Menu
Housing & Communities Planning for the Future Death & Estates Health Older Adults Consumer Protection Non-Profit Organizations & Charities Debts & Credit Government Agencies Courts & Legal Systems Crimes & Fines Victims Covid-19 & The Law Resources for Teachers Legal Information for Newcomers Family Law Saskatchewan Workplace Sexual Harassment (SHIFT) About PLEA Contact Us Search

Privacy of Personal Information

There are laws that protect the privacy of your personal information. These laws determine when your person information can be collected and used, how it must be protected and provide people with the right to access their personal information.

This information deals with personal information other than health information. For information about the privacy of health information see Privacy of Your Health Records.

Privacy laws are complex. Below is a summary of these laws. If you need specific information or have a privacy concern contact the Office of the Saskatchewan Information and Privacy Commissioner if your concern is about the provincial government or a provincial government institution. If you have a privacy concern about the federal government, a federal government institution, a business or a federally regulated employer contact the Office of the Privacy Commissioner of Canada.

When Privacy Laws Apply

People and organizations that privacy laws do not apply to include:

  • Individuals
  • Non-Profits
  • Charities
  • Political Parties & Associations
  • Organizations that collect, use or disclose personal information solely for journalistic, artistic or literary
  • Courts

Privacy laws apply to your personal information held by:

  • provincial government and its institutions
  • municipal governments and their institutions
  • some federal government departments and institutions
  • crown corporations
  • businesses
  • federally regulated employers

To find out if privacy laws apply to the federal government body you are dealing with see Schedule 3 of the Privacy Act.

Examples of federally regulated employers include railways, and airlines.

Examples of entities covered by privacy laws include:

  • Cities
  • Universities
  • Libraries
  • Boards of Education
  • Canada Revenue Agency
  • Canada Employment Services Commission
  • Many federal government departments such as Finance, Justice and Health
  • Banks
  • Television or Radio Stations
  • Retail or Online Stores
  • Service providers such as Restaurants, Movie Theatres & Car Rental Companies

What is Personal Information?

Information that is not personal information includes information:

  • about government employee's salaries, benefits and employment responsibilities
  • about a licence, permit or other similar benefit government has given an individual
  • that is not about an individual (for example, a postal code on its own which covers a wide area with many homes)
  • about an organization such as a business
  • that has been made anonymous
  • that is person’s business contact information used to communicate with that person about their business
  • about a government

Privacy laws only protect your information if it is personal information. Personal information can be information in paper or electronic records. Any information about an identifiable individual is considered personal information.

This includes information about your:

  • Race, national or ethnic origin
  • religion
  • age
  • marital status
  • education or employment history
  • finances
  • identifying numbers such as your social insurance number, or driver’s licence

Examples of personal information a government or government institution might collect include a person's:

  • criminal history
  • address
  • fingerprints
  • personal opinions or views unless they are about another individual
  • private or confidential correspondence sent to an government institution

Examples of personal information a business might collect include a person's:

  • e-mail address and messages, IP (Internet protocol) address
  • income information
  • purchases and spending habits
  • banking information
  • credit/debit card data
  • loan or credit reports
  • tax returns

Examples of personal information an employer might collect include an employee's:

  • performance appraisals
  • internal investigation files
  • complaints against an employee
  • employee number
  • recording of an employee’s voice
  • video footage or live-feed of the employee
  • salary & benefits
  • personnel files

Collection of Personal Information

There are rules about when personal information can be collected and how it can be collected.

Government & Government Institutions

Remember some federal government departments and institutions are not covered by privacy laws.

Government and government institutions cannot collect your personal information unless they need it for one of their programs or activities. Generally any personal information must be collected directly from you. You can consent to having your personal information collected in another way. There are some exceptions.

Businesses & Employers

Remember only federally regulated employers are covered by privacy laws.

Businesses and employers cannot collect personal information unless it is for a purpose that a reasonable person would consider appropriate in the circumstances. Some things that are generally considered inappropriate are:

  • Using the audio or video recording functions of someone’s phone or other electronic device to track the person’s activities, conversations etc.
  • Publishing someone’s personal information with the intent of charging them to remove it.

Businesses and employers must identify the reasons for collecting your personal information before or at the time of collection. They must have your consent before they collect your personal information. They must limit the amount and type of the information gathered to what is necessary.

Businesses can only collect the personal information they need for the business transaction in question. If they ask for more information than you think they need you can ask why and not provide the information if you are not satisfied with the answer. You should still be able to complete the transaction, even if you refuse to give out more personal information than you think is needed.

Protection of Personal Information

Provincial government and institutions as well as businesses and federally regulated employers are required to protect your personal information once they have collected it.

Provincial Government & Institutions

The provincial government and its institutions must take steps to prevent personal information they have collected from being accessed, used, disclosed or modified by people or institutions that are not authorized.

