A Skewed “Modernization”: Looking for Balance in Canada’s Access to Information and Privacy Reviews

This policy paper discusses the Treasury Board Secretariat (TBS) of Canada’s ongoing reviews of the federal Access to Information Act and Privacy Act, respectively launched in June 2025 and April 2026. It argues that these separate review processes potentially advance privacy reforms in a way that will further burden and deteriorate the access to information system in Canada by hampering the ability of the Office of the Information Commissioner of Canada to successfully deliver on its mandate. In conducting fragmented review processes, the TBS proposes changes that do not recognize the intertwined importance and reality of access and privacy in digital governance. Furthermore, it overlooks the current, deteriorated state of the access to information system, the lack of resources to support or improve its performance, and the absence of a robust research ecosystem to conduct objective reviews of the access system to identify and address gaps and implement enhancements. The paper identifies several reforms that would rebalance these reviews and avoid potential pitfalls of reform.¹

Legislative Framework

Access and privacy are two sides of the same coin. They regulate how data and information are collected, used and disclosed. As data increasingly becomes a foundational unit of digital governance, research into questions of access and privacy in digital environments has become essential to understanding power, and balancing rights and freedoms in such systems. The regulation of data through access and privacy channels these values, in turn making them sites of critical importance in exercising and realizing the shape of many fundamental democratic rights.

In Canada, the national regulation of access and privacy is shaped by three main statutes: the Privacy Act (PA), regulating the personal information held by governments, including access to that information,² the Access to Information Act (ATIA), regulating access to general records under the control of a government institution,³ and the Personal Information Protection and Electronic Documents Act (PIPEDA), regulating the collection, use and disclosure of personal information in certain domains of electronic commerce.⁴ Two officers of Parliament are responsible for overseeing compliance with these statutes: the Office of the Information Commissioner of Canada carries out complaints into access requests and maximizes compliance with the ATIA while the Privacy Commissioner investigates complaints arising from and oversees compliance with the PA and the PIPEDA. This federal approach varies from the provincial approach, where privacy and access mostly use an integrated model — that is, privacy and access are regulated by a single regulator, with the exception of Québec (and not considering ombudsmen roles for health data).

A breakdown of the federal governance in this area is provided in Figure 1 below.

Figure 1: Federal Regulation of Access and Privacy

Source: Author.

The ATIA and the PA were enacted together, along with amendments to the Evidence Act, in Bill C-43 of the 32nd Parliament in 1983.⁵ As Justice Gérard La Forest noted in the seminal Supreme Court of Canada case of Dagg v. Canada (Minister of Finance) in 1997, together these statutes form a “seamless code.”⁶ As other Supreme Court of Canada decisions have also noted, the statutes reference one another in detail, establish comparable regulator roles in Offices of the Information Commissioner and the Privacy Commissioner, “each of whom is charged with carrying out impartial, independent and non-partisan investigations into the violation of, respectively, the right of access to information and privacy rights.”⁷ The PA even provides that the Information Commissioner may become the Privacy Commissioner — so the same person can hold both roles.⁸

The purpose of the ATIA is “to enhance the accountability and transparency of federal institutions in order to promote an open and democratic society and to enable public debate on the conduct of those institutions.”⁹ It provides that “government information should be available to the public,” subject to “necessary exceptions” that are “limited and specific,” with decisions on access “reviewed independent of government.”¹⁰ The statute also notes that it does not replace “existing procedures for access” and does not limit “government information that is normally available to the general public.”¹¹ For its part, the PA’s purpose is to “protect the privacy of individuals with respect to personal information about themselves held by a government institution” and to “provide individuals with a right of access to that information.”¹²

Because access and privacy pull in different directions — one toward disclosure and one away from it — these two competing legislative tools sometimes clash. “Recognizing the conflicting nature of governmental disclosure and individual privacy,” Justice La Forest wrote in Dagg, which devised an interpretative framework for addressing conflicts between access and privacy, “Parliament attempted to mediate this discord by weaving the [ATIA] and the [PA] into a seamless code. In my opinion, it has done so successfully and elegantly.”¹³ They set out, as Justice La Forest wrote, “a coherent and principled mechanism for determining which value [that is, privacy or access] should be paramount in a given case.”¹⁴ In doing so, the Supreme Court has also held that these statutes enshrine values that are fundamental to democracy. For example, the ATIA can channel the Charter of Rights and Freedom’s guarantee on the freedom of expression in certain cases,¹⁵ while many of the PA’s provisions can be viewed as derivative of Charter rights concerning liberty of the person and against unreasonable search and seizure by the state.¹⁶ As such, the Supreme Court of Canada has held that these statutes both may be found to have “quasi-constitutional” status.¹⁷

