Tips for raising your privacy concern with a federal government institution

Federal government departments and agencies are required to responsibly handle the personal information that individuals entrust to their care.

The Privacy Act sets out the rules for the collection, use and disclosure of personal information by federal government institutions. It also gives individuals, whether they are within or outside Canada, the right to request to see the information the government holds about them, and to request corrections.

When a privacy issue arises, your first step should generally be to try to resolve the issue directly with the institution.

You can raise your concerns with the Access to Information and Privacy (ATIP) Co-ordinator of the institution responsible for the personal information at issue. A list of ATIP Co-ordinators in the federal government can be found on canada.gc.ca. This information can also be obtained by contacting the institution directly.

It may be helpful to lay out your concerns in writing to the institution.

General tips

Some tips for raising your concerns:

Don’t wait. If you have a privacy concern, raise it immediately. With time, information is deleted and memories fade. The longer you wait to raise your concerns, the more difficult it becomes to address them.

Engage the right person. Federal government institutions have Access to Information and Privacy (ATIP) Co-ordinators who are responsible for addressing issues related to the handling of personal information.

Be crystal clear. Use simple language to explain yourself and be concise by staying focused on the specific issue at hand. Avoid referencing past concerns/complaints or unrelated matters to prevent confusion and resist the urge to cut and paste legalese. If you raise your concern in writing, type your letter whenever possible, or ensure you write clearly.

Be courteous. You may be upset but you are more likely to convey your point successfully and get the results you are looking for if you are calm and polite. 

Set timelines. Set or seek firm, reasonable timelines for a response and resist contacting the institution before the allotted time has elapsed. Ask the institution to, if necessary, provide an initial response within the timeline given, and tell you how long it will take to provide a full response.

Be thorough and keep good records. Include all relevant details about your situation to assist organizations in identifying you and your concerns more quickly. Provide copies of key supporting documentation. Keep originals in case you need them later and avoid overwhelming organizations by providing unnecessary evidence. Make sure letters are properly dated, take notes on all conversations and keep emails and make copies of any correspondence.

Sample letter/Email

If you opt to put your concerns in writing, the following template provides a suggested starting point for drafting a letter or email outlining your privacy concerns.

Be sure to include:

• Your full address; and
• Any relevant identification numbers or a reference number if you have had previous contact with the department or agency on the matter.

Dear Sir/Madam (ATIP Co-ordinator or name of person you have been in contact with previously),

I am writing to you regarding a privacy concern.

[Provide details about your concern and the specific issue. Briefly explain what occurred and, if applicable, what impact it has had on you.]

My hope is that you will be able address this/these issue(s) and alleviate my concern(s). [If appropriate, state the specific action you would like the institution to take.]

I would appreciate a response within 30 business days. If you cannot provide a response within that time, please let me know when you will be able to respond.

Please do not hesitate to contact me at [your daytime phone number and/or your email] if you would like additional details or to discuss the matter further.

Complaints to the Office of the Privacy Commissioner of Canada

If you are not satisfied with an organization’s response to your concerns, you may be able to file a formal privacy complaint about a federal government institution with the Office of the Privacy Commissioner of Canada.