Privacy Act (R.S.C., 1985, c. P-21)

Marginal note:Record of disclosures to be retained

• 9 (1) The head of a government institution shall retain a record of any use by the institution of personal information contained in a personal information bank or any use or purpose for which that information is disclosed by the institution where the use or purpose is not included in the statements of uses and purposes set forth pursuant to subparagraph 11(1)(a)(iv) and subsection 11(2) in the index referred to in section 11, and shall attach the record to the personal information.

• Marginal note:Limitation

  (2) Subsection (1) does not apply in respect of information disclosed pursuant to paragraph 8(2)(e).

• Marginal note:Record forms part of personal information

  (3) For the purposes of this Act, a record retained under subsection (1) shall be deemed to form part of the personal information to which it is attached.

• Marginal note:Consistent uses

  (4) Where personal information in a personal information bank under the control of a government institution is used or disclosed for a use consistent with the purpose for which the information was obtained or compiled by the institution but the use is not included in the statement of consistent uses set forth pursuant to subparagraph 11(1)(a)(iv) in the index referred to in section 11, the head of the government institution shall

  • (a) forthwith notify the Privacy Commissioner of the use for which the information was used or disclosed; and

  • (b) ensure that the use is included in the next statement of consistent uses set forth in the index.

Personal Information Banks

Marginal note:Personal information to be included in personal information banks

• 10 (1) The head of a government institution shall cause to be included in personal information banks all personal information under the control of the government institution that

  • (a) has been used, is being used or is available for use for an administrative purpose; or

  • (b) is organized or intended to be retrieved by the name of an individual or by an identifying number, symbol or other particular assigned to an individual.

• Marginal note:Exception for Library and Archives of Canada

  (2) Subsection (1) does not apply in respect of personal information under the custody or control of the Library and Archives of Canada that has been transferred there by a government institution for historical or archival purposes.

Personal Information Index

Marginal note:Index of personal information

• 11 (1) The designated Minister shall cause to be published on a periodic basis not less frequently than once each year, an index of

  • (a) all personal information banks setting forth, in respect of each bank,

    • (i) the identification and a description of the bank, the registration number assigned to it by the designated Minister pursuant to paragraph 71(1)(b) and a description of the class of individuals to whom personal information contained in the bank relates,

    • (ii) the name of the government institution that has control of the bank,

    • (iii) the title and address of the appropriate officer to whom requests relating to personal information contained in the bank should be sent,

    • (iv) a statement of the purposes for which personal information in the bank was obtained or compiled and a statement of the uses consistent with those purposes for which the information is used or disclosed,

    • (v) a statement of the retention and disposal standards applied to personal information in the bank, and

    • (vi) an indication, where applicable, that the bank was designated as an exempt bank by an order under section 18 and the provision of section 21 or 22 on the basis of which the order was made; and

  • (b) all classes of personal information under the control of a government institution that are not contained in personal information banks, setting forth in respect of each class

    • (i) a description of the class in sufficient detail to facilitate the right of access under this Act, and

    • (ii) the title and address of the appropriate officer for each government institution to whom requests relating to personal information within the class should be sent.

• Marginal note:Statement of uses and purposes

  (2) The designated Minister may set forth in the index referred to in subsection (1) a statement of any of the uses and purposes, not included in the statements made pursuant to subparagraph (1)(a)(iv), for which personal information contained in any of the personal information banks referred to in the index is used or disclosed on a regular basis.

• Marginal note:Index to be made available

  (3) The designated Minister shall cause the index referred to in subsection (1) to be made available throughout Canada in conformity with the principle that every person is entitled to reasonable access to the index.

Access to Personal Information

Right of Access

Marginal note:Right of access

• 12 (1) Subject to this Act, every individual who is a Canadian citizen or a permanent resident within the meaning of subsection 2(1) of the Immigration and Refugee Protection Act has a right to and shall, on request, be given access to

  • (a) any personal information about the individual contained in a personal information bank; and

  • (b) any other personal information about the individual under the control of a government institution with respect to which the individual is able to provide sufficiently specific information on the location of the information as to render it reasonably retrievable by the government institution.

• Marginal note:Other rights relating to personal information

  (2) Every individual who is given access under paragraph (1)(a) to personal information that has been used, is being used or is available for use for an administrative purpose is entitled to

  • (a) request correction of the personal information where the individual believes there is an error or omission therein;

  • (b) require that a notation be attached to the information reflecting any correction requested but not made; and

  • (c) require that any person or body to whom that information has been disclosed for use for an administrative purpose within two years prior to the time a correction is requested or a notation is required under this subsection in respect of that information

    • (i) be notified of the correction or notation, and

    • (ii) where the disclosure is to a government institution, the institution make the correction or notation on any copy of the information under its control.

• Marginal note:Extension of right of access by order

  (3) The Governor in Council may, by order, extend the right to be given access to personal information under subsection (1) to include individuals not referred to in that subsection and may set such conditions as the Governor in Council deems appropriate.

Requests for Access

Marginal note:Request for access under paragraph 12(1)(a)

• 13 (1) A request for access to personal information under paragraph 12(1)(a) shall be made in writing to the government institution that has control of the personal information bank that contains the information and shall identify the bank.

• Marginal note:Request for access under 12(1)(b)

  (2) A request for access to personal information under paragraph 12(1)(b) shall be made in writing to the government institution that has control of the information and shall provide sufficiently specific information on the location of the information as to render it reasonably retrievable by the government institution.

