Privacy Act
Sections and provisions with full text and the judgments that cite each one.
Section 1 — Short title
This Act may be cited as the Privacy Act .
Section 2 — Purpose
The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to personal information about themselves held by a government institution and that…
Section 3 — Definitions
In this Act, administrative purpose , in relation to the use of personal information about an individual, means the use of that information in a decision making process that directly affects that…
Section 3.01 — For greater certainty
For greater certainty, any provision of this Act that applies to a government institution that is a parent Crown corporation applies to any of its wholly-owned subsidiaries within the meaning of…
Section 3.02 — Application
Paragraph (j.1) of the definition personal information in section 3 applies only to records created on or after the day on which that paragraph comes into force.
Section 3.1 — Power to designate Minister
The Governor in Council may designate a member of the Queen’s Privy Council for Canada to be the Minister for the purposes of any provision of this Act. The Governor in Council may, by order,…
Section 4 — Collection of personal information
No personal information shall be collected by a government institution unless it relates directly to an operating program or activity of the institution.
Section 5 — Personal information to be collected directly
A government institution shall, wherever possible, collect personal information that is intended to be used for an administrative purpose directly from the individual to whom it relates except where…
Section 6 — Retention of personal information used for an administrative purpose
Personal information that has been used by a government institution for an administrative purpose shall be retained by the institution for such period of time after it is so used as may be prescribed…
Section 7 — Use of personal information
Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except for the purpose for which the…
Section 8 — Disclosure of personal information
Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this…
Section 9 — Record of disclosures to be retained
The head of a government institution shall retain a record of any use by the institution of personal information contained in a personal information bank or any use or purpose for which that…
Section 10 — Personal information to be included in personal information banks
The head of a government institution shall cause to be included in personal information banks all personal information under the control of the government institution that has been used, is being…
Section 11 — Index of personal information
The designated Minister shall cause to be published on a periodic basis not less frequently than once each year, an index of all personal information banks setting forth, in respect of each bank, the…
Section 12 — Right of access
Subject to this Act, every individual who is a Canadian citizen or a permanent resident within the meaning of subsection 2(1) of the Immigration and Refugee Protection Act has a right to and shall,…
Section 13 — Request for access under paragraph 12(1)(a)
A request for access to personal information under paragraph 12(1)(a) shall be made in writing to the government institution that has control of the personal information bank that contains the…
Section 14 — Notice where access requested
Where access to personal information is requested under subsection 12(1), the head of the government institution to which the request is made shall, subject to section 15, within thirty days after…
Section 15 — Extension of time limits
The head of a government institution may extend the time limit set out in section 14 in respect of a request for a maximum of thirty days if meeting the original time limit would unreasonably…
Section 16 — Where access is refused
Where the head of a government institution refuses to give access to any personal information requested under subsection 12(1), the head of the institution shall state in the notice given under…
Section 17 — Form of access
Subject to any regulations made under paragraph 77(1)(o), where an individual is to be given access to personal information requested under subsection 12(1), the government institution shall permit…
Section 18 — Governor in Council may designate exempt banks
The Governor in Council may, by order, designate as exempt banks certain personal information banks that contain files all of which consist predominantly of personal information described in section…
Section 19 — Personal information obtained in confidence
Subject to subsection (2), the head of a government institution shall refuse to disclose any personal information requested under subsection 12(1) that was obtained in confidence from the government…
Section 20 — Federal-provincial affairs
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) the disclosure of which could reasonably be expected to be injurious to the…
Section 21 — International affairs and defence
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) the disclosure of which could reasonably be expected to be injurious to the…
Section 22 — Law enforcement and investigation
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that was obtained or prepared by any government institution, or part of any…
Section 22.1 — Information obtained by Privacy Commissioner
