What is the federal Privacy Act?

The Privacy Act is the federal statute that governs how federal government institutions collect, use, and disclose personal information about individuals, and how individuals can access and request correction of personal information held by the federal government. The Act received Royal Assent on July 7, 1982 and came into force on July 1, 1983. It is administered and enforced by the Office of the Privacy Commissioner of Canada (OPC), an independent agent of Parliament. The Privacy Commissioner is currently Philippe Dufresne, appointed in 2022.

The Privacy Act applies to about 270 federal government institutions listed in the schedule, including federal departments, federal agencies, federal Crown corporations, and the federal courts. Each institution must collect personal information directly from the individual where possible, must use the information only for the purpose for which it was collected (or a consistent use), must protect the information with appropriate safeguards, must allow individuals to access their personal information held by the institution, and must allow individuals to request correction of inaccurate information.

The Privacy Act overlaps with PIPEDA: PIPEDA covers private-sector commercial activities, while the Privacy Act covers federal government institutions. The two statutes apply different standards (the Privacy Act is generally less stringent and lacks the consent and limiting-collection requirements of PIPEDA), reflecting different policy goals. The federal Access to Information Act (also 1982) provides a parallel right of access to general government records (other than personal information). The federal Library and Archives Canada Act of 2004 addresses the long-term retention of federal records.

The Privacy Act has been the subject of periodic reform calls. The 2009 Office of the Privacy Commissioner Special Report to Parliament identified more than 100 recommended reforms. The federal government's Public Safety Canada Discussion Paper of 2021 and the Government response of 2024 propose updates including mandatory breach reporting (currently voluntary), expanded individual rights, modernised information-sharing rules, and clearer Privacy Commissioner powers. The Privacy Act and the Canadian Charter of Rights and Freedoms section 8 (unreasonable search and seizure) work together to protect personal information held by government, with the Charter providing the constitutional baseline and the statute providing operational rules.