Privacy Act Extension Order, No. 3

Lead Directorates:

1. Compliance, Intake and Resolution Directorate (CIRD)
2. Privacy Act Compliance Directorate (PA Compliance)

Background

• Privacy Act Extension Order No. 3: SOR/2021-174 comes into effect on July 13, 2022.
• The Privacy Act establishes a right for individuals to request access to their personal information under the control of a federal government institution. However, under the current Act, this right only applies to Canadian citizens and people physically in Canada. The Extension Order will allow foreign nationals to make requests, and therefore complaints to OPC about those requests, under the Act.
• Government institutions, primarily Immigration, Refugees and Citizenship Canada (IRCC), expect to receive hundreds of thousands of new personal information requests, with an anticipated cascading impact on complaint volumes to the OPC.
  • IRCC currently receives hundreds of thousands of requests each year for personal information from representatives in Canada for the personal information of foreign nationals under the Access to Information Act (ATIA), including immigration, visa and permanent residency applicants. The Office of the Information Commissioner subsequently receives thousands of complaints.
  • The Extension Order will permit foreign nationals to make requests under the Privacy Act, which has stricter statutory timelines than the ATIA, and no costs. As such, requesters may favour making requests, and complaints, under the Privacy Act instead of the ATIA.
  • IRCC received funding for immigration system upgrades in Budget 2022, but not for the processing of personal information requests.
• Based on government estimates, the OPC is likely to receive a six-fold increase in complaint volumes, which will have significant resource implications for the Compliance Sector, particularly CIRD, which deals with the vast majority of the access, time limits and correction complaints.

Current status

• [Redacted]
• The Compliance Sector is running anticipatory staffing processes and exploring solutions for enhanced automation and triage for the type of complaints expected to increase the most.

Strategic considerations

• Even if request volumes at IRCC stay the same, but just switch from being made under the ATIA to the Privacy Act, the OPC will be faced with a several-fold increase in total complaint volumes.
• Handling this increase in the absence of additional funding will likely affect the timely completion of investigations, and potentially their depth.
• Effects will be felt across the entire Compliance Sector as resources in CIRD that are currently allocated to investigating existing Privacy Act and PIPEDA complaints may need to be diverted to manage the influx.

Next steps

• The OPC is continuing to pursue funding options with central agencies as a priority.
• The Compliance Sector will propose triage strategies if funding is insufficient, delayed or not received.