Proposed Privacy Act reforms and the data of Indigenous Peoples of Canada

In this post I return to my series on proposed reforms to the federal Privacy Act. The deadline for submissions to the consultation on the proposal is July 10, 2026, so I encourage those of you who have opinions on reform issues to be sure to participate before this deadline. Details on how to participate can be found here. My previous posts on the discussion paper can be found here, here, here, here, here, here, and here.

Theme 5 of the discussion paper on proposed reforms to the federal Privacy Act contains recommendations relating to Indigenous personal data. My post considers these, although I preface this discussion with the caveat that I do not presume to speak for First Nations, Inuit and Métis (FNIM) Peoples on these issues, and that I hope and expect that the government is exploring these ideas through meaningful consultation and engagement. I note as well that the proposals in the discussion paper touch on only some of the issues raised in a more comprehensive study of Canada’s privacy and access to information regimes by the First Nations Information Governance Centre (FNIGC). I note as well that this FNIGC study emphasizes the need to take a comprehensive approach to reform of the Privacy Act, the Access to Information Act and the Personal Information Protection and Electronic Documents Act (PIPEDA) when it comes to data sovereignty issues. It is clear that this has not occurred. For example, Bill C-36 – a bill to reform PIPEDA – currently before Parliament is entirely silent as to Indigenous data sovereignty concerns.

The stated goals of the proposed reforms are to “support self-determination, meaning Indigenous Peoples can make decisions about their own data in ways that reflect their values and priorities, both as individuals and communities.” This forms part of the government’s commitment to reconciliation, as well as to Indigenous self-determination, as reflected in the United Nations Declaration on the Rights of Indigenous Peoples Act (UNDRIP Act). The UNDRIP Act Action Plan (2023-2028) identifies Indigenous Data Sovereignty as a cross-cutting and shared priority, and sets out the government’s commitment to:

Continue to support Indigenous Data Sovereignty and Indigenous-led data strategies through legislative, regulatory and policy options to help ensure that First Nations, Inuit, and Métis have the sufficient, sustainable data capacity they need to control, manage, protect, and use their data to deliver effective services to their peoples, tell their own stories, participate in federal decision-making processes on matters that impact them, and realize their respective visions for self-determination. This should include nation-to-nation, Inuit-Crown, and government-to-government approaches to streamline timely sharing and access to federal data and information holdings with Indigenous partners, while respecting the privacy of individuals. This will support Indigenous jurisdiction over their data, and enable Indigenous-led survey and other data collection strategies, such as for the purpose of processing claims; facilitating decision-making; and for genealogical research.

There are three main proposals regarding the data of Indigenous Peoples in the discussion paper. The first (Proposal 16) relates to updating the language used in existing provisions of the Privacy Act to make the Act more responsive. Section 8 of the Privacy Act governs the circumstances in which the federal government can disclose (share) data. Paragraphs 8(2)(f) and 8(2)(k) have particular relevance for FNIM peoples. Paragraph 8(2)(f) allows data sharing “for the purpose of administering or enforcing any law or carrying out a lawful investigation”. It requires an agreement to be in place between the federal institution holding the data and the recipient government. Currently, subparagraphs under s. 8(2)(f) list specific Indigenous governing bodies in Canada, or ones belonging to certain categories defined in legislation or agreements. What is proposed is to expand the list to include “Indigenous entities that have signed a self-government agreement”.

Paragraph 8(2)(k) enables data sharing with “any aboriginal government, association of aboriginal people, Indian band, government institution or part thereof, or to any person acting on behalf of such government, association, band, institution or part thereof, for the purpose of researching or validating the claims, disputes or grievances of any of the aboriginal peoples of Canada”. The proposal would be to revise this to enable sharing with “an Indigenous government or Indigenous organization”, with ‘Indigenous organization’ defined as “an Indigenous governing body or any other entity that represents the interests of an Indigenous group and its members.”

Section 19(1) of the Privacy Act places an obligation on federal institutions to protect the confidentiality of any information that they receive in confidence from another government. Several paragraphs in this section identify specific FNIM governments. Proposal 16 of the discussion paper would expand this list to include “Indigenous entities that have signed a Modern Treaty or a self-government agreement.”

Overall, the relatively modest goals of Proposal 16 are to broaden the scope of these provisions relating to disclosure or confidentiality, and to allow them to include new Indigenous governments as the need arises without need for legislative amendment. The proposal notes that in keeping with the ongoing nature of the reconciliation process, it might be necessary to reevaluate these provisions in subsequent mandated reviews of the Privacy Act.

