Archived [2022-07-13] - Directive on Personal Information Requests and Correction of Personal Information

1.1 This directive takes effect on October 1, 2018.

1.2 This directive replaces the Directive on Privacy Requests and Correction of Personal Information dated April 1, 2010.

2.1 This directive is issued pursuant to paragraph 71(1)(d) of the Privacy Act.

3.1 The objective of this directive is to establish consistent practices and procedures for processing requests for access to or correction of personal information that is under the control of government institutions and has been used, is used or is available for use for administrative purposes.

3.2 The expected results of this directive are:

• 3.2.1 Effective, well–coordinated and proactive administration of the Privacy Act within government institutions; and
• 3.2.2 Complete, accurate and timely responses to personal information requests and correction of personal information made under the Privacy Act.

4.1 Heads of government institutions are responsible for:

Principles for delegation under the Privacy Act

4.1.1 Respecting the following principles when delegating any powers, duties or functions under the Privacy Act:

• 4.1.1.1. Heads can only designate officers and employees of their government institution in the delegation order: consultants or employees of other government institutions or from the private sector cannot be named in the delegation order;
• 4.1.1.2. Powers, duties and functions are delegated to positions identified by title, not to individuals identified by name;
• 4.1.1.3. Persons with delegated authorities are to be well informed of their responsibilities;
• 4.1.1.4. Delegates cannot further delegate powers, duties and functions that have been delegated to them, although employees and consultants may perform tasks in support of delegates' responsibilities; and
• 4.1.1.5. The delegation order is to be reviewed when circumstances surrounding the delegation have changed. A delegation order remains in force until such time as it is reviewed and revised by the head of the institution; and

Privacy awareness

4.1.2 Ensuring that delegates receive privacy training in the areas outlined in Appendix B of this directive.

4.2 Heads of government institutions or their delegates are responsible for:

Discretion

4.2.1 Exercising discretion in a fair, reasonable and impartial manner after:

• 4.2.1.1. Considering the Act's intent, which is to provide individuals with the right of access to their personal information, and of its limited and specific exemptions;
• 4.2.1.2. Considering the Act's relevant provisions as well as applicable jurisprudence;
• 4.2.1.3. Consulting with government institutions, as necessary, for the processing and disclosure of personal information;
• 4.2.1.4. Reviewing the personal information; and
• 4.2.1.5. Considering, in a fair and unbiased manner, of relevant factors;

Privacy awareness

4.2.2 Ensuring that employees of government institutions and officials who have functional responsibility for the administration of the Privacy Act receive privacy training in the areas outlined in Appendix B of this directive;

Identity of the requester

4.2.3 Establishing procedures to validate the following:

• 4.2.3.1. The identity of the requester;
• 4.2.3.2. The authority of an individual making a request on behalf of another individual; and
• 4.2.3.3. The requester's Canadian citizenship, status as a permanent resident or presence in Canada;

Duty to assist

Protection of the requester's identity

4.2.4 Limiting to a need-to-know basis the disclosure of information that could directly or indirectly lead to the identification of a requester, unless the requester consents;

Principles for assisting requesters

4.2.5 Implementing and communicating the principles for assisting requesters identified in Appendix C of this directive;

Informal processing

4.2.6 Determining whether it is appropriate to process the personal information request on an informal basis. If so, offering the requester the possibility of treating the request informally and explaining that only formal requests are subject to the provisions of the Privacy Act;

Written explanation for extensions

4.2.7 Providing a written explanation to the requester when a request for access to personal information takes more than 30 days to fulfill.

4.2.8 Reporting on the number of and reasons for extensions in the institution's annual report to Parliament.

Processing of privacy requests and correction requests

Tracking system

4.2.9 Establishing and maintaining an internal management system to keep track of personal information requests and correction requests and to document notations when required. This includes documenting the resolution of privacy complaints and reviews by the courts;

Documentation

4.2.10 Documenting the processing of requests by placing on file all created and received paper and electronic documents that supported decisions under the Privacy Act, including communications where recommendations were given or decisions were made;

Revised requests

4.2.11 Documenting, when a request has been clarified or its wording altered, the wording of the revised request and the date of the revision in the tracking system;

Notification of right to complain

4.2.12 Ensuring that requesters are notified of their right to complain to the Privacy Commissioner of Canada for all matters relating to the request, collection and handling of personal information;

Application of exemptions

4.2.13 Invoking applicable exemptions by properly applying the provisions of the Privacy Act. As defined in Appendix A and listed in Appendix D of this directive, exemptions are based either on a class test or an injury test and are either discretionary or mandatory in nature;

Citation of exemptions

4.2.14 Citing all exemptions invoked on the records containing the personal information, unless doing so would reveal the exempted information or cause the injury upon which the exemption is based;

Mandatory consultations

4.2.15 Consulting with the appropriate institutions in all instances involving the application of sections 21, 22 and 23 of the Privacy Act, as specified in Appendix E of this directive;

Requests for correction and notation of personal information

4.2.16 Establishing a process to ensure that any request for correction and any subsequent actions are made in accordance with the Privacy Regulations and are documented; and

4.2.17 Inscribing any correction or notation made to personal information in a manner that ensures it will be retrieved and used whenever the original personal information is used for an administrative purpose. This also involves notifying the individuals and public and private sector organizations that use the information for administrative purposes of any correction or notation made to the personal information.

Monitoring and Reporting

4.2.18 Monitoring and reporting on the requirements of this Directive as specified in the Policy on Privacy Protection.

4.3 Employees of government institutions are responsible for:

Informal access

4.3.1 Recommending to the head or the delegate, when appropriate, that the requested information be disclosed informally;

Search of records

4.3.2 Making every reasonable effort to search records under the control of the government institution to identify and locate the personal information that is responsive to the request; and

Recommendations

4.3.3 Providing valid and request-related recommendations on the disclosure of personal information.

5.1 The roles of other government organizations in relation to this directive are described in section 5 of the Policy on Privacy Protection.

6.1 This directive applies to the government institutions defined in section 3 of the Privacy Act, including parent Crown corporations and any wholly owned subsidiary of these corporations.

6.2 This directive does not apply to the Bank of Canada.

6.3 This directive does not apply to information that is excluded under the Privacy Act.

7.1 Legislation

• Access to Information Act
• Access to Information Regulations
• Canada Evidence Act
• Canadian Charter of Rights and Freedoms
• Financial Administration Act
• Library and Archives of Canada Act
• Official Languages Act
• Personal Information Protection and Electronic Documents Act
• Privacy Act
• Privacy Act Heads of Government Institutions Designation Order
• Privacy Regulations

7.2 Related policy instruments

• Interim Directive on the Administration of the Access to Information Act
• Directive on Privacy Impact Assessment
• Directive on Privacy Practices
• Directive on Social Insurance Number
• Policy on Access to Information
• Policy on Communications and Federal Identity
• Policy Framework for Information and Technology
• Policy on Government Security
• Policy on Information Management
• Policy on Learning, Training, and Development
• Policy on Management of Information Technology
• Policy on Privacy Protection

8.1 Members of the public may contact Treasury Board of Canada Secretariat Public Enquiries for information about this directive.

8.2 Employees of federal institutions may contact their Access to Information and Privacy (ATIP) coordinator for information about this directive.

8.3 ATIP coordinators may contact the Treasury Board of Canada Secretariat's Information and Privacy Policy Division for information about this directive.