Privacy Act Extension Order, No. 3: SOR/2021-174

Canada Gazette, Part II, Volume 155, Number 15

Registration
SOR/2021-174 July 14, 2021

PRIVACY ACT

P.C. 2021-725 July 13, 2021

His Excellency the Administrator of the Government of Canada in Council, on the recommendation of the Minister of Justice, pursuant to subsection 12(3) of the Privacy Act footnote a, makes the annexed Privacy Act Extension Order, No. 3.

Privacy Act Extension Order, No. 3

Extension of right of access

1 The right to be given access to personal information under subsection 12(1) of the Privacy Act is extended to include all individuals outside Canada to whom that right has not been extended previously.

Coming into force

2 This Order comes into force on the first anniversary of the day on which it is made.

REGULATORY IMPACT ANALYSIS STATEMENT

(This statement is not part of the Order.)

Issues

The right of access to personal information under subsection 12(1) the Privacy Act is not universal and, as such, is not aligned with domestic and international norms.

Background

The Privacy Act establishes a right for individuals to request access to their personal information under the control of a federal government institution. Under subsection 12(1) of the Privacy Act, this right applies to Canadian citizens and permanent residents. Redress rights, such as the right to request correction of one's personal information, are found in subsection 12(2) of the Privacy Act and flow from the right of access in subsection 12(1) of the Act.

The right of access under the Privacy Act can be extended by means of an extension order made under subsection 12(3) of the Act. In 1983, the Privacy Act Extension Order, No. 1, extended the right of access to inmates in federal penitentiaries who are not Canadians or permanent residents, and in 1989, the Privacy Act Extension Order, No. 2, extended the right of access to include all individuals present in Canada to whom that right has not been extended previously.

Until the Privacy Act Extension Order, No. 3 (the Extension Order) comes into force, only Canadians and permanent residents (irrespective of geographical location) and individuals physically present in Canada have a right of access to their own personal information under the Privacy Act. Foreign nationals abroad do not have such a right.

The Privacy Act is an outlier in this respect. Provincial and territorial public sector access to information and privacy legislation provide for a right of access without geographical limitations. The United Kingdom and most other Commonwealth jurisdictions do so also, as does the European Union General Data Protection Regulation. Universal access to personal information, regardless of an individual's geographical location, is the domestic and international norm.

Federal government institutions hold personal information about non-citizens as well as citizens. Given the limits to the right of access under the Privacy Act, foreign nationals, for example those applying for work or study visas or seeking to immigrate to Canada, who want access to their personal information, often have to do so by having an agent or mandatary (in civil law) make an Access to Information Act request for their information, often for a fee, and then consenting to the release of their personal information to the agent or mandatary.

The Privacy Commissioner of Canada has long advocated for the right of access under the Privacy Act to be made universal. Likewise, the House of Commons Standing Committee on Access to Information, Privacy and Ethics recommended in 2016 that the Government of Canada consider extending the right of access to personal information to foreign nationals.

Objective

The Extension Order gives foreign nationals abroad the same right as Canadians to request access to personal information about themselves that is under the control of federal government institutions. Foreign nationals abroad will now be in a position to determine directly how their personal information is used, and to take steps to rectify any inaccuracies in such information. As a result, openness, fairness and accountability are enhanced.

The Extension Order extends the right of access under the Privacy Act such that the right will become universal, bringing that Act in line with domestic and international norms. It enhances interoperability, particularly with European Union Member States.

Description

The Extension Order permits foreign nationals, regardless of where they are located, to request access to their personal information held by federal government institutions under the Privacy Act.

Regulatory development

Consultation

The Treasury Board of Canada Secretariat (TBS) has been consulted on the proposal, as the President of the Treasury Board is the designated minister for the administration of the Privacy Act, which includes responsibilities for developing policies and guidelines, operating the Access to Information and Privacy Online Request Service (AORS), collecting statistics and promoting compliance among government institutions subject to the Privacy Act.

The Department of Justice also consulted with a number of departments and agencies that it expected to be most affected by the Extension Order, including Immigration, Refugees and Citizenship Canada (IRCC). It is expected that IRCC will experience significant operational impact with the coming into force of the Extension Order, considering how the majority of its client base are foreign nationals. Overall, federal government institutions are supportive of the Extension Order, although they anticipate a certain degree of operational impact.

The Extension Order is not expected to impact the rights of Canadians or increase administrative burdens or costs on businesses. It extends the right of access under the Privacy Act to foreign nationals, regardless of their geographic location, affording them the same right of access as Canadians.

Modern treaty obligations and Indigenous engagement and consultation

No modern treaty implications are anticipated because Indigenous peoples in Canada are not impacted by the Extension Order.

Instrument choice

The right of access under subsection 12(1) of the Privacy Act could be extended by amending the Act or by means of an order made under subsection 12(3) of the Act. The use of a regulatory instrument permits the extension to the right of access to be accomplished sooner, and this approach was taken for previous extensions of the right of access.