Marginal note:Notice where access requested

14 Where access to personal information is requested under subsection 12(1), the head of the government institution to which the request is made shall, subject to section 15, within thirty days after the request is received,

• (a) give written notice to the individual who made the request as to whether or not access to the information or a part thereof will be given; and

• (b) if access is to be given, give the individual who made the request access to the information or the part thereof.

Marginal note:Extension of time limits

15 The head of a government institution may extend the time limit set out in section 14 in respect of a request for

• (a) a maximum of thirty days if

  • (i) meeting the original time limit would unreasonably interfere with the operations of the government institution, or

  • (ii) consultations are necessary to comply with the request that cannot reasonably be completed within the original time limit, or

• (b) such period of time as is reasonable, if additional time is necessary for translation purposes or for the purposes of converting the personal information into an alternative format,

by giving notice of the extension and the length of the extension to the individual who made the request within thirty days after the request is received, which notice shall contain a statement that the individual has a right to make a complaint to the Privacy Commissioner about the extension.

Marginal note:Where access is refused

• 16 (1) Where the head of a government institution refuses to give access to any personal information requested under subsection 12(1), the head of the institution shall state in the notice given under paragraph 14(a)

  • (a) that the personal information does not exist, or

  • (b) the specific provision of this Act on which the refusal was based or the provision on which a refusal could reasonably be expected to be based if the information existed,

  and shall state in the notice that the individual who made the request has a right to make a complaint to the Privacy Commissioner about the refusal.

• Marginal note:Existence not required to be disclosed

  (2) The head of a government institution may but is not required to indicate under subsection (1) whether personal information exists.

• Marginal note:Deemed refusal to give access

  (3) Where the head of a government institution fails to give access to any personal information requested under subsection 12(1) within the time limits set out in this Act, the head of the institution shall, for the purposes of this Act, be deemed to have refused to give access.

Access

Marginal note:Form of access

• 17 (1) Subject to any regulations made under paragraph 77(1)(o), where an individual is to be given access to personal information requested under subsection 12(1), the government institution shall

  • (a) permit the individual to examine the information in accordance with the regulations; or

  • (b) provide the individual with a copy thereof.

• Marginal note:Language of access

  (2) Where access to personal information is to be given under this Act and the individual to whom access is to be given requests that access be given in a particular one of the official languages of Canada,

  • (a) access shall be given in that language, if the personal information already exists under the control of a government institution in that language; and

  • (b) where the personal information does not exist in that language, the head of the government institution that has control of the personal information shall cause it to be translated or interpreted for the individual if the head of the institution considers a translation or interpretation to be necessary to enable the individual to understand the information.

• Marginal note:Access to personal information in alternative format

  (3) Where access to personal information is to be given under this Act and the individual to whom access is to be given has a sensory disability and requests that access be given in an alternative format, access shall be given in an alternative format if

  • (a) the personal information already exists under the control of a government institution in an alternative format that is acceptable to the individual; or

  • (b) the head of the government institution that has control of the personal information considers the giving of access in an alternative format to be necessary to enable the individual to exercise the individual’s right of access under this Act and considers it reasonable to cause the personal information to be converted.

Exemptions

Exempt Banks

Marginal note:Governor in Council may designate exempt banks

• 18 (1) The Governor in Council may, by order, designate as exempt banks certain personal information banks that contain files all of which consist predominantly of personal information described in section 21 or 22.

• Marginal note:Disclosure may be refused

  (2) The head of a government institution may refuse to disclose any personal information requested under subsection 12(1) that is contained in a personal information bank designated as an exempt bank under subsection (1).

• Marginal note:Contents of order

  (3) An order made under subsection (1) shall specify

  • (a) the section on the basis of which the order is made; and

  • (b) where a personal information bank is designated that contains files that consist predominantly of personal information described in subparagraph 22(1)(a)(ii), the law concerned.

Responsibilities of Government

Marginal note:Personal information obtained in confidence

• 19 (1) Subject to subsection (2), the head of a government institution shall refuse to disclose any personal information requested under subsection 12(1) that was obtained in confidence from

  • (a) the government of a foreign state or an institution thereof;

  • (b) an international organization of states or an institution thereof;

  • (c) the government of a province or an institution thereof;

  • (d) a municipal or regional government established by or pursuant to an Act of the legislature of a province or an institution of such a government;

  • (e) the council, as defined in the Westbank First Nation Self-Government Agreement given effect by the Westbank First Nation Self-Government Act;

  • (e.1) the Whitecap Dakota Government, as defined in section 2 of the Self-Government Treaty Recognizing the Whitecap Dakota Nation / Wapaha Ska Dakota Oyate Act;

  • (f) the council of a participating First Nation as defined in subsection 2(1) of the First Nations Jurisdiction over Education in British Columbia Act; or

  • (g) a First Nation Government or the Anishinabek Nation Government, as defined in section 2 of the Anishinabek Nation Governance Agreement Act, or an Anishinaabe Institution, within the meaning of section 1.1 of the Agreement, as defined in section 2 of that Act.

• Marginal note:Where disclosure authorized

  (2) The head of a government institution may disclose any personal information requested under subsection 12(1) that was obtained from any government, organization or institution described in subsection (1) if the government, organization or institution from which the information was obtained

  • (a) consents to the disclosure; or

  • (b) makes the information public.