Privacy Act Access Extended to Foreign Nationals Abroad

Summary#

The Canada Gazette published Privacy Act Extension Order, No. 3, which extends who can ask federal institutions for access to their personal information under the Privacy Act. The order was made on July 13, 2021 and comes into force on the first anniversary of that day (so on July 13, 2022).

What it does#

• Extends the right to request access to personal information under subsection 12(1) of the Privacy Act to all individuals outside Canada who did not already have that right.
• Allows those individuals to use related rights under subsection 12(2) (for example, to ask for corrections to their personal information).
• Does not remove or reduce rights that Canadians, permanent residents, or people physically in Canada already have.
• Requires federal institutions and the Treasury Board of Canada Secretariat to update online request systems and forms before the order comes into force.
• Agencies such as Immigration, Refugees and Citizenship Canada are expected to change how they handle and staff request processing.

Who's affected#

• Foreign nationals who are outside Canada and who want access to personal information held by the federal government (for example, visa or immigration applicants).
• Federal departments and agencies that hold personal information, especially Immigration, Refugees and Citizenship Canada, which handles a large share of privacy requests.
• Third-party firms and paid services that currently make Access to Information requests on behalf of non-Canadians.
• The Privacy Commissioner of Canada, since those newly covered people will be able to file complaints about access or correction decisions.

Why it matters#

• People outside Canada will be able to see and ask to correct their federal personal records directly, instead of paying or relying on an agent.
• It brings the federal privacy law more into line with domestic and international norms (for example, EU and UK rules), which may make data sharing with other countries easier.
• It is likely to increase the number of privacy requests to federal departments. For context, Immigration, Refugees and Citizenship Canada received close to 130,000 access requests in 2020–2021, and about 99% of its requests are for personal information — so the operational impact could be significant.
• Some departments plan to broaden proactive access and improve systems, but those changes may take 1–2 years, so there could be short-term pressure on processing times and resources.