Personal information must be protected from being stolen or destroyed by things like fire or floods. Electronic information must be protected with passwords and firewalls. Policies must be in place to protect personal information, including training of staff that handles personal information.

Businesses & Employers

Businesses and employers that are covered by privacy laws must keep your personal information only as long as necessary based on the purpose the information was collected for. They must protect your personal information against loss, theft, unauthorized access, disclosure, use or modification by using appropriate security safeguards. This should include physical measures such as locked filing cabinets, organizational methods such as security clearance for access to information and technological measures such as the use of passwords and encryption.

Use or Disclosure of Personal Information

Generally speaking personal information that is protected by privacy laws can only be used for the purpose it was collected for unless the person consents to a different use.

There are a number of exceptions that allow use of your personal information without your consent.

Government and government institutions can use your personal information without your consent for certain things including:

  • law enforcement
  • complying with a subpoena or warrant
  • debt collection (when you owe money to a government or government institution)
  • court cases involving the government

Businesses and employers can also disclose your personal information in some circumstances including when it is needed for a police investigation or in an emergency situation.

Accessing Your Personal Information

You have the right to see your personal information.

You can apply for access to your personal information by contacting the government institution, business or employer that has the information. Remember not all government institutions, businesses and employers are covered.

The first step is to determine the information you want and the name of the government institution, business or employer that has the information.

If it is a provincial government institution you complete an Access to Information Request Form and send it to the government institution. If it is a federal government institution that is covered by privacy laws you complete the Personal Information Request Form.

If it is a business or employer you make the request in writing. Businesses and covered employers should have a designated contact for access requests or privacy concerns.

There is no charge for accessing your personal information in the hands of the federal government or a federal institution that is covered by privacy laws. Provincial government, provincial government institutions, businesses and employers can only charge you a minimal fee for responding. You must be told about the approximate cost up front and agree to proceed with that cost.

You do not have the right to paper copies. In some cases you may have to go their office and look at your information there.

A government institution, business or employers generally have 30 days to respond. If a provincial government office refuses your request you can apply to the Saskatchewan Information and Privacy Commissioner to reviewthe decision. If a federal government institution or employer that is covered by privacy laws or a business refuses you can file a complaint with the Office of the Privacy Commissioner Canada.

Correcting Your Personal Information

If you have accessed your personal information you can request that it be corrected if you feel any of the information is incorrect. The government institution can make the correction or make a note on the file that a correction was requested but denied.

To make this request to a federal government institution covered by privacy laws use the Record Correction Form.

Businesses must correct your personal information if you can prove that what they have is incorrect. If the business and you cannot agree your concerns must be recorded.

Members of Saskatchewan's Legislative Offices are covered by privacy laws but you cannot request copies of your personal information from them or ask that it be corrected. Members of Parliament and Senators are not covered by privacy laws.

Privacy Complaints

Under Saskatchewan law anyone who knowingly collects, uses or discloses personal information held by the provincial government or a provincial government institution contrary to privacy laws can be charged with a summary conviction offence and if found guilty, fined up to $50,000 and be sentenced to up to a year in jail.

If you think a government institution has violated your privacy rights you start by complaining directly to that institution.

If it is a provincial government institution and they do not respond to a written complaint within 30 days or you are not satisfied with their response, you can complain in writing to the Saskatchewan Information and Privacy Commissioner. They will investigate and try to resolve the complaint. If the complaint cannot be settled a report will be issued with findings and recommendations on how to prevent future incidents.

If it is a federal government institution, or employer that is covered by privacy laws or a business you can file a complaint with the Office of the Privacy Commissioner Canada. They will investigate and try to resolve the complaint. They cannot order an institution or business to take any specific action but they can make recommendations. If the complaint is about a business or employer they can publicize their findings.

Is an offence for a business or employer covered by privacy laws to:

  • destroy personal information that has been requested
  • not report a breach that puts individuals at a real risk of significant harm
  • fail to keep a record of a privacy breech
  • obstruct the Commission in an investigation

It is also an offence for an employer to take action against an employee for exercising their privacy rights. Businesses or employers covered by privacy laws can be charged with a summary conviction offence and, if found guilty, fined up to $10,000 or charged with an indictable offence and fined up to $100,000.

How helpful was this article? *

PLEA can provide you with information to help you understand many legal matters you, a family member or friend may be facing.

Have a question?

ASK US We're here to help.

Housing & Communities

Planning for the Future

Death & Estates

Health

Older Adults

Consumer Protection

Non-Profit Organizations & Charities

Debts & Credit

Courts & Legal System

Government Agencies

Crimes & Fines

Victims

About PLEA

PLEA gratefully acknowledges our primary core funder the Law Foundation of Saskatchewan for their continuing and generous support of our organization.