Canada Proposes Major Privacy Law Overhaul to Enable Easier Data Sharing Across Agencies

The federal government of Canada has unveiled a sweeping proposal to modernize its decades-old Privacy Act, aiming to make it easier for government institutions to share and reuse citizens’ personal data while strengthening accountability and transparency.

First introduced in 1983, the Privacy Act governs how federal bodies collect, use, and disclose personal information. However, officials now argue that the law has failed to keep pace with the demands of a digital, interconnected era.

According to a newly released policy paper, current rules often require explicit consent before personal data can be reused or shared across departments unless specific legal exceptions apply. While these safeguards were designed to protect privacy, the government says they now create barriers to delivering efficient and integrated public services.

Under the proposed changes, federal agencies would be allowed to share and reuse personal data without obtaining consent, provided strict conditions are met. These include limiting data use to what is necessary, ensuring minimal intrusion, and implementing strong security protections. Citizens would still be informed through clear and accessible privacy notices published in a centralized registry.

The reform package also emphasizes stronger individual rights. The government is considering formally recognizing privacy as a fundamental right and introducing mandatory privacy impact assessments when programs use personal data to make decisions about individuals. Additionally, departments would be legally required to notify affected individuals in the event of a data breach.

A key focus of the overhaul is addressing the growing use of artificial intelligence and automated decision systems in public services. Officials acknowledge that while such technologies can improve efficiency, they also raise concerns about transparency. The proposal would give individuals the right to request explanations of how automated systems influenced decisions and what personal data was used. Citizens could also seek human reviews if they believe an automated decision was flawed.

The government is also looking to simplify how Canadians access their personal information. Currently, requests are split between the Access to Information Act and the Privacy Act, often leading to confusion and delays. The new plan would consolidate personal data requests תחת a single system under the access law, creating a more streamlined process.

Another important aspect of the proposal addresses Indigenous data governance. The government acknowledges that Indigenous communities have unique perspectives on data ownership and privacy. The updated law aims to support Indigenous self-determination, potentially allowing shared stewardship of data between communities and federal institutions.

Public feedback on the proposed reforms will be accepted until July 10 through an online consultation process. The government also plans to engage with experts and stakeholders in the coming months, with a final report expected in the winter of 2026–27.

The proposed overhaul represents one of the most significant updates to Canada’s privacy framework in over four decades, reflecting the growing need to balance efficient service delivery with the protection of personal data in an increasingly digital world.