Recent Reviews

By the time of writing in August 2026, the federal government had launched two review processes of these frameworks, each branded as a “modernization.”¹⁸ On June 20, 2025, the federal government begrudgingly launched a review of the ATIA on the last day on which the President of the TBS was required to do so under the statute’s mandatory five-year review requirement.¹⁹ As the review notice stated, the review was deemed necessary because “the way Canadians and the government handle information has changed considerably since the act came into force in 1983.”²⁰ That notice also highlighted: “Such reviews help keep the act up to date with these changes and ensure that it supports a transparent, accountable and participatory government in the digital age.”²¹ Subsequently, the review announcement was followed by the publication of a “Policy Approaches” document that laid out areas of focus for reform and anticipated legislative amendments, including with respect to (but not limited to) declassification and disclosure of historical records, information management practices and oversight. This review process followed a lengthy history of ministerial, parliamentary and watchdog-led reviews that have repeatedly proposed many of the same changes to the system.²²

It is widely acknowledged that reforms to the ATIA are sorely needed. In particular, the access to information system is noted for widespread delays in the processing of access request, with delay complaints comprising the majority of complaints reaching the Office of the Information Commissioner. In 2021, an investigation by The Globe and Mail noted that government institutions were only responding to access requests within the 30-day legislative timeline 50 percent of the time.²³ In 2024, the Information Commissioner, Caroline Maynard, and all of her provincial counterparts issued a call for enhanced transparency obligations, including better respect of timelines.²⁴ Unfortunately, however, the proposed policy approaches do not incorporate many of the changes that have been identified in previous parliamentary, ministerial and civil society reviews, including with respect to issues around the scope and nature of exemptions and exclusions.

In tandem with the ongoing review of the ATIA, in April 2026, the federal government launched a review of the PA. The review notice stated that “[a]n effective and efficient federal privacy regime should advance trust in the government’s ability to safely manage the personal data entrusted to it, while enabling timely, efficient services to Canadians, including Indigenous people.”²⁵ An accompanying discussion paper, “2025 review of the Access to Information Act: Policy approaches,” laid out areas of focus for legislative amendment. One clear objective of the modernization plan was visible from its prominent placement as “Proposal 1: Enable responsible sharing and reuse of personal data across government programs.”²⁶ While the policy approaches in the review process generally have enjoyed welcome and tentative support from the privacy community,²⁷ some of the proposals in this document show dissonance with the review of the ATIA, as discussed in subsequent sections.

Potential Dissonance between the Access and Privacy Reviews

This policy paper does not address all the proposals in the ATIA and PA reviews, but rather, focuses on one major change proposed in the PA review (Proposal 15) and its potential impact on both the access and privacy systems. Under Proposal 15, the PA review process suggests the federal government intends to introduce legislative amendments that will “[h]armonize the request regime by incorporating requests for personal data into the Access to Information Act.”²⁸ Neither the initiating review document²⁹ nor the “Policy Approaches” document³⁰ of the simultaneous review of the ATIA mention this change.

From one perspective, the incorporation of access requests for personal information into the ATIA framework is logical: the current two-system approach with the ATIA (an access request system for general records) and the PA (an access request system for one’s personal records) is confusing and requesters, at times, misdirect their requests. Moreover, the ATIA has an exemption for “personal information” that would likely be adequate for processing such requests.³¹ However, this proposed change would likely impact the workload of the Office of the Information Commissioner in significant ways. As previously noted, complaints over the administration of the ATIA are funnelled through that office; complaints regarding compliance with the PA are reviewed by the Privacy Commissioner. Significantly expanding the scope of potential complaints reaching the Information Commissioner would compound a long-standing problem: while the ATIA and the PA are analogous statutes enjoying quasi-constitutional status, the two Commissioners’ offices have starkly different levels of resources responding to different workloads.

This inequality is apparent from basic metrics. For example, in 2025, the Office of the Privacy Commissioner accepted for review a total of 1,725 complaints (1,279 under the PA and 446 under PIPEDA),³² while the Office of the Information Commissioner received 3,626 complaints.³³ However, the Office of the Privacy Commissioner had roughly double the resources. Its total actual spending was CDN$36,850,160 with a full-time staff of 229,³⁴ while the Office of the Information Commissioner’s total actual spending was CDN$18,166,969 with a staff of 119.³⁵ Although the nature of complaints differs, the Office of the Information Commissioner already carries a much heavier case load with fewer resources. The Information Commissioner recently characterized this workload to Parliament in May 2026 as a “rising pressure.” Maynard also, worryingly, characterized the status quo as “manageable,” even though her investigations are defined by shocking delays, including more than 10 percent of complaints pre-dating 2024.³⁶ Moreover, as she recently acknowledged, her office lacks a mechanism to seek increases in funding that are responsive to the number of complaints she receives. As Maynard noted, “an increase in the number of complaints” would be “out of our control and we have no process to seek additional funding to seek to respond to that increase.”³⁷

The proposed changes in the PA modernization plan will potentially aggravate those problems. Proposal 15 to “[h]armonize the request regime by incorporating requests for personal data into the Access to Information Act”³⁸ would have sweeping changes, effectively sending a large number of access requests for one’s own personal information — approximately 75,000 such requests were made last year³⁹ — through the ATIA process rather than the PA process. Given that most of the complaints received by the Privacy Commissioner concern the PA — that is, the complaints concern the processing of and access to one’s own request for their own information — the review suggests these complaints will now be directed through the Information Commissioner’s office, adding to her workload and backlog.

