Privacy Act Modernization: Engagement with Indigenous Partners – What We Have Learned (so far) and Next Steps
Annex A. Backgrounder document provided to support bilateral engagement sessions
Privacy Act Modernization Engagement: Taking into Account the Perspectives of First Nations, Inuit and Métis Peoples
What is the Privacy Act?
- The Privacy Act is Canada’s federal public sector personal information protection statute. It applies to approximately 265 federal government institutions, including agencies, departments, offices, crown corporations, national councils, agents of parliament, and many more. It does not apply to private sector businesses, nor to Indigenous governments and organizations.
- The Privacy Act governs how federal government institutions may collect, use, disclose, retain and dispose of personal information, and gives individuals the right to access their own personal information from federal government institutions. It provides individuals with the right to file a complaint to the Privacy Commissioner of Canada if they are concerned with how a federal government institution handles their personal information or with the response received to a request to access their personal information.
- The Privacy Act is organized around the concept of “personal information” which is defined in the Act as information about an identifiable individual that is recorded in any form. This means that the Act offers privacy protection to information associated with an identifiable individual. To date, information about groups or nations has not been specifically protected under this law.
- The Privacy Act is a very important piece of the federal public sector privacy framework, but does not contain all the legal rules that can have an impact on the privacy of individuals. It creates a set of general rules that can be supplemented, expanded, or restricted by provisions included in other federal laws. The Privacy Act works alongside the Access to Information Act, the Canadian Charter of Rights and Freedoms, and treaties, many of which contain detailed provisions about information sharing and confidentiality.
What are the goals of modernizing the Privacy Act?
- The Privacy Act has not been substantially amended since it became law in 1983. A modern Privacy Act should update rights and obligations to protect individuals’ modern expectations of privacy, allow adaptability for innovative governance in a world of disruptive change, and incorporate meaningful and transparent accountability mechanisms backed by strong governance and oversight.
- The Act was drafted in a paper-based era, long before the First Nations and Inuit Regional Health Survey National Steering Committee recognized the OCAP® principles, and before the Government of Canada’s commitment to implement the United Nations Declaration of the Rights of Indigenous Peoples in Canadian law. One of the goals of the modernization initiative is to support reconciliation with First Nations, Inuit and Métis peoples
What is the purpose of this engagement?
- The purpose of this engagement is to learn about the experience of Indigenous peoples, groups, organizations and governments with the Privacy Act. We are seeking their perspectives on what is working well, what could be improved, and how the Act can be modernized to better reflect Indigenous peoples’ needs and expectations.
- This engagement builds upon a preliminary targeted technical engagement with experts conducted during the summer of 2019. At that time, the Department of Justice Canada sought the views of privacy, digital, and data experts on five discussion papers and, through this process, gained a preliminary understanding of some of the issues of interest to Indigenous peoples, organizations and governments.Footnote 19
- Our goal is to deepen our understanding of the considerations raised during this earlier engagement, broaden the scope of these preliminary conversations, and discuss potential approaches to responding to issues of concern for Indigenous peoples in Canada.
- In addition, the Department of Justice Canada has launched an online public consultation on Privacy Act modernization to which you are invited to participateFootnote 20. The public consultation is proceeding in parallel with our separate engagement efforts with Indigenous governments and organizations in Canada in order to discuss issues in which they have a specific interest.
Some of the specific questions on which we would like to engage
- We welcome any feedback you may have regarding potential changes that could be made to the Privacy Act.
- In addition to the general feedback we are seeking, we have summarized below key themes and questions that emerged from our 2019 preliminary targeted technical engagement that could help to organize our discussions.
- Recognizing the diversity of Indigenous governments
The Privacy Act provides a definition of “Indian Band” and “aboriginal government” which identify specific Indigenous governments to which personal information may be disclosed (see ss. 8(2)(k), 8(2)(f), 8(6), 8(7) and 8(8)).- How can a modernized Privacy Act best recognize a broader and more inclusive approach to these information-sharing partnerships consistent with a renewed nation-to-nation, government-to-government, and Inuit-Crown relationships?
- Continued disclosures for claims research while mitigating impacts on individual privacy
Subsection 8(2)(k) of the Privacy Act authorizes government institutions to disclose personal information, notably to “any aboriginal government” (as defined under paragraph 8(7)), “association of aboriginal people”, “Indian band” (as defined by paragraph 8(6)) or to any person acting on behalf of them “for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada”.- While advancing collective claims can require and justify the disclosure of personal information, is there a need to mitigate impacts on individual privacy through new legal, policy or governance measures?
- To what extent should personal information be disclosed to an Indigenous entity with which the subject individual is not associated in any way?
- New and more flexible information-sharing partnerships
Paragraph 8(2)(f) of the Privacy Act facilitates information-sharing agreements with specific First Nation governments for law enforcement purposes or lawful investigations.- Should this provision be reviewed to ensure that all Indigenous governments, whether they are First Nation, Inuit or Métis, have the same opportunities to access federal personal information for not only law enforcement or lawful investigations, but potentially other purposes?
- New governance mechanisms
Decisions with respect to the protection of and access to the personal information of Indigenous peoples can be particularly complex. For instance, Indigenous organizations and governments want to exercise a measure of control over these decisions, notably in the research context.- Is there a need for new governance tools supporting a consultative approach that could assist federal institutions in discharging their stewardship obligations in a way that meets the expectations of Indigenous peoples, and if so, what are the preferred options?
- Protecting collective-based interests in autonomous Indigenous data governance
Individual and collective Indigenous privacy interests are intertwined, and are impacted by the federal government’s relationship with Indigenous peoples.- Is there a need to modify the Privacy Act to ensure protection for Indigenous peoples as individuals and as members of distinct Indigenous collectivities, whether personal information is de-identified or not and, if so, how could that be achieved?
- Date modified: