Privacy Principles, Canadian Constitutional Law, and Data Protection Regimes

Vocabulary practice flashcards covering foundational privacy concepts, Canadian constitutional history, the 10 Canadian Privacy Principles, The Privacy Act (1985), and PIPEDA.

Informational Self-Determination

The ability of an individual to control or influence the way in which personal information about them is collected, used, and disclosed, as described by the Information and Privacy Commissioner of Ontario.

Physical Privacy

A class of personal privacy that protects individuals against intimidation, surveillance, physical harm, crime, and loss of freedoms to assemble or express religion; controlled using surveillance limits, facial recognition limits, and GPS/biometric controls.

Informational Privacy (Personal)

A class of privacy that protects personal data against political, commercial, racial, or religious targeting, damaging disclosures, and discrimination through controls over data collection, use, sharing, and retention.

Informational Privacy (Government, Commercial, Corporate)

A class of privacy focused on institutional records that safeguards against excessive secrecy, lack of government accountability, political targeting, insider trading, and unfair hiring; controlled by Freedom of Information laws, ombudsmen, and whistle-blower protections.

Legal or Special Privacy

A class of privacy applying to personal, government, commercial, and corporate entities that protects against the breakdown of solicitor-client privilege, unfair judicial proceedings, and compromised national security; enforced by courts, CSIS, police, and the Ministry of Justice.

Privacy Impact Assessment (PIA)

A structured review and documentation process essential in complex, interconnected IT environments to thoroughly understand data flows and identify privacy risks affecting user data.

British North America Act (1867)

An Act of the British parliament that forms the historical foundation of Canada's Constitution, establishing the Dominion of Canada and granting the federal legislature residual power to legislate on all matters not explicitly assigned to the provinces.

Statute of Westminster (1931)

An Act of the British parliament that placed all Dominions, including Canada, on equal footing with the United Kingdom and marked the beginning of full legislative independence.

Canadian Bill of Rights (1960)

A federal law addressing fundamental freedoms, legal rights, and equality before the law; it had weak legal standing because it applied only to the federal government and held equal footing with any ordinary federal statute.

Canada Act (1982)

An Act of the British parliament that formally patriated Canada's Constitution, eliminated British parliamentary authority over Canada, and established an internal constitutional amending formula.

Constitution Act (1982)

A Canadian parliamentary statute paralleling the Canada Act that assigned residual legislative powers to the federal government and enshrined the Canadian Charter of Rights and Freedoms into the Constitution.

Notwithstanding Clause

A constitutional mechanism established during patriation that permits Canadian federal or provincial governments to override Section 2 and Sections 7 through 15 of the Charter for a maximum term of 5 years at a time.

Section 7 of the Canadian Charter of Rights and Freedoms

The constitutional section providing the right to life, liberty, and security of the person, which offers privacy-like protections in Canadian law.

Section 8 of the Canadian Charter of Rights and Freedoms

The constitutional section guaranteeing the right to be secure against unreasonable search or seizure, providing a primary constitutional basis for privacy protection.

Quasi-Constitutional Status

The special legal status accorded by the Supreme Court of Canada to the federal Privacy Act (1985), indicating that it is near in spirit to the Canadian Constitution and holds paramount legal importance.

Justices of Peace Act (14th Century England)

An early English statute that provided for the arrest of eavesdroppers and 'peeping toms,' representing one of the earliest legal restrictions on privacy violations.

The 'Right to be Let Alone'

The influential formulation of privacy published in the Harvard Law Review in 1890 by Samuel Warren and future US Supreme Court Justice Louis Brandeis.

Hessian Data Protection Act (1970)

A law enacted in Hesse, Germany, widely recognized as the first data protection law in the world.

General Data Protection Regulation (GDPR)

The 2018 European Union regulation that superseded previous privacy directives, requiring demonstrable compliance, introducing a risk-based data protection approach, and invalidating the Safe Harbour and Privacy Shield frameworks.

Data Trusts

Legal and governance frameworks established under the GDPR to ensure that individuals receive fair value in exchange for providing their personal data to commercial entities.

Principle 1: Consent

The Canadian privacy principle requiring an individual's free, specific, and informed permission prior to the collection, use, or disclosure of personal data; consent may be withdrawn at any time and cannot be an unreasonable condition of service.

Principle 2: Accountability

The Canadian privacy principle holding an organization responsible for all PII under its control or transferred to a third party, requiring periodic awareness training and the formal designation of a Privacy Officer.

Privacy Officer

A designated individual within an organization held accountable for compliance with the 10 privacy principles, documenting policies, safeguarding data, and ensuring equivalent protections before transferring data to third parties.

Principle 3: Identifying Purposes

The Canadian privacy principle obligating an organization to explicitly, clearly, and narrowly state the reason for collecting personal data at or before the moment of collection.

Principle 4: Limiting Collection

The Canadian privacy principle mandating that data collection be fair, lawful, and restricted solely to personal information strictly necessary to fulfill the identified purpose, defaulting to anonymized data whenever possible.

Principle 5: Limiting Use, Disclosure, and Retention

The Canadian privacy principle requiring that PII be used or shared only for specified purposes and retained only as long as required to achieve those purposes, followed by secure destruction.

Principle 6: Accuracy

The Canadian privacy principle requiring personal data to be as accurate, complete, and up-to-date as necessary for its intended use ('fit for purpose'), allowing individuals to challenge and amend flawed information.

Principle 7: Safeguards (Security)

The Canadian privacy principle requiring PII to be secured against loss, theft, and unauthorized access via reasonable physical, technical, and administrative controls appropriate to the data's sensitivity.

Principle 8: Openness

The Canadian privacy principle requiring organizations to make policies, practices, and Privacy Officer contact details readily available to the public without unreasonable effort and in an understandable format.

Principle 9: Individual Access

The Canadian privacy principle stipulating that upon request, individuals must be informed of the existence, use, and disclosure of their PII and be granted access to inspect that data.

Principle 10: Challenging Compliance

The Canadian privacy principle providing individuals the right to challenge an organization's adherence to privacy principles by lodging complaints directly with the designated Privacy Officer.

Paramountcy

The legal doctrine in Canadian law establishing that federal legislation takes legal precedence over provincial legislation in situations where both levels of government have enacted overlapping laws.

The Privacy Act (1985)

Canadian federal legislation that regulates how federal government departments, agencies, and parent Crown corporations collect, use, disclose, retain, and dispose of personal information.

Personal Information (under The Privacy Act)

Information about an identifiable individual recorded in any form, including race, national/ethnic origin, religion, age, marital status, medical/criminal/employment history, identifying numbers, fingerprints, address, or blood type.

PIPEDA (Personal Information Protection and Electronic Documents Act)

The 2000 Canadian federal statute governing how private-sector organizations collect, use, or disclose personal information in the course of commercial activities and federal works, undertakings, or businesses.

Substantially Similar Legislation

A provision under PIPEDA allowing the Governor in Council to exempt an organization from PIPEDA's application for intra-provincial activities if the province has enacted private-sector privacy laws that provide equivalent protection.

Digital Privacy Act (2015)

A significant federal legislative enactment that modified PIPEDA to introduce mandatory data breach reporting regulations and specific statutory updates.