Context and Summary

Context

The Department of Justice Canada is leading the effort to modernize the Privacy Act and establish an updated framework to govern how federal public bodies manage personal information. The need for Privacy Act modernization is well recognized; after almost 40 years of technological advances and societal change since the Act became law in 1983, expectations regarding the use and protection of personal information have evolved significantly.

Recognizing that the Privacy Act has specific impacts on Indigenous peoples in Canada, Justice Canada undertook an initial engagement with Indigenous governments and organizations from spring 2020 to spring 2021 to learn how a modernized Privacy Act could better reflect the distinct needs, expectations and perspectives of First Nations, Inuit and Métis.2

In the context of that initial engagement, we invited 32 First Nations, Inuit and Métis governments and organizations to discuss Privacy Act modernization, 14 of whom met with us to share their perspectives and experiences.3 These discussions were summarized in the report, What We Have Learned (so far) and Next Steps (the “Initial Report”), published in March 2022. In the Initial Report, Justice Canada committed to continuing the dialogue with First Nations, Inuit and Métis partners to ensure that questions related to Privacy Act modernization and its impacts on Indigenous peoples are given appropriate consideration as it develops policy proposals for potential changes to the Privacy Act.

The Initial Report proposed a multi-stage approach to modernizing the provisions in the Privacy Act pertaining to Indigenous peoples and identified the first two stages of this work. Stage 1 would focus on the Act’s foundational principles and rules that play a significant role in governing information sharing between federal public bodies and Indigenous peoples. Stage 2 – which could occur after the enactment of a new Act – would engage First Nations, Inuit and Métis partners to discuss more detailed rules and complex questions that could support any initial changes made to modernize the Act.

To help inform the first stage of Justice Canada’s multi-phase approach, the Initial Report set out questions for input, which were developed based on the feedback received from partners that participated during the initial engagement.4 We shared the report with 64 partners representing First Nations, Inuit and Métis governments and organizations. Partners were invited to provide feedback in response to these questions through a virtual sharing and discussion session, in writing, or both, by April 30, 2022.5

What we have learned from the 2022 Indigenous Engagement

Justice Canada would like to thank the many First Nations, Inuit and Métis governments and organizations who provided input in response to the questions presented in our Initial Report, either in writing, through bilateral engagement sessions, or both. Of the 64 partners that were invited to provide feedback, we heard from 16 representing the views of First Nations, Inuit and Métis.

More specifically, we heard from eight First Nations Modern Treaty organizations and governments, one Inuit land claims organization, two Métis Nation governments, three National Indigenous Organizations (NIOs), and two Indigenous organizations with particular expertise in privacy, claims research and information management.

When partners provided their feedback at a discussion session, Justice Canada officials prepared notes to document the points raised. These were shared after each session with the representatives of the participating partner for their review and comment to ensure that they accurately captured the conversation. This report draws from these notes as well.

This stage of the engagement began in February 2022 and closed in December 2022. Funding was made available to First Nations, Inuit and Métis partners to support their participation.

In addition to the input Justice Canada received during this stage of the engagement, this report also summarizes input received from Indigenous partners in the course of the Treasury Board of Canada Secretariat’s Indigenous engagement on the review of the federal access-to-information regime, which occurred from the spring to the fall of 2022, where there was overlap with Privacy Act modernization.6

The following subsections summarize in detail the feedback from First Nations, Inuit and Métis partners in response to the ideas and questions for potential changes to modernize the Privacy Act set out in the Initial Report.7

General comments from First Nations, Inuit and Métis partners

At the start of an engagement session or written submission, Indigenous partners often provided introductory remarks to help orient their responses to our questions for input. Most partners specified whose interests they were representing as well as the limitations of their authority to speak on behalf of other Indigenous peoples.

We also found that these remarks reflected some common themes. The majority of partners spoke to the importance of aligning a modernized Privacy Act with the United Nations Declaration on the Rights of Indigenous Peoples (UN Declaration). In particular, partners noted that section 5 of the United Nations Declaration on the Rights of Indigenous Peoples Act (UNDA) requires measures be taken to ensure the consistency of federal laws with the UN Declaration. According to some First Nations partners, alignment with the UN Declaration would require the Government of Canada to obtain the free, prior and informed consent of First Nations for any new governance regime that impacted their personal information, both before its enactment and thereafter, and to involve them in decisions regarding the collection and maintenance of information about their members.

