Philippe Dufresne: Canada Privacy Act Modernization Submission Filed

• Canada's Privacy Commissioner, Philippe Dufresne, submitted recommendations on August 6, 2026, for modernizing the federal Privacy Act.
• He supported government proposals like recognizing privacy as a fundamental right and mandating breach reporting.
• Dufresne also proposed new measures, including a legislative requirement for privacy impact assessments for high-risk activities.
• Further proposals include strengthening enforcement mechanisms and expanding the Commissioner's mandate for research and education.
• The Commissioner emphasized that strong data governance by federal institutions is crucial for public trust and a resilient digital society.

Central among these Philippe Dufresne Privacy Act proposals is the introduction of a legislative requirement for federal institutions to conduct privacy impact assessments (PIAs) for any activities deemed high-risk.

On August 6, 2026, Canada's Privacy Commissioner, Philippe Dufresne, formally submitted his recommendations to the Honourable Shafqat Ali, President of the Treasury Board of Canada. This submission was a direct response to the Treasury Board of Canada Secretariat's (TBS) ongoing consultation regarding the modernization of the federal Privacy Act. Commissioner Dufresne expressed strong support for the government's initiative to update Canada's federal public sector privacy law, acknowledging the critical need for reform in the digital age.

In his comprehensive Canada Privacy Act modernization submission, Commissioner Dufresne specifically endorsed several key measures already under consideration. These included the explicit recognition of privacy as a fundamental right and the integration of contemporary privacy principles into the updated legislation. He also welcomed proposals aimed at establishing safeguards and making the comprehensive management, notification, and reporting of privacy breaches a mandatory legal obligation. Furthermore, the Commissioner viewed enhanced transparency requirements for automated decision systems as a significant and positive advancement for public sector accountability.

Beyond endorsing existing proposals, Commissioner Dufresne put forward several additional measures designed to further strengthen privacy protections for Canadians. Central among these Philippe Dufresne Privacy Act proposals is the introduction of a legislative requirement for federal institutions to conduct privacy impact assessments (PIAs) for any activities deemed high-risk. This would mandate a proactive evaluation of privacy implications before new programs or technologies are implemented, a crucial step for data governance in the federal public sector.

The Commissioner also advocated for bolstering enforcement mechanisms within the updated federal public sector privacy law. He proposed granting greater authority for the Office of the Privacy Commissioner to collaborate effectively with other oversight bodies, fostering a more integrated regulatory environment. Additionally, Dufresne suggested an expanded mandate for privacy research and public education, recognizing these as essential tools to support both Canadians and institutions in safely adopting and leveraging modern technologies while understanding their privacy implications. These changes would significantly update the federal public sector privacy law.

The urgency behind this federal public sector privacy law update stems from the immense responsibility federal institutions bear as stewards of vast amounts of sensitive personal data. Commissioner Dufresne highlighted that these institutions manage critical information spanning financial, health, employment, immigration, and public safety domains. Protecting such data presents an increasingly complex challenge in the current digital landscape.

Dufresne underscored that robust data governance is not merely a compliance exercise but a fundamental pillar for building public trust. He articulated that strengthening privacy protections would contribute directly to a more resilient Canadian economy and foster a more secure and enriching digital society. The proposed changes, including mandatory privacy impact assessments Canada federal institutions would undertake, are seen as vital steps to ensure that federal operations align with contemporary privacy expectations and technological realities.

This submission signals the likely direction of future amendments to Canada's federal Privacy Act, particularly regarding mandatory privacy impact assessments for high-risk activities, enhanced breach reporting, and transparency for automated decision systems. Lawyers advising federal institutions or entities dealing with federal data should monitor these developments to anticipate new compliance obligations and prepare for potential changes in data governance requirements.

Source: Original reporting via Office of the Privacy Commissioner of Canada