Menu
Housing & Communities Planning for the Future Death & Estates Health Older Adults Consumer Protection Non-Profit Organizations & Charities Debts & Credit Government & Government Agencies Courts & Legal Systems Crimes & Fines Victims Resources for Teachers Legal Information for Newcomers Family Law Saskatchewan Workplace Sexual Harassment (SHIFT) About PLEA Contact Us Search

Privacy of Personal Information

There are laws that protect the privacy of your personal information. These laws set out how organizations can collect and use your personal information. When an organization has your information, these laws allow you to access it. You can also file a complaint regarding the handling of your personal information.

When Privacy Laws Apply

For information about the privacy of your health information see Privacy of Your Health Records.

The protection that your personal information receives depends on the type of organization you are dealing with. Different laws apply if the information relates to a governmental or private organization. It is important to determine what type of organization you are dealing with so that you know which laws apply.

The Saskatchewan Information and Privacy Commissioner is responsible for provincial privacy laws. These laws protect your personal information where it is held by:

  • the provincial government and crown corporations, such as SaskTel and SGI
  • libraries, schools and universities
  • municipalities, such as cities, towns and RMs
  • hospitals, doctors and other healthcare institutions and personnel

The Privacy Commissioner of Canada oversees privacy laws that apply across Canada. These laws protect your personal information where it is:

  • held by most federal institutions, such as the Canada Revenue Agency and the Department of Health
  • related to an employee, or an applicant for a job, at a federally regulated employer, such as railways, airlines and banks
  • held by a business for commercial purposes

The Privacy Act is the law that applies to federal government agencies. Not all agencies are covered, however. The Schedule at the end of the Act contains a list of organizations that it applies to.

You can contact the privacy commissioners mentioned above if you need more information or are unsure about a particular organization.

Privacy laws generally do not apply to:

  • individuals who collect, use or disclose personal information for personal or domestic purposes
  • organizations which collect, use or disclose personal information for journalistic, artistic or literary purposes
  • business contact information of an individual that an organization collects, uses or discloses to communicate with the individual
  • non-commercial activities of non-profits and charities
  • political parties
  • the House of Commons, the Senate, the Prime Minister’s Office or Members of Parliament
  • courts

What is Personal Information?

Privacy laws only protect your information if it is personal information. Personal information is information about an identifiable individual. If the information can be linked to an individual then it will usually be personal information. Personal information can be paper or electronic records.

This includes information about your:

  • race
  • national or ethnic origin
  • religion
  • age
  • marital status
  • education or employment history
  • finances
  • identifying numbers, such as your social insurance number or driver’s licence

Examples of personal information a government might collect include a person's:

  • criminal history
  • address
  • fingerprints
  • personal opinions or views unless they are about another individual
  • private or confidential correspondence sent to a government institution

Examples of personal information a business might collect include a person's:

  • e-mail address and messages
  • IP (internet protocol) address
  • income information
  • purchases and spending habits
  • banking information
  • credit or debit card data
  • loan or credit reports
  • tax returns

Examples of personal information an employer might collect include an employee's:

  • performance appraisals
  • internal investigation files
  • complaints against an employee
  • employee number
  • recording of an employee’s voice
  • image, such as through photos and live or recorded video footage
  • salary and benefits
  • personnel files

Information that is not personal information includes information:

  • about government employee's salaries, benefits and employment responsibilities
  • about a licence, permit or other similar benefit government has given an individual
  • that is not about an individual, such as a postal code on its own which covers a wide area with many homes
  • about an organization such as a business
  • that has been made anonymous
  • about a government

Collection of Personal Information

There are rules about when and how organizations can collect personal information.

Government & Government Institutions

Remember, some federal government departments and institutions are not covered by privacy laws.

Government and government institutions cannot collect your personal information unless they need it for one of their programs or activities. Generally, any personal information must be collected directly from you. You can also consent to having your personal information collected in another way.

Businesses & Employers

Remember, only federally regulated employers are covered by privacy laws.