Similarly, many partners stated at the outset that any decisions about Indigenous peoples’ personal information should be made in partnership between the Government of Canada and those representing the interests of Indigenous peoples; some stated this was required by certain modern treaties, self-government agreements, and the UNDA. Most partners indicated they would welcome continued engagement with Justice Canada on its initiative to modernize the Privacy Act in a manner that is participatory, ensures the diverse views of Indigenous peoples across Canada are incorporated, and aligns with Indigenous peoples’ engagement protocols, including providing sufficient time for meaningful contributions.

Finally, some partners commented on the limitations of the Privacy Act modernization initiative, signalling that while it is essential and sorely needed, it only deals with one piece of the framework governing Indigenous data and thus could only partially address the privacy and data-governance issues affecting First Nations, Inuit and Métis.

Including a purpose clause that recognizes the advancement of reconciliation with Indigenous peoples in Canada

Q1. In what circumstances would you support the inclusion of a purpose clause which recognizes that one purpose of a modernized Privacy Act is advancing reconciliation with Indigenous peoples in Canada by promoting improved sharing of Indigenous individuals’ personal information with First Nations, Inuit and Métis?

Most partners that responded to this question expressed support for including in the Privacy Act a purpose clause recognizing reconciliation with Indigenous peoples without framing it around the promotion of improved sharing of information with those representing Indigenous peoples. One partner further explained that a purpose clause framed more broadly would not limit the ends by which reconciliation may be advanced to the “sharing of Indigenous individuals’ personal information.” Another partner suggested that a broader framing would be consistent with the preamble of the UNDA.

An NIO partner commented on the importance of ensuring the purpose clause is precise, since it would serve as a strong interpretative guide in the potential future application of the Privacy Act. As such, they cautioned against adopting terms not currently used in the Privacy Act, like “sharing”, which could lead to interpretive ambiguity. This partner also expressed concerns with the grouping of “First Nations, Inuit, and Métis” because “First Nations” is not a defined legal term and it could be misinterpreted as applying only to Indian Act bands. In their view, a purpose clause designed to advance reconciliation must also take into account the rights and needs of “off-reserve Status” and “non-Status Indians” who have little or no connection to a First Nation, Indian Act Band, or other “aboriginal government” as presently defined in the Privacy Act. Given these considerations, the partner recommended that the purpose clause should instead adopt the language of “aboriginal peoples of Canada” under section 35 of the Constitution Act, 1982 to ensure that all peoples to whom the Crown owes its duties are included.

Some partners also suggested that in addition to recognizing reconciliation, a purpose clause should:

Finally, one partner suggested adopting the Principles Respecting the Government of Canada's Relationship with Indigenous Peoples in a purpose section to guide federal public bodies’ determinations as to how to exercise authorities or comply with requirements in a modernized Privacy Act.

Adding a principle that could broaden the scope of disclosure to those representing interests of Indigenous peoples

Q2. In what circumstances would you support the addition of a principle recognizing that a federal public body may disclose Indigenous individuals’ personal information under its control to an Indigenous government, organization or entity?

In response to this question, a few partners supported inclusion of such a principle, with one First Nations partner proposing that, in their context, the principle be framed to permit the Crown to disclose personal information to First Nations governments and duly authorized organizations and entities at the request of First Nations. In this partner’s view, such an addition would be an important element of recognizing First Nations data sovereignty and OCAP® principles8 and ensuring effective operations of First Nations governments.

Some partners offered cautionary remarks, suggesting a disclosure principle would need to be:

Identifying purposes for which personal information can be disclosed without an individual’s consent

Q3. For which purposes, in addition to those already included in the Privacy Act9, should disclosure of Indigenous individuals’ personal information to Indigenous government, organizations or entities be authorized?

Q4. Which approaches would you support to expand the purposes for which Indigenous individuals’ personal information could be disclosed without consent?

  1. Would you support (a) listing all the purposes for which disclosure is permitted, (b) allowing disclosure regardless of the purpose, or (c) an alternative approach?

In response to these questions, one NIO partner favoured listing the purposes for which information could be disclosed and suggested that those purposes be set out in a regulation to the Act so they remain flexible and responsive to change over time. This partner clarified that definitions of purposes should not be generic, such as “to contribute to the development or well-being of the community” or “for the purpose of advancing the interests of Indigenous peoples in Canada.” In their view, the federal government should not be charged with the power to determine when something advances the interests of Indigenous peoples in order to obtain access to personal information that is the rightful property of Indigenous peoples.

