Modernizing Canada’s Privacy Act

  On this page

Why review the Privacy Act

Our world has changed dramatically since Canada’s Privacy Act came into force in 1983. At that time, information was still mainly stored on paper. After over 40 years of technological advances and social change, expectations from people in Canada on how federal institutions use, share and store their personal information have changed. The Act is federal legislation focused on the protection of personal information held by the federal government and federal public-sector institutions.

In 2016, the House of Commons Standing Committee on Access to Information, Privacy and Ethics Committee (ETHI Committee) studied this topic. Experts and stakeholders who appeared before this committee raised concerns that the basic framework in the Privacy Act was overdue for a thorough review. The Office of the Privacy Commissioner also provided public opinion research suggesting that this perception was widespread among residents of Canada.

Given these societal and technological shifts, the Government of Canada is committed to reviewing our federal public sector privacy law to ensure it keeps pace with these changes. In its response to the ETHI Committee’s report following its study on Privacy Act reform, the government announced it would be leading a review of the Act, and would engage experts, organizations, advocates, and people in Canada, as the review progresses.

Ongoing engagement and consultations

The Treasury Board of Canada Secretariat (TBS) has launched a public consultation on the Privacy Act and is seeking feedback from stakeholders and Indigenous partners.

TBS’s public consultation paper includes themes considered in earlier engagement activities alongside new themes on which the government is seeking the public’s views for the first time. This approach enables stakeholders and Indigenous partners who have not previously participated to provide feedback, while also allowing those who took part in earlier engagement activities to update or add to their previous comments and to respond to the new themes now being presented. This engagement will build on the Department of Justice Canada’s Privacy Act modernization work, further informing the government’s path forward to modernize the Act.

Justice-led engagement and consultations

In 2020-2021, Justice Canada held an online public consultation to obtain the views of people in Canada on how the Privacy Act could be updated. Feedback received as part of the consultation was summarized and published in a What We Heard Report.

Between 2020 and 2022, Justice Canada also held two rounds of engagement with Indigenous partners on the modernization of the Privacy Act and published two reports entitled Report on Engagement with Indigenous Partners and Report on 2022 Engagement with Indigenous Partners summarizing the feedback received.

For further information on Justice Canada’s consultation and engagement with people in Canada on the modernization of the Privacy Act, visit Engaging with people in Canada.

Privacy protection in Canada

The Privacy Act is a key piece of Canada’s overall legal framework for protecting privacy. It is federal legislation focused on the protection of personal information held by the federal government and federal public-sector institutions. However, Canadian law protects various privacy interests in many ways.

The Charter of Rights and Freedoms

Although the word “privacy” does not appear in the Canadian Charter of Rights and Freedoms, the Charter protects certain privacy interests. For example, section 8 of the Charter protects personal, territorial and informational privacy through the right to be free from unreasonable search and seizure by the government.

The Criminal Code

The Criminal Code also includes a number of criminal offences that protect privacy interests, such as the offense against voyeurism.

Quebec’s Charter, Code civil and privacy torts

Section 5 of Quebec’s Charter states that “every person has a right to respect for his private life”. Its Code civil has provisions protecting privacy rights, and in some Canadian provinces, courts have recognized common law privacy torts, such as for intrusions into private affairs and spaces, and for the wrongful publication of private information. Some provinces have also enacted specific laws creating statutory privacy torts.

Provincial personal information protection laws

In addition, provincial and territorial governments have enacted statutes specifically aimed at protecting personal information, including in the public sector and the private sector. Some provinces have passed legislation aimed at protecting personal health information, and some have passed legislation that applies to municipalities.

The private sector and privacy: Personal Information Protection and Electronic Documents Act

Since 2001, the Personal Information Protection and Electronic Documents Act (PIPEDA) has set the ground rules at the federal level for how organizations engaged in commercial activities must handle personal information. This law now generally applies to all private-sector organizations that collect, use or disclose personal information in the course of commercial activities in Canada. In addition, provinces can also pass their own substantially similar private sector personal information protection statutes, and many have.

Innovation, Science and Economic Development Canada is also working towards legislative reform that would modernize the PIPEDA.

What others are doing

Other countries have responded to these technological and societal changes with new laws to protect their citizens’ personal information. These laws are sometimes called “data protection” laws.

In May 2018, the European Union brought into force a new privacy regime for all member jurisdictions called the General Data Protection Regulation (GDPR). The GDPR imposes privacy protection requirements for personal information within and flowing out of the European Union. Other countries, such as Australia, New Zealand and the United Kingdom, have also made changes to their own data protection frameworks.

Many Canadian provinces have also renewed their public sector privacy laws, and somehave introduced specific health information privacy statutes.