The Privacy Commissioner shall refuse to disclose any personal information requested under this Act that was obtained or created by the Commissioner or on the Commissioner’s behalf in the course of…
Section 22.2 — Public Sector Integrity Commissioner
The Public Sector Integrity Commissioner shall refuse to disclose any personal information requested under subsection 12(1) that was obtained or created by him or her or on his or her behalf in the…
Section 22.3 — Public Servants Disclosure Protection Act
The head of a government institution shall refuse to disclose personal information requested under subsection 12(1) that was created for the purpose of making a disclosure under the Public Servants…
Section 22.4 — Secretariat of National Security and Intelligence Committee of Parliamentarians
The Secretariat of the National Security and Intelligence Committee of Parliamentarians shall refuse to disclose personal information requested under subsection 12(1) that was obtained or created by…
Section 23 — Security clearances
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that was obtained or prepared by an investigative body specified in the…
Section 24 — Individuals sentenced for an offence
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that was collected or obtained by the Correctional Service of Canada or the…
Section 25 — Safety of individuals
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) the disclosure of which could reasonably be expected to threaten the safety of…
Section 26 — Information about another individual
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) about an individual other than the individual who made the request, and shall…
Section 27 — Protected information — solicitors, advocates and notaries
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that is subject to solicitor-client privilege or the professional secrecy of…
Section 27.1 — Protected information — patents and trademarks
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that is subject to the privilege set out in section 16.1 of the Patent Act or…
Section 28 — Medical record
The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that relates to the physical or mental health of the individual who requested it…
Section 29 — Receipt and investigation of complaints
Subject to this Act, the Privacy Commissioner shall receive and investigate complaints from individuals who allege that personal information about themselves held by a government institution has been…
Section 30 — Written complaint
A complaint under this Act shall be made to the Privacy Commissioner in writing unless the Commissioner authorizes otherwise.
Section 31 — Notice of intention to investigate
Before commencing an investigation of a complaint under this Act, the Privacy Commissioner shall notify the head of the government institution concerned of the intention to carry out the…
Section 32 — Regulation of procedure
Subject to this Act, the Privacy Commissioner may determine the procedure to be followed in the performance of any duty or function of the Commissioner under this Act.
Section 33 — Investigations in private
Every investigation of a complaint under this Act by the Privacy Commissioner shall be conducted in private. In the course of an investigation of a complaint under this Act by the Privacy…
Section 34 — Powers of Privacy Commissioner in carrying out investigations
The Privacy Commissioner has, in relation to the carrying out of the investigation of any complaint under this Act, power to summon and enforce the appearance of persons before the Privacy…
Section 35 — Findings and recommendations of Privacy Commissioner
If, on investigating a complaint under this Act in respect of personal information, the Privacy Commissioner finds that the complaint is well-founded, the Commissioner shall provide the head of the…
Section 36 — Investigation of exempt banks
The Privacy Commissioner may, from time to time at the discretion of the Commissioner, carry out investigations of the files contained in personal information banks designated as exempt banks under…
Section 37 — Investigation in respect of sections 4 to 8
The Privacy Commissioner may, from time to time at the discretion of the Commissioner, carry out investigations in respect of personal information under the control of government institutions to…
Section 38 — Annual report
The Privacy Commissioner shall, within three months after the termination of each financial year, submit an annual report to Parliament on the activities of the office during that financial year.
Section 39 — Special reports
The Privacy Commissioner may, at any time, make a special report to Parliament referring to and commenting on any matter within the scope of the powers, duties and functions of the Commissioner…
Section 40 — Transmission of reports
Every report to Parliament made by the Privacy Commissioner under section 38 or 39 shall be made by being transmitted to the Speaker of the Senate and to the Speaker of the House of Commons for…
Section 41 — Review by Federal Court where access refused
Any individual who has been refused access to personal information requested under subsection 12(1) may, if a complaint has been made to the Privacy Commissioner in respect of the refusal, apply to…
Section 42 — Privacy Commissioner may apply or appear
The Privacy Commissioner may apply to the Court, within the time limits prescribed by section 41, for a review of any refusal to disclose personal information requested under subsection 12(1) in…