Others, however, opposed listing purposes in the Act. In their view, it might be impractical, would require the co-development of agreed purposes, and could result in a narrow interpretation and be inflexible over time. However, these partners made suggestions of purposes that could be included in a modernized Act should the Act continue listing them. These included permitting disclosure of Indigenous individuals’ personal information to:

Some First Nations partners favoured broad disclosure of Indigenous individuals’ personal information regardless of purpose because it would provide the widest latitude to First Nations, limit opportunities for the federal government to deny access to personal information by First Nations rights holders, and support self-governing nations in effectively operating and delivering their programs and services for the benefit of their members. One proponent of this approach stated that if disclosure of First Nations personal information to a First Nations government, organization, or entity were authorized regardless of purpose, it could become an exception provided for in subsection 8(2) of the Privacy Act, replacing paragraphs 8(2)(f) and (k), as well as others with respect to First Nations information.

Others, however, cautioned that permitting disclosure for any purpose might be too broad and vague, resulting in over-collection by recipients and thus increasing risk of privacy violations. Furthermore, one partner explained it may be the wish of some Indigenous individuals that their personal information not be accessible to all Indigenous groups or organizations, even those they may ostensibly be members of.

Another set of partners offered alternatives to these approaches. For example, one partner suggested that the federal government should be authorized to disclose Indigenous individuals’ personal information if the personal information relates directly to an operating program or activity of an Indigenous entity, which would need to be subject to a clear and transparent process. In their view, such an approach would provide the most flexibility to Indigenous entities, whose needs for personal information may vary significantly, with some requiring more information than others, such as those with governing roles.

Similarly, another partner suggested that disclosures would need to be both broad and specific if dealing with Indigenous governments, organizations and entities. They explained that Indigenous governments require broad access to effectively govern and have sovereignty over their affairs, so they should not have to justify access to information every time. For Indigenous organizations and entities that are not recognized under section 35 of the Constitution Act, 1982, disclosures would need to be more restricted, with purposes of disclosure tailored to the practical realities of the requester’s mandate.

An NIO partner took the view that the Privacy Act should provide an opt-in framework wherein Indigenous governing bodies elect to receive their members’ personal information without consent through Information-Sharing Agreements (ISAs). According to this partner, the category of purposes under which such information can be disclosed should be specific to the relevant body, determined according to the opt-in processes and set out in each ISA. The partner also suggested considering including provincial governments in ISAs because these governments also possess personal information relevant to Indigenous governing bodies (e.g., birth and marriage certificates). The partner stated that these measures could be incorporated into a modernizedActand modeled on the section 20 Coordination Agreements under the Act respecting First Nations, Inuit and Métis children, youth and families.

One partner representing First Nations interests emphasized the need to proceed cautiously in expanding existing disclosure authorities and suggested undertaking further engagement with First Nations and their legal experts. Additionally, this partner called for more insight into the entirety of proposed changes to section 8 of the Privacy Act to ascertain whether any of these changes might adversely affect First Nations and result in further interdepartmental disclosure of their information without consent. This partner explained that First Nations are concerned about their personal information being disclosed between federal public bodies to investigate or survey First Nations individuals who participate in protests and who seek to uphold their Aboriginal and Treaty rights.

Finally, while certain partners abstained from suggesting approaches for expanding the current list of permissible disclosures of personal information under section 8, they instead drew attention to the challenges that claims researchers face when seeking to obtain personal information. In particular, these partners stated that researchers encounter several administrative barriers when seeking to obtain disclosures of personal information in accordance with paragraphs 8(2)(k) and 8(2)(j). These partners recommended that the Government of Canada work in partnership with Indigenous peoples to develop a mechanism of independent oversight that would ensure full and timely access to records held by federal government institutions for purposes of substantiating historical claims.

Recognizing the diversity of Indigenous governments

Q5. Which concepts and definitions would you support to ensure that the Privacy Act appropriately recognizes the diversity of First Nations, Inuit, and Métis Nation governments?

Of those that provided input on this question, most favoured the concept of “Indigenous governing body”, with a minority expressing some concern.

Some partners explicitly supported the concept as used in several federal laws10 and defined as “a council, government or other entity that is authorized to act on behalf of an Indigenous group, community or people that holds rights recognized and affirmed by section 35 of the Constitution Act, 1982.”11

One NIO partner suggested that the concept appropriately authorizes disclosure to Indigenous organizations and should replace the existing restrictive definition of “aboriginal government” under section 8(2)(k) of the Privacy Act. In their view, the concept was not a perfect solution because it is still contested among some and there is currently no consistent set of criteria defining an Indigenous governing body. Nonetheless, they added that its adoption would still be an improvement, and urged the Government of Canada to recognize the diversity of representation that exists among Indigenous peoples in a modernized Act, regardless of the terminology chosen.

