On April 2, 2026, the Government of Canada announced its launch of the review of Canada’s Federal Privacy Act (the “Act”). Enacted in 1983, the Act governs how federal institutions handle personal information. However, despite over four decades of technological advancements and shifts in how personal data is collected and used, the Act has not been substantially updated since it came into force.
Although the Act has not seen a meaningful reform since 1983, its need for modernization has been a topic of ongoing discussion since 2016. Multiple reports and recommendations from bodies including the Standing Committee on Access to Information, Privacy and Ethics and the Office of the Privacy Commissioner of Canada, as well as consultations led by Justice Canada have all pointed to the need for reform.
This time around, it is the Treasury Board of Canada Secretariat (TBS) that has launched a public consultation on the Act. TBS has published a discussion paper which outlines the areas of focus for the review. In it, TBS states it is seeking feedback on potential policy approaches to:
- enable better services to Canadians;
- strengthen privacy protections for the digital age; and
- update the foundation and oversight of the federal government privacy regime.
The paper organizes recommendations for reform into six themes, namely: (1) enabling integrated services; (2) enhancing accountability and transparency; (3) advancing safeguards across the spectrum of data sensitivity; (4) modernizing the foundation for privacy and trust; (5) Indigenous peoples’ access to, and protection of, their data; and (6) updating the compliance framework. Neither the themes nor related policy approaches are exhaustive or definitive.
There are several interesting and important recommendations for reform outlined in the discussion paper. For instance, the proposed reforms recognize that different types of data should be subject to different management requirements based on their level of sensitivity and identifiability. There are proposals to make privacy impact assessments and breach notification requirements legal requirements instead of a policy requirements, introduce transparency requirements for the use of artificial intelligence and automated decision systems, enable secure personal data sharing across multiple government departments where it directly benefits individuals or serves a public interest, and consolidate access to information requests by moving provisions relating to such requests from the Privacy Act to the Access to Information Act.
Notably, the proposed reforms also consider updating the Act to recognize privacy as a fundamental right, include mechanisms to support Indigenous data sovereignty, and strengthen compliance through measures such as new penalties, granting the Privacy Commissioner order-making powers, among other changes.
Taken together, these proposed reforms signal a long-overdue effort to bring Canada’s federal privacy framework in line with today’s data-driven world. The consultations are open until July 10, 2026, with a final report consolidating the findings expected for publication in the Winter of 2026-27.
Any article or other information or content expressed or made available in this Section is that of the respective author(s) and not of the OBA.