The review processes do not suggest that timelines will be shortened or even guard railed in any way. Under the ATIA, the Information Commissioner still does not have to conclude her investigations within any set deadline (and parties do not have the right to go to Federal Court until she finishes those investigations — effectively blocking access to courts). She has published guidance simply stating “every case is different, so it is difficult to predict exactly how long an investigation will take.”⁴⁰ But one report has noted that while the Information Commissioner “can generally complete an investigation in between three and 12 months,” some of her investigations have taken over a decade.⁴¹ She has refused to comply with her own oversight body’s (the Ad Hoc Information Commissioner of Canada) recommendations to release more granular information about how long her investigations take.⁴² Under the PA, there is also no obligation to produce a review or report within a certain timeframe (unlike in PIPEDA, which requires a report be completed within one year).⁴³ Nothing in the review processes suggests this will change. This indicates that the time it takes to conduct an investigation regarding a complaint over access to personal information, which is already worryingly long and not governed by firm standards, could be exacerbated by adding to the caseload of the Information Commissioner. Effective timelines are needed to enable meaningful access, dissuade over collection of personal information, prevent avoidable encroachments of state surveillance and obviate maladministration.

Adding to these challenges, in recent years the Office of the Information Commissioner’s caseload in Federal Court has also increased drastically, as Maynard files applications against government institutions to enforce her orders regarding disclosure (or those government institutions file applications against her office to challenge them). According to the Government Electronic Directory Service (GEDS), in May 2026 the Information Commissioner’s office had 21 employees in the “Legal Public Affairs” section, one of three branches of the Information Commissioner’s office; this is compared with 40 employees in the Office of the Privacy Commissioner’s “Legal Services and Policy Sector” office, also one of three branches of that office.⁴⁴ However, these supports responded to very different caseloads as shown in the figure below.

Figure 2: Cases Commenced Involving the Office of the Privacy Commissioner and the Office of the Information Commissioner from 2020–2025

Source: Data collected by the author from the Federal Court website.⁴⁵

There is no acknowledgement in the review processes into the ATIA and PA that the Office of the Information Commissioner will receive more support. To the contrary, the ATIA review would possibly water down the order-making power of the Information Commissioner.⁴⁶ “Currently, the Information Commissioner is not required to explain their decisions,” the review states. “Requiring the Information Commissioner to publish rationales for decisions would make their work more transparent.”⁴⁷ It will also make it far more burdensome for the investigators in that office, as they will now be required to provide reasons for the decisions — a burden that could potentially incentivize investigators to default toward adverse findings as a way of avoiding this obligation. According to GEDS, the Office of the Information Commissioner currently has 47 employees in the “Registry, Investigation Governance and Strategic Guidance” section of her office.⁴⁸ An increase in their workload of more than 1,000 complaints per year (the number of PA complaints received by the Privacy Commissioner last year) could drastically impact their workloads, the timeliness of investigations and the burdens of providing justifications for orders. Moreover, the proposed policy to require the Information Commissioner to take into consideration “any evidence that the institution did its best to respond to the request” as a new criterion for issuing orders for personal information might dilute the Commissioner’s order-making power in such cases.⁴⁹

Imbalanced Research Supports

The PA review has been largely welcomed in civil society and public interest circles, while the ATIA review has largely been seen as out-of-touch and not fit for purpose. That is not a coincidence. Privacy studies in Canada is a mature field, with research playing a crucial role in establishing new directions in the field, identifying gaps and problems, understanding and mapping changes (including with respect to emergent technologies), and overall shaping the development of proposed and actual policy. Significant work has gone into devising, thinking about and preparing for reform for the PA and PIPEDA.