Regulatory analysis

Benefits and costs

The Extension Order will allow foreign nationals, regardless of their location, to request access to their personal information held by federal government institutions.

Foreign nationals abroad will also be able to exercise the rights under subsection 12(2) of the Privacy Act, such as the right to request correction of their personal information where it is believed there is an error or omission in the information, as these rights flow from the right of access. Foreign nationals abroad will also benefit from having the right to engage the Privacy Commissioner of Canada with respect to the exercise of their right of access and any of the rights under subsection 12(2).

Extending universal access to personal information holdings brings Canada's privacy regime closer in line with major trading partners, such as the European Union and the United Kingdom. This alignment will facilitate the exchange of personal information between Canadian-based firms and firms based in those regions.

The Extension Order is expected to increase the number of requests for access to personal information across federal government departments and agencies subject to the Privacy Act to varying degrees, with the most significant increase expected to be with IRCC.

IRCC receives more access to information and privacy requests than all other federal government institutions combined, most of which are linked to individual case files. In the 2020–2021 fiscal year, IRCC received close to 130 000 access to information and privacy requests. The Extension Order is expected to result in a significant increase in the total number of privacy requests received due in large part to a shift in the nature of the requests received.

Close to 99% of requests submitted to IRCC are for personal information. However, the majority of these requests are not made by IRCC clients directly since they have not had the right to do so under the Privacy Act. Instead, these requests are made by third-party services, often for a fee, under the Access to Information Act. Once the Extension Order comes into force, a large portion of IRCC's request volumes are expected to shift from requests under the Access to Information Act to requests under the Privacy Act. Privacy Act response timelines are mandatory and the extension of time limits is more limited than under the Access to Information Act. Therefore, this shift may have an impact on IRCC's operations.

Federal government departments and agencies subject to the Privacy Act will incur costs to process additional requests. TBS will incur costs to update AORS and policy instruments, such as the Personal Information Request Form and statistical forms to align them with the Extension Order by the time the Order comes into force. Once the Extension Order is in force, depending on the overall increase in requests made by foreign nationals abroad using AORS, additional and ongoing system maintenance costs are expected to handle the additional requests.

Small business lens

Analysis under the small business lens concluded that the Extension Order will not impact Canadian small businesses.

One-for-one rule

The one-for-one rule does not apply to the Extension Order, as there is no incremental change in administrative burden on business.

Regulatory cooperation and alignment

The Extension Order is not related to a work plan or commitment under a formal regulatory cooperation forum.

However, the Extension Order extends the right of access under the Privacy Act such that that right will become universal, bringing that Act in line with domestic and international norms.

Strategic environmental assessment

In accordance with the Cabinet Directive on the Environmental Assessment of Policy, Plan and Program Proposals, a preliminary scan concluded that a strategic environmental assessment is not required.

Gender-based analysis plus (GBA+)

The Extension Order will benefit foreign nationals abroad and more particularly those foreign nationals without the means to pay a third party to obtain access to their personal information by way of the Access to Information Act.

Implementation, compliance and enforcement, and service standards

The Extension Order comes into force on the first anniversary of the day on which it is made.

Collaboration is ongoing with TBS to ensure an effective and efficient implementation. Prior to the coming into force of the Extension Order, TBS will update AORS, the Personal Information Request Form, policy instruments and the statistical reporting forms to align with the Extension Order. As well, TBS will support the implementation of the Extension Order across the access to information and privacy community by developing guidance regarding the processing of personal information requests by foreign nationals and directly engaging federal government institutions to prepare them for the change with respect to the right of access under the Privacy Act.

Work is underway for IRCC to proactively broaden access to personal information, which should remove the need for IRCC clients to seek access through a request under the Privacy Act. However, some initiatives are estimated to take one to two years to implement, given digitally dependent solutions. As such, IRCC is also expected to establish interim solutions. This includes updating its systems to accommodate for increased personal information request volumes, as well as hiring, training and equipping additional staff to address any surge in personal information requests that will stem from broadening access rights.

Government institutions will be required to adhere to the service standards in the Privacy Act, including those relating to access request response timelines.

The Privacy Act provides an independent review mechanism, with the Privacy Commissioner of Canada, for complaints by requesters relating to the exercise of their rights under the Act. This involves an investigation by the Privacy Commissioner of Canada in all matters relating to access to personal information and a right to seek judicial review in matters relating to a refusal to be given access to such information.

In terms of monitoring and reporting on performance, the Privacy Act requires that the head of every federal government institution submit to Parliament an annual report on the administration of the Act within the institution.

Contact

Carolina Mingarelli
Director and General Counsel
Centre for Information and Privacy Law
Department of Justice
284 Wellington Street
Ottawa, Ontario
K1A 0H8
Email: EXT3.usg@justice.gc.ca