Proposals 17 and 18 address a more fundamental change to the Privacy Act – one designed to further Indigenous Data Sovereignty by better enabling Indigenous governments to access the data about their citizens that they need to deliver services and simply to provide essential data for self-governance purposes. Finding a pathway is challenging. The Privacy Act sets out rules to govern the protection of personal information of all Canadians in the hands of the federal government. Proposals 17 and 18 seek to create a way for Indigenous governments to access the data of their citizens within the broader data protection framework. Part of the challenge here is, as the FNIGC notes in their paper on PIPEDA and First Nations, that “the individual focus of privacy law [. . . ] might be in conflict or tension with some First Nations norms” (at p. 16). The document goes on to note that privacy law reflects “cultural and political choices regarding the nature of the value of privacy and how it should be balanced against other important values”(at p. 17).

One challenge in this context is not just knowing which data collected by federal institutions are about FNIM peoples but also knowing with which particular FNIM governments those individuals are linked. Different federal institutions may have different data collection and labelling practices, so there are likely to be inconsistencies. Proposal 17 floats the idea of creating “Indigenous personal data” as a specific category of data with its own governance rules. Going forward, when data is collected for certain “key” programs, data subjects would have the choice to designate their data as Indigenous personal data and link it to a particular Indigenous government. There are a couple of things here to consider. First, the proposal addresses “key programs”. At least in the initial stages it is clear that this option would be available only in relation to particular programs – presumably these would be determined through a consultation process. Second, the labeling of data as Indigenous personal data and its linkage to a particular Indigenous government would be a matter of choice and consent for the data subject. Consent in this instance ensures that the basic Privacy Act protections remain in place across the board, and it also addresses the autonomy of individuals in a context in which there may well be a profound lack of trust regarding sharing Indigenous identity with government institutions. It is an individual choice and not a requirement. Of course, leaving it as a choice will impact the quantity and quality of any data ultimately shared with Indigenous governments – potentially quite significantly. A third point to note is that the proposal is forward-looking. It does not contemplate the sharing of already collected data.

The proposal is silent as to how it will be carried out. It might be important to include within any such legislated framework a requirement for the development of a standard (or standards) for the collection of Indigenous personal data. Any such standard development would, of course, have to be in consultation with FNIM Peoples. A standard would ensure that there are a set of rules and processes that respect FNIM peoples’ values and concerns, while also ensuring consistency of approaches across the whole of the federal government. There has been some work done on data collection standards around the disaggregated data of FNIM peoples at the provincial level. For example, a standard has been developed under BC’s Anti-Racism Data Act that offers a useful example of how a set of rules/principles around data collection could be developed. Ontario has established standards by Order in Council in relation to its Anti-Racism Act. A revised Privacy Act could contain a provision requiring the establishment of standards, in consultation with FNIM Peoples, for the collection of Indigenous personal data.

Proposal 18 addresses how Indigenous personal data would be transferred to the relevant Indigenous governments. The proposal indicates that one option would be the negotiation of data sharing agreements to facilitate routine sharing with Indigenous governments of “copies of personal data about their citizens from key programs”. The wording emphasizes that the scope of sharing will be limited to “key programs”, and that this is not a transfer of all data, but rather the sharing of a copy of data that is also collected and used by the federal government for its own service delivery purposes. The data sharing agreement would set out the obligations on both sides and would make it clear that Indigenous governments in receipt of shared data would have responsibilities for safeguarding the data. The proposal also considers establishing a public registry of these data sharing agreements “to support transparency and consistency across programs”. This transparency point is important – so important that I would remind Treasury Board Secretariat that similar transparency requirements should also be in place for the data sharing that is contemplated between federal government institutions and international, provincial and even municipal governments under a modernized Privacy Act.

If no data sharing agreement is in place between an Indigenous government and the federal government, the proposal suggests that it would be ‘business as usual’, with disclosure taking place under the existing provisions of s. 8(2) of the Privacy Act (discussed above). On this point, one issue that is unclear to me is whether any data shared in this way would also include Indigenous personal data labelled as such. In other words, would the disaggregated Indigenous personal data be collected (with individuals self-identifying and linking themselves to specific Indigenous governments) only after a data sharing agreement is in place, or would this take place as a matter of course, leaving some individuals self-identifying in a context in which there is no data sharing agreement.

Overall, these proposals recognize the importance of data to Indigenous self-determination and respond, at least partially, to the growing Indigenous Data Sovereignty movement. At the same time, they reflect the complexity, risks and challenges of both disaggregated data collection and the sharing of this information. However, what is proposed here seem like only tentative first steps in a broader reform of information management with respect to FNIM peoples, and it will be important to recognize them as such in a much longer, consultative journey. Addressing Indigenous Data Sovereignty will require much more concerted work than tweaks to the federal Privacy Act. As the FNIGC states:

The Crown assumes ownership of all First Nations data and information in its control and makes decisions about how to use, share, or dispose of that data through unilateral decision‑making processes. Canada’s information management regime is in breach of the Crown’s moral and legal obligations to respect First Nations rights to self‑determination and self‑government. A system‑wide, First Nations driven overhaul is required to accommodate First Nations data sovereignty premised on a Nation‑to‑Nation relationship.” (FNIGC Exploration at 2).