When providing personal information to government authorities, citizens want to know how their government will use their data. Citizens and residents are concerned about the legitimacy of data collection, thus they request clear notice describing to what extent privacy rules will be followed while analyzing their personal data. To ensure the maximum data safety of its people, Canada has established a well-defined Privacy Act.

Let's have a look at how information is being used and which basic privacy rights are guaranteed to the citizens of Canada.

1. What is the Privacy Act of Canada?

According to a trusted source:

The Privacy Act, first enacted in 1983, describes how government departments and agencies must handle the personal information of Canadian citizens and foreign nationals alike.

While interacting with federal authorities and government institutions, the Privacy Act of Canada ensures that citizens practice their due Privacy rights. This involves informing people about how their information will be collected and used by the government of Canada.

Therefore, the details of information disclosure and usage are provided in a well-defined manner in the form of the Privacy Act. The Act also gives you the right to access your personal information held by the federal government.

2. Where Does the Privacy Act Apply?

Before asking people for their data, the Canadian government has to provide detailed information about the collection, usage, retention, and disposal of the personal information of its citizens.

This usually happens when government authorities need to collect important information that is required to conduct various tasks related to the public.

Let's take a look at some of the cases in which the government is authorized to collect public data, as permitted by the Privacy Act:

• To provide security benefits to elderly people, especially those who have retired from their regular government jobs
• While verifying documents for employment insurance claims
• Tasks related to border security provision
• To proceed with public safety and computerized verification of public data
• During the federal policy formation that relates to public benefits
• Tax collection and refunds

A common time when federal government institutions process their citizens‘ information is during tax collection and refunds.

Here, it is important to mention that the Canadian Privacy Act includes a detailed listing of all of the federal government institutions. Morover, the institutions that are listed in schedule 3 are required to strictly follow all instructions provided in the Act. Additionally, the Canadian Privacy Act also applies to Crown corporations.

Remember that the provinces and territories of Canada also have their own set of rules regarding public privacy and security.

Note: there are some organizations in which the Privacy Act of Canada does not apply.

These include:

• All private sector organizations that are independently running businesses
• Political parties
• All members of parliament and senators
• Other political representatives
• Courts

3. How Does the Canada Privacy Act Define Personal Information?

For a complete understanding of the Privacy Act, one must know what is covered under the personal information section.

Personal information includes any type of data related to an individual that makes them identifiable and recognizable.

Here we will discuss what kind of recorded information makes an individual identifiable:

• All basic information including the name, marital status, age, religion, color, ethnic origin, nationality, and race of a person
• Names of an individual are considered sensitive personal information, especially in conjunction with other personal data
• Any particular identity number or symbol that is assigned to at user is also considered personal information
• Data included in any confidential correspondences that are sent to government institutions are also recognized as personal information
• The blood group, personal markings, DNA data, permanent address, and fingerprints also make a person identifiable
• The overall opinion of an  individual is personal information
• The complete history of a person, including their criminal background, employment history, medical record, and educational information are personal information. Their financial data and transaction records are also items related to their personal information

Keep in mind that not all types of information are considered personal information,  and may not be covered by the Privacy Act of Canada.

But, what is not considered personal information?

According to the Privacy Act, personal information does not include the following:

• Any kind of data or information related to a person who is long deceased, especially if that person has been deceased for more than 20 years
• Any professional information about an individual who is not currently serving government authorities and is not an employer or current officer
• Any information related to the services of a person who was performing their work on behalf of a contract owned by a government institution
• Information related to the discretionary financial benefit

4. What Are the Requirements for Handling Personal Information According to Canada’s Privacy Act?

According to the Privacy Act of Canada, there are six requirements for handling personal information:

• Collection
• Use
• Accuracy
• Retention
• Disclosure
• Collection

The Privacy Act of Canada clearly explains that the collection of personal information by a government institution is permitted only when it directly relates to the operation of one of its programs or activities. There are two conditions that must be fulfilled to enable a government institution to gain access to your personal information:

• After you fully permit and authorize the collection of your information
• A specific condition in which the government institution has the authority to gain access to your data

Click here to learn more about the occasions in which it becomes possible for an institution to transfer or share your personal information.

a) Use

In the cases when people allow the acces to their personal information to organizations, they want to know what their information will be used for. When a government organization provides a legal justification for collecting personal data, government authorities are required to use that information only for its intended purpose and not any other.

b) Accuracy

According to the Privacy Act of Canada, it is the responsibility of the government authorities to check the authenticity of the information and make sure that the personal information is 100% accurate and up-to-date.

c) Retention

According to the Privacy Act of Canada, the information that the government authorities collect from their citizens for administrative purposes can only be retained for two years and should be disposed of after requesting permission of its disposal by the citizen.

If you aim at exercising all of the rights given under the Privacy Act of Canada, you can request access to the information that you have provided to the government institutions.

d) Disclosure

As we have discussed earlier, no one has the right to disclose your personal information; even government authorities cannot do this without your consent or permission.

The Privacy Act of Canada also provides information about the use of personal information regarding an individual, with a few exceptions. A Canadian citizen as well as the individual residing within the Canada's territory must have already authorized the collection of information for some particular purpose within a private or public sector. The disclosure of information should directly benefit the individual or at least doesn't cause any harm.  

These disclosures are used to comply with warrants or court orders that grant government authorities access to your personal information and allow usage of that data for various purposes.

5. Right to Access Personal Information

As discussed earlier, all Canadian residents have the right to access their information by making a written request to the designated government institution and asking for the type of data that they need.

These specific applications must be related to government programs, such as when applying for an employment insurance claim. In these cases, citizens are allowed to access their personal information.

Additionally, government institutions are allowed to deny your request for access. It is important to note that not all requests will be denied and in most cases, government institutions must have a valid reason for denying access.

Here are several instances in which the government organization may deny you access to information:

• Disclosure of any kind of PII that goes against the defense of Canada
• The exposure of information that may threaten an individual or a citizen
• Personal information that relates to your physical or mental health, where the examination of the information is contrary to your best interests

It is the citizen’s responsibility to solve all privacy issues immediately by directly consulting with the institution, especially in cases of access denial. Moreover, they can also raise their concerns with the Access to Information and Privacy (ATIP) coordinator of the institution.