Department of Justice’s consultation on modernizing Canada’s outdated federal public sector privacy law.

“We are very encouraged by the thoughtful and comprehensive consultation paper Justice published last November, which demonstrates the seriousness of the government’s intent for meaningful reform,” writes the OPC in its submission.

The submission also notes that the consultation document proposes substantive changes that represent significant strides toward a law in step with modern data protection norms.

For nearly 40 years, the Privacy Act has set out the ground rules for how federal government departments and agencies handle personal information. The law has not been substantially updated since it was enacted in 1983, well before digital technologies became mainstream.

The government’s discussion paper includes many proposals that could significantly improve the federal public sector privacy law to effectively address the modern needs of Canadians in relation to their privacy.

These positive proposals include adding a purpose clause to the Privacy Act that specifies that one of the key objectives of the legislation is “protecting individuals’ human dignity, personal autonomy, and self-determination”, thereby recognizing the broad scope of the right to privacy as a human right.

As well, the government’s discussion paper proposes measures aimed at providing meaningful oversight and quick and effective remedies, such as order-making and expanded rights of recourse to Federal Court.

The OPC also welcomes proposals to protect personal information, including an expanded definition of “personal information”, explicit requirements for protection of information, and mandatory breach reporting to affected individuals and the Privacy Commissioner.

The OPC has emphasized the importance of ensuring similar principles and levels of legal protections between both the federal public sector and private sector laws.

The proposed changes to the Privacy Act are substantive and go much further in providing a rights-based foundation to the law than those in Bill C-11, the government’s bill to modernize the federal private sector privacy law. A legal framework entrenching privacy as a human right and as a prior condition for the enjoyment of other democratic rights is critical for modernized privacy laws in both the public and private sectors.

A number of other elements of the Privacy Act modernization plan would also better protect privacy rights than Bill C-11.

For example, the proactive audit powers proposed for the Privacy Act go further in ensuring effective oversight over how institutions manage personal information. As well, the Commissioner’s order-making powers, while limited, would involve a process that is simpler, faster and more effective.

The OPC’s submission on Privacy Act reform includes a number of recommendations aimed at improving the law, such as:

• Clarify the “reasonably required” standard, which limits the collection of personal information by a federal public body, to clearly affirm that the privacy impacts must be proportionate to the public interest at stake.
• Add provisions on automated decision-making including, for example, a definition, a right to meaningful explanation and human intervention related to its use. The law should also establish an obligation for institutions to log and trace personal information used in automated decision-making.
• Provide for responsible design and development of artificial intelligence and situating it within a framework of demonstrable accountability.
• Expand the OPC’s order-making powers so that they apply to all Privacy Act violations. These powers should not be limited to complaints concerning refusals of access to personal information. Instead, they should encompass issues related to the collection, use and disclosure of personal information by government institutions, recognizing that these contraventions affect the greater number of Canadians.
• Clarify that the concept of publicly available personal information does not apply to information where an individual has a reasonable expectation of privacy.

The Privacy Act modernization submission follows the OPC’s recent submission to the Treasury Board of Canada Secretariat in relation to a statutory review of the Access to Information Act (ATIA), which presented an opportunity to examine issues that lie at the intersection of both the ATIA and the Privacy Act.

Related documents:

• OPC submission to the Department of Justice Public Consultation on the Modernization of the Privacy Act
• Submission on the statutory review of the Access to Information Act

Contact:

Office of the Privacy Commissioner of Canada
Communications@priv.gc.ca