Businesses and employers cannot collect personal information unless it is for a purpose that a reasonable person would consider appropriate in the circumstances. Examples of things that may be considered inappropriate are:

  • tracking personal activities or conversations through a leased laptop's audio or video functions
  • publishing someone’s personal information online with the intent of charging them to remove it

In most situations, businesses and employers must:

  • identify the reasons for collecting your personal information before collecting it
  • have your consent before they collect your personal information
  • limit the amount and type of the information gathered to what is necessary

Businesses can only collect the personal information they need for the transaction in question. If they ask for more information than you think they need you can ask why. You do not need to provide the information if you are not satisfied with the answer. The business should still allow you to complete the transaction.

Protection of Personal Information

Organizations covered by privacy laws must protect your personal information once they have collected it.

Government & Government Institutions

The government and its institutions must take steps to prevent personal information they have collected from being accessed, used, disclosed or modified by anyone unauthorized to do so.

Personal information must be protected from being stolen or destroyed by things like fire or floods. Electronic information must be protected with passwords and firewalls. Policies must be in place to protect personal information, including training of staff that handles personal information.

Businesses & Employers

All businesses and those employers covered by privacy laws must keep your personal information only as long as necessary. They must also protect your personal information against improper access or use. This should include physical measures such as locks, organizational methods such as security clearance and technological measures such as passwords and encryption.

Use or Disclosure of Personal Information

Under privacy laws, organizations can only use your personal information for the reason it was collected. There are several exceptions to this, however, such as:

  • if you consent
  • for police investigations
  • to comply with a subpoena or warrant
  • to collect a debt you owe
  • in an emergency

These are only some of the reasons that an organization may use or disclose your information. If you are unsure about a particular situation, contact the relevant privacy commissioner.

Accessing Your Personal Information

You have the right to see your personal information.

You can apply for access to your personal information by contacting the organization that has the information. Remember, not all government institutions, businesses and employers are covered by privacy laws.

The first step is to determine the information you want and the name of the organization that has the information. To make a request for access:

Organizations covered by privacy laws should have a designated contact for access requests.

A government institution, business or employer generally has 30 days to respond to an access request.

There is no charge for accessing your personal information held by the federal government. Provincial government institutions, businesses and employers can only charge you a minimal fee. You must be told the approximate cost up front and agree to proceed with that cost.

You do not have the right to paper copies in all cases. Sometimes, you may have to go to an office and look at your information there.

Members of Saskatchewan's Legislative Offices are covered by privacy laws, but you cannot request copies of your personal information from them or ask that it be corrected. Members of Parliament and Senators are not covered by privacy laws.

Correcting Your Personal Information

You can use the Record Correction Form for corrections related to a federal government institution covered by privacy laws.

If you have accessed your personal information, you can request that it be corrected if any of the information is incorrect. The government institution can make the correction or make a note on the file that a correction was requested but denied.

Businesses must correct your personal information if you can prove that what they have is incorrect. If the business and you cannot agree, your concerns must be recorded.

Personal Information Complaints

In Saskatchewan, it is an offence to knowingly collect, use or disclose personal information contrary to privacy laws. This can result in a fine of up to $50,000 and a year in jail.

If you are concerned about privacy or access to your personal information, you should start by trying to resolve your issue directly with the organization that has the information.

If you still have an issue with privacy or were denied access to your personal information and:

  • it relates to a provincial government institution or municipality, you can file a complaint with the Saskatchewan Information and Privacy Commissioner
  • it relates to a federal government institution, an employer covered by privacy laws or a business, you can file a complaint with the Privacy Commissioner of Canada

The commissioner will try to resolve the complaint. If it cannot be resolved, they will investigate and may make recommendations. If the organization does not follow the recommendations, the matter can be brought to court. The court may then make orders forcing the organization to comply.

It is an offence for a business or employer covered by privacy laws to:

  • destroy personal information that has been requested
  • not report a breach that puts individuals at a real risk of significant harm
  • fail to keep a record of a privacy breach
  • obstruct the Commission in an investigation

If found guilty, these offences can result in a fine of up to $100,000.

How helpful was this article?

PLEA offers free online training on preventing and addressing workplace harassment.

Workplace Harassment Prevention Training

CHECK IT OUT We're here to help.

Housing & Communities

Planning for the Future

Death & Estates

Health

Older Adults

Consumer Protection

Non-Profit Organizations & Charities

Debts & Credit

Courts & Legal System

Government & Government Agencies

Crimes & Fines

Victims

About PLEA

PLEA gratefully acknowledges our primary core funder the Law Foundation of Saskatchewan for their continuing and generous support of our organization.