This did not happen overnight. In Canada, research into privacy is much better funded than access to information. At the federal level, the Privacy Commissioner has a mandate under PIPEDA to “develop and conduct information programs to foster public understanding, and recognition of the purposes,” “undertake and publish research that is related to the protection of personal information,” and to “promote, by any means” that law.⁵⁰ As part of this mandate, the Privacy Commissioner funds research and public awareness projects connected to the purposes of PIPEDA.⁵¹ Since 2005, this program has funded eligible projects, and its current annual budget for projects is CDN$500,000.⁵² Unlike PIPEDA, the Privacy Commissioner does not have a mandate to support research or awareness into the PA. Likewise, the Information Commissioner of Canada does not have a mandate to support research or awareness in the ATIA.⁵³ The offices’ primary function in respect of those statutes is adjudication. Nothing in the ongoing reviews of the ATIA and PA suggests that will change. Mirroring these problems, at the provincial level, the Ontario Information and Privacy Commissioner recently launched a “Scholar-in-Residence” program, but it has only appointed specialists in privacy.⁵⁴

Since Justice La Forest described the two statutes in the seminal Dagg case as a “seamless code,” privacy research and studies have also received far greater research funding and support than access research and studies from government post-secondary funding bodies. For example, between 1998–2025, the Social Sciences and Humanities Research Council (known as SSHRC), the federal research funding agency that supports research in the humanities and social sciences, funded considerably less research into projects featuring the words “freedom of information” ($0) or “access to information” (CDN$385,027.33) in their title than it did for projects featuring in the word “privacy” (CDN$6,233,549.09) in their title.⁵⁵

Necessary Changes

As noted, Canadian civil society and public interest commentators have, for the most part, tentatively welcomed the review of the PA while criticizing the ATIA. The interaction between the two processes has been largely ignored, especially the manner in which personal information access requests — previously under the PA — will now fall under the ATIA, with complaints then presumably to be heard by the Office of the Information Commissioner. In light of this change, it is paramount to look more closely at the two review processes in tandem and to consider how changes will impact Canadians’ privacy rights. This policy paper lays out several changes to ensure access to information remains robust while the protection of privacy remains paramount in matters where it should prevail:

• The Office of the Information Commissioner’s budget must be substantially increased both to clear its existing backlog (in some cases stretching back years) and to prepare for the incoming volume of complaints it would receive under the reforms proposed in the reviews. Furthermore, the Information Commissioner’s funding must become far more agile to respond to caseloads.
• Timelines are needed on the Information Commissioner’s investigations, ideally for all investigations but especially for personal information complaints. These should mirror the timelines set forth in PIPEDA. There is little reason to provide commercial entities with stronger privacy rights than humans. Over 10 percent of the complaints to the Information Commissioner date from before December 2023.⁵⁶ It is incongruent for the government to highlight that privacy is a human right in the reformed PA while neglecting the access regime vital to exercising those privacy rights.
• The Information Commissioner must be given a mandate (and budget) to support research and awareness into access to information, mirroring the Privacy Commissioner’s mandate to do the same with respect to PIPEDA. This is especially critical given the Information Commissioner’s proposed new mandate to process complaints regarding personal information requests. Such a mandate would perform an essential maintenance function, including defining critical questions, identifying new methods and best practices, and mapping short- and long-term goals and priorities for reform.
• While greater mediation could become an important tool of efficiency, proposed changes to the order-making power of the ATIA must be refined to preserve the Information Commissioner’s existing power without adding to her workload. The Information Commissioner must also be endowed with power to sanction government officials who flout the Act.
• The funding model of the Information Commissioner must be made independent. The “Principles on the Protection and Promotion of the Ombudsman Institution” published by the Venice Commission, which set forth best practices on such offices, highlights the importance of independence. In Canada, however, the Information Commissioner is dependent on the TBS itself — a body it sometimes investigates— for its funding.⁵⁷

Conclusion

Despite forming a “seamless code,”⁵⁸ access and privacy have received different attention in recent years. They have different mandates, yet the Office of the Privacy Commissioner received approximately twice as much funding — and had twice as many staff — as the Office of the Information Commissioner.⁵⁹ The former, but not the latter, has a research program to support privacy studies and research with a budget of CDN$500,000 per year.⁶⁰ This has occurred even while the latter, but not the former, has a higher caseload and is inundated with litigation burdens to enforce their orders.

Proposed changes to the ATIA and PA that promise to channel access requests for personal information through the ATIA — and, therefore, into complaints processed by the Office of the Information Commissioner — might overwhelm the current resources and capacity of the Commissioner. Adjustments to the ways in which orders will be made, and the criteria necessary for issuing them, might also impact the contour of and respect for privacy rights of individuals vis-à-vis the federal government — even at a time when the federal government is suggesting in the PA review that it will recognize privacy as a human right. In light of these changes, it is imperative that the federal government recognize the potential resource burdens already on the Office of the Information Commissioner and devise plans for responsive and flexible funding mechanisms that reflect the workload. Additionally, the federal governments should explore imposing timelines to ensure that privacy rights enjoy respect during the investigation process — and parties are able to avail themselves of review in Federal Court when delays are excessive. More broadly, the federal government would do well to remember that as data becomes a core unit of digital governance, effective governance in both privacy and access will become essential. Contemplating the existing and potential future burdens resulting from reforms is an important step in doing that.