Privacy Act Modernization: Engagement with Indigenous Partners – What We Have Learned (so far) and Next Steps

Part 3: Questions for future discussion and consideration

In addition to the ideas presented above for potential changes to modernize the Privacy Act, there remain many other related questions that may or may not need to be addressed by the Privacy Act itself. For these questions, there is a need to discuss how to address them as well as the most appropriate tools (legislation, regulations, policies, guidelines, etc.) to do so.

Following engagement on the ideas for potential changes set out in Part 2 of this report and the possible enactment of a modernized Privacy Act, we are proposing a later stage to discuss the more detailed rules and complex questions that could support and complement any initial changes made to modernize the Privacy Act. This further engagement would also provide an opportunity to discuss any additional issues that Indigenous partners consider relevant and important. Below are some of the issues that have been identified so far that would benefit from future discussion and consideration.

Mitigating impacts on Indigenous individuals’ privacy interests

Once we have gathered feedback on questions 10 to 12 above, we will be better able to determine whether and how to continue discussions on the best way to ensure that Indigenous individuals’ privacy interests are adequately protected when their personal information is disclosed or transferred to First Nations, Inuit and Métis governments or organizations.

If needed, future discussion on this issue would focus on identifying more precise measures and mechanisms that could be used to ensure the protection of such personal information, in line with federal public bodies’ responsibilities and accountability obligations.

It could also address measures to appropriately balance the privacy interests of those individuals whose personal information is disclosed or transferred with communal access to that information (for example, an individual being given a right to opt out, to file a complaint, or to request access to and correction of their personal information).

New governance mechanisms

Some Indigenous partners have raised the possibility of Indigenous governments and organizations participating in the decisions of federal public bodies about their handling of personal information about Indigenous peoples, individually and collectively. This could include more general situations where any personal information is disclosed or specific circumstances (e.g. where personal information is disclosed for research purposes, where it is disclosed outside of Canada, or where there is a privacy breach).

The discussion on this issue would focus on obtaining input from a greater number of Indigenous partners and, if required, identifying the means and tools necessary to support a participatory approach. It could also include measures to assist employees of federal public bodies in discharging their stewardship obligations in a way that better meets the expectations and needs of Indigenous peoples.

New oversight mechanisms

As mentioned in Part 1 of this report, some Indigenous partners have suggested there is a need to develop new oversight mechanisms or to review the current ones. Suggestions include having a dedicated Indigenous Privacy Commissioner or an advisory body to resolve complaints related to Indigenous people’s privacy concerns. Another suggestion is to modify the existing powers of the Privacy Commissioner to ensure appropriate recourse in resolving Indigenous individuals’ privacy complaints.

The input received so far on the need to develop new oversight mechanisms has been raised by very few partners. Consequently, future discussion on this issue would focus on obtaining the perspectives of a greater number of Indigenous partners to better understand the needs underlining this recommendation and, if necessary, to identify the best way to meet these expectations.

Protection of Indigenous peoples’ collective and unique privacy interests

Another question that was raised during the Indigenous engagement was whether the Privacy Act, which is designed to protect an individual’s personal information, should expand its scope to also protect community, aggregated or de-identified information about Indigenous peoples or their unique privacy interests relating to certain information (for example, oral histories or Indigenous traditional knowledge).

There was divided opinion among Indigenous partners on whether the Privacy Act itself,other federal laws, or Indigenous laws would be the appropriate legal framework to protect Indigenous peoples’ collective and unique privacy interests. These issues are very complex; further discussion would help identify the real impacts of any proposed approach.