What laws govern privacy in Canada?
There’s two sets of federal laws that govern privacy in Canada: the Privacy Act,7 which governs how government agencies can handle our sensitive data, and the Personal Information and Electronic Documents Act (PIPEDA),8 which governs how companies and individuals handle our sensitive data.
The Privacy Act was established in 1983 to define Canada’s laws around how our government and its agencies should govern and protect our privacy, and has never been substantially updated to reflect the digital era. PIPEDA, while newer, is still a law that dates back over two decades, and hasn’t been substantially updated since 2015.9
Why do we need privacy law reform now?
Canada’s privacy laws are decades old, written long before AI, smartphones, and the modern Internet. They fail to reflect the scale and complexity of today’s digital world, leaving Canadians exposed to surveillance,10,11 data breaches,12,13,14 data misuse, and inadequate protections. Current rules offer little accountability, transparency, or independent oversight over how government agencies and corporations collect, use, and share our personal information.
Without meaningful reform, Canadians’ privacy is immensely vulnerable to outdated loopholes, weak enforcement, and the expanding reach of technology that operates far beyond the framework of laws designed in the 20th century. It’s time to update our privacy framework for the realities of the 21st century and ensure that individuals (not corporations or political actors) are in control of their data.
Has the government done anything to strengthen these privacy laws?
Not really. The Privacy Act was established in the 1980s and has seen barely any updates since. Despite thousands of OpenMedia community members taking part in a 2021 survey on how to improve public sector privacy, the government has done nothing to update the Privacy Act.15
There was some hope for modernizing private-sector privacy protections under PIPEDA during the Trudeau era with the proposed Bill C-27.16 However, the bill contained significant omissions and weaknesses—and, most importantly, it never passed. As a result, the promised reforms to Canada’s privacy framework never became law.17
What else is the government doing to our privacy?
The government isn’t standing still; it’s actively pushing bills that put Canadians’ privacy at risk. These laws often claim to serve public interests like security, border control, or protecting children, but in reality, they give corporations and the government even greater access to our personal information while undermining fundamental privacy rights.
- Bill C-2 claims to strengthen borders but expands cross-border surveillance and exposes Canadians’ data to foreign regimes.18,19
- Bill C-8 (like its close doppelganger, the former Bill C-26) frames itself as a cybersecurity measure, but it permits secret government orders to telecoms that can last indefinitely, and new powers to compel telecom providers, banks, and any other federally regulated organizations to weaken encryption or install surveillance capabilities.20,21,22
- Bill S-209 (like its predecessor Bill S-210) purports to protect children but could lead to over-collection of data and even censorship of lawful content.23,24,25
- Part 4 of Bill C-4 outright rejects the voter privacy Canadians have been demanding for years.26
What can you do to protect privacy?
Canadians cannot wait while government and corporate surveillance powers continue to expand at the expense of our privacy. You can make a difference by speaking up to your MP and demanding that your privacy rights, not corporate or political convenience, come first.
We’ve won privacy battles before, and together, we can push for the serious, long-overdue privacy reforms Canadians deserve!
Take action now!