Federal privacy law changes would expand sharing of personal data across government

A person works on a spreadsheet in a photo illustration made in Toronto on Monday, Sept. 22, 2025. THE CANADIAN PRESS/Sammy Kogan

OTTAWA — The Liberal government proposes making it easier for federal agencies to share and reuse the personal data of Canadians through a major overhaul of the Privacy Act.

The act governs how federal agencies collect, use and disclose personal information, and gives people the right to see and correct data about them the government holds. The law has not changed substantially since it took effect in 1983.

In a policy paper issued Thursday, the government says that in most cases, reusing personal data or sharing it with another program for an alternative purpose requires the person’s consent or must meet one of the few legal exceptions.

“These rules were designed to protect privacy, but they make it harder to deliver modern, connected services that rely on secure data sharing,” the paper says. “The goal is to make it easier for programs to share data responsibly, so Canadians only have to provide information once.”

The government proposes allowing federal agencies to reuse and share personal data with each other and with their provincial, territorial or municipal partners, without consent, if it improves services or programs.

This would be allowed only when the data is limited to what is clearly required, the reuse and sharing are done in the least invasive way possible and strong safeguards are in place, the policy paper says.

Although consent would not be required, individuals would still be informed of such uses, the paper adds. “This would be done through stronger transparency requirements, including clear, easy-to-understand privacy notices that are published in a central registry before the data is shared or reused.”

The government also suggests bolstering protection by recognizing privacy as a fundamental right and requiring what’s known as a privacy impact assessment when a federal program uses personal data to make a decision about someone.

It also proposes enshrining in law the obligation to notify people of a breach at a federal department or agency that involves personal data.

Another proposal recognizes that the government is increasingly adopting technologies such as artificial intelligence and automated decision systems to improve service delivery.

“While these technologies can improve efficiency and consistency, they raise concerns about transparency and trust,” the paper says.

“Individuals may find it hard to understand how AI or ADS work and what personal data these systems use to make or support decisions. There is no federal legislation in Canada that fills this gap.”

The government proposes amending the Privacy Act to require institutions, upon request, to explain how an automated decision system supported a decision and what personal data was used.

The measure would help people check to see if the data used by the system is accurate and ask for corrections if needed, the paper says.

“People could also ask for a human review of a decision if they believe the ADS made a mistake or used incorrect or incomplete personal data,” the paper says.

The government notes that Canadians currently rely on two separate laws to request information from the federal government: the Access to Information Act for general records and the Privacy Act for their personal information.

“This dual system for access requests can be confusing and inefficient,” the paper says. “Individuals seeking access to their own information often do not know which law applies, and may end up navigating two separate processes, which can lead to delays, incomplete responses, and multiple requests.”

The government proposes removing the personal data request process from the Privacy Act and incorporating it into the access law to create “a more harmonized regime” for requests.

The government says Indigenous Peoples have distinct perspectives and priorities when it comes to data, including the personal data of the members of their communities.

A modernized Privacy Act would aim to support self-determination, meaning Indigenous Peoples could make decisions about their own data in ways that reflect their values and priorities, the paper says.

“This may include shared stewardship with the government of Canada, ensuring Indigenous authority while working together to manage and protect data,” it reads.

Ottawa says comments and feedback on the policy approaches will be collected through an online submission form until July 10.

It also promises consultation meetings with federal institutions and subject matter experts over the coming months, with a report on the overall findings to be published in the winter of 2026-27.

This report by The Canadian Press was first published April 2, 2026.

Jim Bronskill, The Canadian Press