Another partner commented that the concept was well-established and recognized a broad range of organizations requiring personal information to serve Indigenous individuals; but even so, they noted that other Indigenous groups may feel otherwise. This partner thus supported inclusion of additional concepts for organizations who may not be considered Indigenous governing bodies but who should be authorized to receive personal information without consent, such as certain land claims entities, advocacy groups, health care organizations, and law enforcement organizations.

Another partner stated that federal laws using the concept of “Indigenous governing body” were co-developed with First Nations and supported First Nations rights to choose their representatives as stated in the UN Declaration. Finally, another NIO partner suggested that the process for determining whether the Indigenous governing body legitimately represents section 35 rights holders as per the Constitution Act, 1982 should proceed on a case-by-case basis.

Other partners shared concerns about adopting the concept of “Indigenous governing body”. One such partner stated that the concept had its own challenges given its broad scope and that the concept does not provide a clear way to determine which bodies it includes. They noted that Indigenous governments representing collective rights holders under section 35 of the Constitution Act, 1982 would need to be further engaged on this concept. This partner added that establishing a definition of Indigenous government in this context would require an understanding of the governance structure involving local and regional governments and the information needs and differing roles of each of these groups, and would require further engagement with its citizens.

One partner referred generally to a need to pursue a distinctions-based approach to every project or piece of legislation affecting First Nations, Inuit and Métis peoples’ rights, interests and claims. They further argued that the term "Indigenous" as a blanket statement is not acceptable as it does not clearly distinguish or recognize the full rights that these groups hold.

Disclosing personal information to Indigenous governments, organizations and entities

Q6. If a modernized Privacy Act were to authorize disclosure of Indigenous individuals’ personal information regardless of the purpose, should this broad disclosure authority be for Indigenous governments only or for all Indigenous governments, organizations and entities?

Q7. If a modernized Privacy Act were to authorize disclosure of Indigenous individuals’ personal information for a new list of specific purposes, which types of Indigenous entities (governments, organizations and/or other entities) should be identified as authorized recipients for each of these purposes?

Q8. What measures should be used to assist a federal public body in ensuring that an Indigenous government, organization, or entity is authorized to receive the personal information of its citizens or members?

There was general unanimity that First Nations, Inuit and Métis governments should be able to receive Indigenous individuals’ information given that these governments need access to this information to:

Specifically, most First Nations partners were generally supportive of disclosing personal information to their democratically elected governments, but were more cautious or silent on whether to extend the same disclosures to other organizations and entities. They provided further details in support of their positions:

Métis partners supported disclosing their citizen and community-related personal information to Métis Nation governments, with one partner emphasizing that such disclosures should be broad and not onerous and not require justification each time. These partners held differing concerns around permitting such disclosures to Indigenous organizations and entities. For example,

Another partner suggested that not every Indigenous entity in Canada needs to receive personal information from the federal government and supported a “layered” approach, in which larger, recognized regional Indigenous organizations or governing bodies could receive and distribute personal information to smaller organizations. In their view, regional organizations and governing bodies have broader needs than smaller entities that serve a single purpose and are also better suited to receive and manage personal information and to determine what information should be made available to smaller organizations under the group umbrella.

We heard from NIO partners who recommended that disclosures be available to Indigenous governing bodies and organizations, given the latter may undertake work vital to advancing reconciliation, addressing inequities, and delivering services related to health, healing, justice, and socioeconomic development. Partners elaborated on their views, highlighting that:

Partners recommended establishing various measures that could assist federal public bodies in ensuring that Indigenous governments, organizations, or entities that receive Indigenous individuals’ personal information are authorized to do so. For example:

Some partners remarked that more study and engagement would be needed for defining which Indigenous entities should be authorized recipients of Indigenous individuals’ personal information. For example, one First Nations partner noted that First Nations governments have an important part in defining those who are eligible to receive personal information without an individual’s consent, which would involve a careful balancing of individual rights and freedom to information. Another partner suggested that a better understanding would be needed of how Indigenous peoples organize themselves and that these should be dealt with on a case-by-case basis.

