OpenMedia Survey: Tell Ottawa How to Fix the Privacy Act

Section A: You and your data

Before we get into the specifics, we want to understand where you're starting from — how you feel about the way the federal government handles your personal data today.

How much do you trust the federal government to handle your personal information responsibly?

(Choose one answer)

What most shapes your level of trust (or distrust) in how the government handles your data?

(Select all that apply)

Government data breaches and security incidents.

Government use of AI to make decisions about people.

Lack of transparency about what data is collected and how it's used.

My data being shared without my knowledge.

Positive or negative experiences with government services.

The operations of the federal Privacy Commissioner, the independent watchdog that investigates breaches of the Privacy Act.

None of the above.

What would increase your trust in how the federal government handles your personal data?

(Select all that apply)

Enforcement – stronger laws with real consequences when rules are broken.

Transparency – easy visibility into what data is collected and how it's used

Consent – my approval required before my data is collected or shared.

Control – the ability to access, correct, or delete my data at any time.

Independent oversight – a strengthened body outside the government overseeing data practices.

Accountability – a proven track record of responsible behaviour over time.

None of the above.

Section B: Data sharing across government

Sharing data across government departments can make public services faster and more seamless. But it also carries real risks: it can happen without your knowledge, and for purposes you never agreed to. We want to know what principles should guide how your data is shared, and how you should be kept informed.

4. How comfortable are you with federal government departments sharing your personal data with each other to improve public services?

(Choose one answer)

5. If a government department were to share your personal data with another department or level of government, what should be required?

(Select all that apply)

Consent – my explicit consent before any sharing takes place.

Oversight – an independent body overseeing and approving the sharing.

Purpose limitation – a clear public interest or direct benefit to me as the reason for sharing.

Data minimization – a strict limit on what data is shared and for what purpose.

Public record – a transparent log of what was shared, with whom, and why.

Technical safeguards – encryption and security controls that prevent unauthorized access during sharing.

Privacy by design – systems built from the ground up to minimize data exposure, not just policies added after the fact.

Auditability – technical logs that allow independent verification of how data was accessed and used.

None of the above.

6. If your data is shared or reused by the government, what tools or mechanisms should exist to give you visibility and control over your personal data held by the government?

(Select all that apply)

Personal portal – a secure online space where I can see, download, correct errors, and track who has accessed my data

Direct notification – a personal notice sent to me whenever my data is shared or accessed.

Public registry – a publicly accessible log of government data holdings and sharing practices.

Independent audits – regular reviews by a body outside government, with findings published publicly.

None of the above.

Section C: AI and automated decisions

Federal departments already use AI and automated systems to make decisions that affect your life — from benefit eligibility to immigration applications.³ These systems may be faster and more consistent, but they can also reflect bias, make errors, hallucinate, and operate in ways that are hard to understand or challenge. We want to know what rights and accountability measures matter most to you when it comes to government use of AI.

7. What should you have the right to know when an AI or automated system is used to make a decision about you?

(Select all that apply)

Full explainability – a plain-language explanation of what data was used and how the conclusion was reached.

Meaningful transparency – a general summary of how the system works, without every technical detail.

Impact assessment – a formal review of the privacy risks of the AI system, conducted before it's used and made publicly available.

Disclosure – that AI was involved in the decision that affected me.

Outcome only – what decision was reached is sufficient; how it was reached is an internal matter.

None of the above.

8. When an automated system makes a decision that affects you, what should you be able to do about it?

(Select all that apply)

Universal right to human review – the right to request a human review for any automated decision.

Rights-based threshold – the right to human review when a decision affects my access to services, benefits, or rights.

Judicial recourse – the right to challenge the decision in court, with access to all data and reasoning used.

System-level assurance – if the AI system is independently certified as fair and accurate, no individual recourse should be necessary.

None of the above.

9. How should the government be held accountable for the AI systems it uses?

(Select all that apply)

Radical transparency – mandatory public disclosure of all AI systems in use, including their purpose, data sources, and bias testing results.

Independent audit – regular audits by a body outside government, with findings published openly.

Open source – government AI code should be publicly available for independent scrutiny.

Parliamentary oversight – internal reviews by a dedicated committee, reported annually to Parliament.

Technical accountability – mandatory logging and monitoring of AI decisions, accessible to oversight bodies.

None of the above.

Section D: Oversight and accountability

When the government mishandles your personal data, who holds them to account — and what actually happens? Right now, oversight of federal privacy practices sits largely within the government itself, and the consequences for breaking the rules are limited. We want to understand what accountability looks like to you.

10. Who should be responsible for making sure the federal government follows privacy law?

(Choose one answer)

11. When a government program collects or uses your personal data, what should be required before it goes ahead?

(Select all that apply)

Mandatory scope – the law should spell out exactly what a privacy impact assessment must cover, not leave it to government policy.

Formal risk assessment – a privacy impact assessment conducted before the program launches, not after.

Plain language disclosure – a public summary of the assessment in language anyone can understand.

Independent review – the assessment reviewed and approved by a body outside the department.

Ongoing monitoring – regular reviews after launch to catch new risks as the program evolves.

None of the above.

12. When a government department breaks privacy law, what should happen?

(Select all that apply)

Fines – significant financial penalties imposed on the department.

Compensation – money paid directly to the people whose data was mishandled.

Mandatory correction – a legally binding plan to fix what went wrong, monitored independently.

Public disclosure – the government must openly explain what happened, who was affected, and what is being done about it.

Personal consequences – senior officials responsible face professional sanctions, such as demotion, suspension or removal from office.

Criminal liability – in serious or willful cases, responsible officials could face criminal charges and potential imprisonment.

None of the above.

13. If your personal data is exposed as a result, what should you be entitled to?

(Select all that apply)

Timely notification – a direct personal notice within a fixed deadline, such as 72 hours.

Full disclosure – a clear explanation of what data was exposed, how, and what risks it creates for me.

Compensation – financial remedy paid directly to me for any harm caused.

Right to appeal – the ability to challenge how my case was handled and seek further remedy independently.

None of the above.

Section E: Your vision for the Privacy Act

After everything you've considered, tell us what you think should be guaranteed, and anything the government should hear that we haven't asked about yet.

14. Which of these rights do you feel should be guaranteed in law?

(Select all that apply)

Right to access – see what data the government holds about me, in plain language.

Right to correction – correct inaccurate information and know if it affected a decision about me.

Right to explanation – know when AI was involved in a decision that affected me.

Right to human review – request a human, not an algorithm, to review a decision about me.

Right to breach notice – be notified promptly if my data is exposed.

Right to legal remedy – challenge government data practices in court with real consequences.

Right to deletion – request that data no longer needed about me be deleted.

None of the above.

15. Is there anything else you'd like the government to consider in this reform, or anything you feel hasn't been covered?

OpenMedia Survey: Tell Ottawa How to Fix the Privacy Act

Section A: You and your data

Section B: Data sharing across government

Section C: AI and automated decisions

Section D: Oversight and accountability

Section E: Your vision for the Privacy Act

Want to learn more?

Stay ahead of the changes.