Survey Results: The Privacy Act in Canada

The OpenMedia community rallied together to make our voices heard about the importance of privacy protections in the public sector.

What’s going on?

We’re experiencing a once in a generation opportunity to update and strengthen privacy law for public bodies in Canada. For the first time in a very long time, the Canadian government is looking at making changes to the laws that govern how federal departments and agencies are able to use our personal information. The Privacy Act has been the law when it comes to privacy and public bodies from about the mid-1980s, and a lot has changed in the world of information technology since then. When the Act was written, the world was still working with mostly physical records — things actually written down on a piece of paper — but now, in an era of digital information and electronic record keeping, an update is badly needed. 

So when the federal government announced they were beginning their review with a public survey on modernizing the Privacy Act, we jumped at the opportunity to engage the OpenMedia community.

One important caveat: all this shouldn’t be confused with what’s happening in the private sector, which is governed by a separate set of legislation, the Personal Information Protection and Electronic Documents Act (PIPEDA). The federal government has separately introduced Bill C-11, legislation to make changes to the laws that govern how private companies are able to use our personal information. (In the span of about a week, they did pretty much everything they could when it came to privacy in Canada.) We’re running a campaign to fix C-11 and make it a net win for privacy, too. 

What’s happened so far?

For the Privacy Act consultation — the one that affects how federal departments and agencies are able to use our personal information — we created a survey to engage people who might not otherwise have the opportunity to make their voice heard during traditional government consultations. This survey was based on one made available through the Department of Justice, but different in that it was less than half as long, featured some new questions on potential improvements to the Act we felt the government had left out, and tweaked a few questions we thought had problematic or misleading phrasing. 

The OpenMedia community stepped up in a big way. More than 4,000 of us generously donated their time to participate, including community members from every province and territory in Canada, and contributed their thoughts on how best to create strong privacy protections for years to come. It truly is a geographically representative sample of people from all across the country. 

We submitted the results of our survey to the Department of Justice on February 12, 2021. If you’re interested, you can read our submission right here. What follows is a breakdown of key findings on how our community feels when it comes to the protection of their personal information in the public sector. 

Greater oversight and accountability

The most prominent finding — and something that was felt to be nearly universally important — was support for the introduction of effective, independent oversight of how public bodies are able to use our personal information. Currently, the federal government gives this job to the Treasury Board. Many in the community find it troubling that one branch of the government is responsible for overseeing and ensuring accountability for another branch of the government. It could be argued that this is a conflict of interest. 

Instead, a strong majority of our community would prefer to see an independent agency oversee this important task. When asked, 95.2% said that this responsibility should rest with the Privacy Commissioner of Canada, an independent officer of the legislature who operates at arms length from the government. The community also felt that the Privacy Commissioner should receive new order-making powers, like the ability to compel federal departments and agencies to stop collecting, using, or disclosing personal information. 94% felt that this would be an important improvement in Canada’s public sector privacy laws. 

An incredible 100% of our community feels that individuals must be empowered to know what information federal departments and agencies have about them, how this information is used, and where it can be shared. Here OpenMedia’s community appears to be of one mind: this is an essential part of a general right to know, and it gives people agency over their personal information. Strong rights here are an essential piece of better protecting privacy in Canada.

Enhanced transparency, and limits on sharing of data without consent

Several questions revealed the community’s discomfort with excessively broad sharing by the federal government of our personal information without our consent. 

Following the Department of Justice’s model, our survey asked detailed questions around the ability of the federal departments and agencies to share personal information with external entities, with and without consent — including provincial, territorial, and municipal governments, foreign governments, private companies, and research institutions. 

In every case, the community was extremely uncomfortable with the federal government sharing personal information with these external entities, and that level of discomfort only increased when that sharing was done without explicit consent. From this we learned that while context is important, giving people clear control over how their personal information is being used and shared is most important. 

One measure that the community felt could improve trust between the public and federal government was the introduction of mandatory transparency reports. These would detail the amount of requests for personal information that federal departments and agencies received from law enforcement. 99.3% of the community feels this is important. In order to build trust, many private companies have begun publicly reporting these figures. Extending this measure to the public sector could help to rebuild trust in government institutions. 

Future proofing privacy

A great many in our community felt that it was important to future proof privacy legislation for emerging technologies, like artificial intelligence. In the name of accountability, 81.3% of our community feels that our right to know should extend to cover AI, and that we should have a right to know if AI has been used by federal departments and agencies in making a decision that affects us. For example, if an automated computerized process was used to determine if someone was eligible or ineligible for certain benefits, that person would have the right to know. 

A significant majority of the community also believes that we should have the right to request human involvement in that decision-making process. So, for example, if an automated computerized process decided that someone was ineligible for benefits, the affected person would have the right to ask for a human being to review that decision-making process, and determine whether or not the person should be eligible to receive the benefit. 82% of the community felt that this would be an important right to enact when modernizing the Privacy Act. 

What’s next?

In the coming months, the Department of Justice will take the feedback the community provided, together with other submissions from their consultation, and work towards drafting legislation to modernize the Privacy Act. 

OpenMedia will campaign to make the final result as strong as it can be through every stage of this legislative reform process. If you want to stay informed about what’s happening along the way, sign up to receive updates on this campaign and others. We’d be happy to have you as part of our community!