Transferring personal information

Q9. In what circumstances would you support expanding the Privacy Act’s disclosure provisions to authorize federal public bodies to transfer personal information?12

  1. Should the transfer of personal information be authorized in general or limited to specific situations, such as where there is also a transfer of a program or activity?
  2. Should federal public bodies be authorized to transfer personal information to all or some Indigenous governments, organizations or entities?

Most of the partners that responded supported information transfers to Indigenous governments, with some emphasizing that it would be a step towards recognizing data sovereignty of Indigenous governments and would ensure their ownership, control, access, and stewardship of the information. However, the extent of partners’ support for such transfers rested on several conditions.

For example, one partner suggested that when a government has the capacity and a need for the information, it would be appropriate to transfer the information in a manner that is not onerous or limited to specific situations; otherwise, it could undermine the process and its objective.

Some Modern Treaty partners suggested transfers should be limited to recipient Indigenous governments with adequate privacy and access-to-information legislation in place to ensure both that privacy interests in the data are protected and that the individual to whom the information relates can have access to it from the recipient body. They also suggested that personal information transfers should be permitted if they were associated with a federal program or activity of a Modern Treaty government; upon the request of a First Nations government; and possibly in some more general circumstances related to the needs of Modern Treaty governments and their citizens. However, others cautioned that limiting a transfer to a “program or activity” might create unintended barriers for transference purposes where Indigenous groups do not share the same structures.

Others generally spoke to the need for a privacy framework or comprehensive information protection mechanisms to be in place for Indigenous governments or governing bodies to receive such information. One partner suggested that transfers should also be permitted to INGOs if they met privacy protective conditions. However, on this point, a partner suggested that Indigenous governments should decide whether transfers should be authorized to a non-rights-holding organization or entity versus another noting that the bar would have to be very high to authorize the transfer of personal information to Indigenous organizations or entities.

Partners shared further considerations, noting that transfers:

Finally, we heard from one partner who did not see a significant need for transfers and was concerned about the potential for information to be permanently lost if transferred and then deleted by the federal government. They further noted that certain entities might not have the resources to remain the sole custodian of that personal information over time and argued that personal information should therefore only be transferred in very specific circumstances and based on clear written instruction from the receiving entity and possibly from affected individuals.

Mitigating impacts on Indigenous individuals’ privacy interests

Q10. What mechanisms should the Privacy Act recognize to support expanded information sharing and to ensure the protection of personal information disclosed or transferred to First Nations, Inuit and Métis governments and organizations in line with federal public bodies’ responsibilities and accountability obligations?

  1. Should a new Act explicitly recognize information-sharing agreements (ISAs) and Indigenous peoples’ own legislation and privacy codes as mechanisms to support personal information sharing and protection?

Q11. In what circumstances would you support the development of legislative or regulatory requirements to establish the baseline privacy protections that any chosen mechanism (whether ISAs, Indigenous privacy legislation or code) should include to mitigate the impacts of disclosure and transfer on Indigenous individuals’ privacy interests?

Q12. What baseline privacy requirements should be discussed after engagement on the potential changes identified in Part 2 has concluded?

Overall, partners favoured privacy mechanisms to support expanded disclosures or transfers of Indigenous individuals’ personal information to First Nations, Inuit and Métis governments or organizations. Partners suggested a variety of privacy mechanisms for differing reasons. For example, partners generally supported ISAs as legally binding agreements that could facilitate and create baseline privacy requirements for disclosures of personal information to Indigenous governments and organizations. Partners elaborated on their views in support of ISAs, indicating that such agreements should be:

One partner supported Indigenous governments establishing privacy legislation to support expanded disclosures or transfers, but held that it should not be required as a condition of receiving personal information. As an alternative to privacy legislation, some partners suggested:

Some partners cautioned that any changes to laws or regulations imposing certain privacy protections and mechanisms on a First Nations, Inuit or Métis government, organization or entity in order to receive Indigenous individuals’ personal information must:

Finally, we heard a few suggestions for baseline privacy requirements that could be discussed at a future engagement to support and complement any initial changes made to modernize the Act, including further dialogue on technical matters (e.g. information technology and information management strategies); the establishment of privacy management programs; and the conduct of privacy impact assessments.

Additional input from First Nations and Métis partners

We heard additional feedback, mainly from First Nations partners, but also from some Métis partners, on amendments they would like included in a modernized Privacy Act to address issues beyond the questions Justice Canada officials posed in the What We Have Learned (so far) and Next Steps report. We summarize this feedback below.