Privacy Legislation in Canada

Two federal laws

Canada has two federal privacy laws, the Privacy Act and the Personal Information Protection and Electronic Documents Act.

The Privacy Act took effect on July 1, 1983. This Act imposes obligations on some 150 federal government departments and agencies to respect privacy rights by limiting the collection, use and disclosure of personal information. The Privacy Act gives individuals the right to access and request correction of personal information about themselves held by these federal government organizations.

Individuals are also protected by the Personal Information Protection and Electronic Documents Act (PIPEDA) that sets out ground rules for how private sector organizations may collect, use or disclose personal information in the course of commercial activities. The law gives individuals the right to access and request correction of the personal information these organizations may have collected about them.

Initially, PIPEDA applied only to personal information about customers or employees that was collected, used or disclosed in the course of commercial activities by the federally regulated private sector, organizations such as banks, airlines, and telecommunications companies. The Act now applies to personal information collected, used or disclosed by the retail sector, publishing companies, the service industry, manufacturers and other provincially regulated organizations. The Act does not apply to the personal information of employees of these provincially regulated organizations.

The federal government may exempt organizations or activities in provinces that have their own privacy laws if they are substantially similar to the federal law.  PIPEDA will continue to apply in those provinces to the federally regulated private sector and to personal information in inter-provincial and international transactions by all organizations engaged in commercial activities.

Oversight of both federal Acts rests with the Privacy Commissioner of Canada who is authorized to receive and investigate complaints.

Provincial and Territorial Laws

Every province and territory has privacy legislation governing the collection, use and disclosure of personal information held by government agencies. Newfoundland and Labrador has passed legislation, but it is not yet in force. These acts provide individuals with a general right to access and correct their personal information.

Oversight is through either an independent commissioner or ombudsman authorized to receive and investigate complaints.

How privacy is protected in the private sector

PIPEDA applies to all organizations engaged in commercial activities unless the federal government exempts an organization or activity in a province that has substantially similar legislation to the Act.

British Columbia, Alberta and Quebec are the only provinces with laws recognized as substantially similar to PIPEDA. These laws regulate the collection, use and disclosure of personal information by businesses and other organizations and provide individuals with a general right of access to, and correction of, their personal information.

Sector-Specific Legislation Dealing with Privacy

Alberta, Saskatchewan, Manitoba and Ontario have passed legislation to deal specifically with the collection, use and disclosure of personal health information by health care providers and other health care organizations.

Several federal and provincial sector specific laws include provisions dealing with the protection of personal information. The federal Bank Act, for example, contains provisions regulating the use and disclosure of personal financial information by federally regulated financial institutions. Most provinces have legislation dealing with consumer credit reporting. These acts typically impose an obligation on credit reporting agencies to ensure the accuracy of the information, place limits on the disclosure of the information and give consumers the right to have access to, and challenge the accuracy of, the information. Provincial laws governing credit unions typically have provisions dealing with the confidentiality of information relating to members' transactions. There are a large number of provincial acts that contain confidentiality provisions concerning personal information collected by professionals.

For more information contact:

Provincial / Territorial Privacy Laws, Oversight Offices and Government Organizations

Revised in October 2004