False claims about Canada's rules on personal data spread online

When the Canadian government collects personal data it is required to disclose how the information will be used and stored via Personal Information Banks (PIBs). Social media users are saying the process is new and nefarious, but such claims are misleading. PIBs have been in use for more than 40 years and are required by a Privacy Act, with federal agencies overseeing the process.

"We were not consulted nor informed about the creation or existence of these databases and they are being collected without our permission or knowledge," says the text of an April 7, 2024 X post from retired hockey player Theo Fleury, who has previously spread misinformation.

The post alleges that PIBs are databases surreptitiously created by the government to store biometric, biographical and financial information.

The text appears to be copied and pasted from an email chain, with near word-for-word posts found on Facebook and Instagram, sometimes ending by encouraging people to send a letter of protest instead of filing tax returns.

However, the Office of the Privacy Commissioner (OPC), which oversees the protection of personal information in Canada, said PIBs are not new as claimed online. They have been a requirement under the Privacy Act since it was introduced in 1983 (archived here).

Teresa Scassa, the Canada Research Chair in Information Law and Policy at the University of Ottawa (archived here), said the Privacy Act requires agencies to annually publish updated lists of all PIBs.

"It is inevitable," that the government will need to collect personal data on its citizens, she said in an email, and PIBs are designed to disclose what information is held by which institution and for what purpose in accordance with the Privacy Act.

OPC spokeswoman Tobi Cohen also said PIBs are intended to be a transparency tool, disclosing the categories and purpose of information collected by government agencies.

"PIBs do not contain personal information that can be searched for or accessed online, rather PIBs explain where personal information may reside in government records," Cohen said in an April 12, 2024 email.

"Someone who would like to request access to the personal information that the organization holds, may reference the PIB when making a request."

Cohen said that contrary to the online claims, PIBs do not create means for the government to collect personal information without consent.

PIBs examples

The Treasury Board of Canada Secretariat (TBS) is responsible for policy concerning the operation of the Privacy Act, including PIBs.

Some of the social media posts lead to the TBS site describing standard PIBs maintained by most government institutions (archived here) which mentions biometrics and medical information as category examples, along with language, citizenship status and date of birth.

The TBS website also includes a page which links to institution-specific PIBs, describing the information these agencies collect and how it is stored (archived here).

For example, Elections Canada describes the purposes of retention of voter registration and identification information so eligible voters can cast their ballot (archived here).

The Canada Revenue Agency -- the country's tax administrator -- lists a PIB for the one-time top-up to Canada Housing. Agreeing to having data, including financial information, stored is required to access this benefit, as mentioned in the posts on social media. But the agency says the personal information is only used to determine eligibility for the benefit and will be destroyed after six years (archived here).

If the government needs to share personal information with another department, it can only do so under conditions outlined in the Privacy Act, Cohen said in an April 15 email.

However, she said exceptional cases related to law enforcement or national security may involve transfer or collection of personal information without prior consent.

Oversight of PIBs

When agencies are not correctly disclosing PIBs, a complaint can be filed with the OPC.

In one such case (archived here), the commissioner found the country's transportation agency, Transport Canada, had not published the PIB for a zero-emissions vehicle incentive before launching the program (archived here).

The OPC found the agency failed to submit the information to TBS and after it did so, an administrative backlog kept it from being approved for nearly four years after the program start date. The PIB has since been approved and published (archived here).

Read more of AFP's reporting on misinformation in Canada here.