The Privacy Act

The Privacy Act took effect on July 1, 1983. The Act imposes obligations on most federal government institutions to respect the privacy rights of Canadians by placing limits on the collection, use and disclosure of personal information. The Act also gives Canadians the right to access and correct personal information about themselves that is held by these institutions.

The Act does apply to all federal institutions listed in the Schedule.

Some of the key components of the Privacy Act include:

• A listing of various types of personal information;
• How to submit a formal request;
• How to change personal information if you feel it is untrue or misleading;
• How personal information is safeguarded by the Government of Canada;
• How the Government of Canada can disclose personal information
• Turnaround times on requests.

The Act also provides key privacy definitions and before you learn anything more, it is extremely important to understand some key definitions and terms, including personal information, collection of personal information and use and disclosure of personal information.

These are just summaries of the definitions and do not include the full definition. To see the full definition go to the Glossary.

Personal Information:

Personal information includes any information about an identifiable individual. This includes information in any form, such as:

• age, name, ID numbers, income, ethnic origin or blood type;
• opinions, evaluations, comments, social status or disciplinary actions;
• employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods and services or change jobs).

Collection of Personal Information:

When collecting personal information it must relate directly to government institution's operating program or activity and it must be collected directly from the subject individual wherever possible. When collected, the individual must also be informed of the purpose of the collection. The personal information does not have to be collected directly from the individual where the individual authorizes otherwise, where the institution collects the information from another institution that is authorized to disclose the information under s. 8(2) of the Privacy Act, where direct collection would result in the collection of inaccurate information or where direct collection would defeat the purpose or prejudice the use for which information is collected.

Use and Disclosure of Information:

Personal information cannot be used without the consent of the individual, but there are limited and specific exceptions to this as stated in Section 8 (1) & (2).

A few examples of when personal information can be disclosed include:

• For the reasons the information was obtained.
• For a purpose that is consistent with the purpose for which the information was obtained.
• For any purpose in accordance with an Act of Parliament.
• To comply with subpoenas or warrants issued by a court or person or body of jurisdiction to compel the production of information.

To learn more about other privacy terms, take a look at the Glossary.

What I will learn

PIPEDA