The Privacy Act: Not an excuse to promote secrecy

The Office of the Privacy Commissioner of Canada’s mission is to protect and promote the privacy rights of Canadians. For obvious reasons, rarely do we advocate for less privacy. That is simply not our role.

Consent is central to the concept of privacy. Granting or withholding consent to the collection, use or disclosure of their personal information provides individuals with the means to protect their privacy rights.

But we understand that there may be occasions when it is appropriate and reasonable to disclose personal information without consent – for health and safety, security, and other reasons related to the public interest. And Canada’s privacy laws have taken this into account. Unfortunately, the provisions that allow such disclosures are not well understood and, on occasion, privacy laws are perceived as standing in the way of safety and security.

This is simply not the case.

A provision in the Privacy Act allows for public interest disclosures. Subsection 8(2) of the Privacy Act sets out specific circumstances in which government institutions may disclose personal information without the individual’s consent. Paragraph 8(2)(m) of the Privacy Act permits for the disclosure of personal information where, in the opinion of the head of the institution, the public interest in disclosure clearly outweighs any invasion of privacy that could result from the disclosure, or disclosure would clearly benefit the individual to whom the information relates. It is up to the head of the institution to determine whether the public interest outweighs the right to privacy. Under subsection 8(5) of the Privacy Act, the institution has a duty to notify the Privacy Commissioner that it will be disclosing personal information in the public interest. The Privacy Commissioner may express concerns, if any, with the proposed disclosure and may, if appropriate, notify the individual whose information will be disclosed. It is, however, ultimately the institution’s decision as to whether it will or will not release the information, and how much it will release. The Privacy Commissioner has no authority to prevent the disclosure.

Although at the Office of the Privacy Commissioner of Canada we feel strongly that this provision of the Privacy Act should not be used too liberally, and without thoughtful consideration of all the issues involved, we must recognize that there are times when it may be appropriate for the head of an institution to invoke this section of the Act. As an example, this provision has been invoked where an individual who poses a threat to the community is being released from a correctional institution.

The media and federal government departments may have different views on what constitutes the "public interest," but it is the responsibility of the head of the institution, if a disclosure is being considered, to ensure that the public interest clearly outweighs the privacy concerns of the individual(s) involved. Departments have been taken to task by our Office for disclosing personal information when they should not have, so it is not surprising that they might often err on the side of caution.

There is a presumption in favour of non-disclosure unless there are compelling arguments to the contrary. The discretion bestowed on the head of the institution must, therefore, be exercised with restraint.

Section 8(2)(m) is not a “loophole” in the Privacy Act which simply allows government departments and agencies to make information public when it should remain private. The provision is applied in unique, fact-specific situations. It is not designed to deal with the disclosure of personal information on a systematic or routine basis. Rather, it is an important section in the Act which provides institutions with a tool they may need to effectively balance an individual’s right to privacy with the public’s need to know.

April 2006