Access to information and privacy implementation notice 2025-01: Disclosing personal information of deceased individuals on compassionate grounds

1. Effective date

This implementation notice takes effect on November 10, 2025.

2. Authorities

This implementation notice is issued pursuant to paragraph 70(1)(c) of the Access to Information Act (ATIA) and paragraph 71(1)(d) of the Privacy Act.

3. Purpose

This implementation notice provides guidance on the release of a deceased individual’s personal information to their loved ones for compassionate reasons. It includes comprehensive instructions on the steps to consider when evaluating the applicability of subparagraph 8(2)(m)(i) of the Privacy Act, which allows for the disclosure of personal information in the public interest, per the discretion of the head of the government institution. It also offers alternative approaches to disclosure and practical recommendations.

4. Context

The federal government retains the information of deceased individuals. This includes information about individuals such as:

members of the federal public service, RCMP, Canadian Armed Forces and veterans
inmates in federal penitentiaries
Canadians requiring consular services at embassies abroad
victims of crime being investigated by the RCMP

Individuals may seek access to the personal information of a deceased loved one for various reasons, including for a sense of closure following their passing. Some government programs have pre-established mechanisms to provide such information to family members. However, this is rare. Typically, loved ones need to request access via the ATIA or the Privacy Act, yet they may choose to submit an informal request for the information.

If the deceased has been dead for more than 20 years, their information meets the exception to the definition of personal information in paragraph 3(m) in the Privacy Act, so it is no longer considered protected personal information. However, if they have been deceased for less than 20 years, access is limited.

There are provisions in legislation that allow for the release of such information, for instance if the information is being used to settle the individual’s estate. Otherwise, personal information is typically redacted. To release it, discretion must be exercised. Institutions must determine whether the public interest, in this case the compassionate grounds, outweigh the invasion of privacy.

This guidance expands on section 10.13.3 of the Personal Information Request Manual, which outlines factors that should be considered when exercising discretion to disclose personal information pursuant to paragraph 8(2)(m). This includes factors related to requests for disclosure of information of an individual who has been deceased less than 20 years. This provision gives heads of institutions the discretion to release personal information for public interest purposes.

5. Guidance

5.1 Defining compassion

Compassion is defined as the “sympathetic consciousness of others’ distress together with a desire to alleviate it.”^{Footnote 1} The meaning implies being aware, sensitive and understanding of the feelings and experience of an individual. It goes beyond empathy as it includes action.

Compassion implies that not only is one moved by an individual’s suffering, but there is also the innate desire to help. It is composed of three aspects: the awareness of an individual’s distressing experience, the understanding of their experience and the action to alleviate their distress. The Office of the Information Commissioner has notably recommended considering disclosure on compassionate grounds, particularly in its investigation of a complaint involving the RCMP and an access to information request related to a fatal accident.

The Policy on Access to Information and the Policy on Privacy Protection both require government institutions to “make every reasonable effort to assist” individuals making a request for records, regardless of who the requester is. The duty to assist particularly intersects with compassion when individuals make a request for access to information because of tragic events. As always, government institutions make every reasonable effort to assist the individual. In so doing, in certain, specific circumstances, they may release records on compassionate grounds to assist in the healing process of individuals.

Essentially, compassionate disclosure bridges empathy with action by offering information that may assist with healing. When considering a compassionate disclosure, institutions should determine whether the request explicitly mentions compassionate grounds or if the circumstances imply a need for compassion.

5.2 Mechanisms for release of information

5.2.1 Disclosure under legislative provisions

Mechanisms that authorize the disclosure of a deceased individual’s personal information can be used in specific conditions. For example, subsection 8(3) of the Privacy Act allows Library and Archives Canada to disclose personal information it has received from government institutions for historical or archival purposes in the circumstances set out in section 6 of the Privacy Regulations. Also, paragraph 10(b) of the Privacy Regulations allows estate administrators to access personal information on behalf of the deceased to manage their estate.

Elsewhere, certain institutions have integrated mechanisms that allow public interest disclosure. Subsection 37(1) of the Department of Employment and Social Development Act (DESDA) permits the minister for Employment and Social Development Canada (ESDC) to disclose personal information when the public interest outweighs privacy concerns or benefits the individual. Likewise, paragraph 8(2)(m) of the Privacy Act authorizes federal institutions outside of ESDC to disclose personal information without the consent of the individual in these same instances. Specific conditions are required to employ these provisions.

5.2.2 Integrating compassionate disclosures into programs

Paragraph 8(2)(m) of the Privacy Act is intended for use in special circumstances and should not be applied systematically or broadly to release the same type of information. If a government institution recognizes a frequent need to disclose information, for example about deceased individuals to loved ones on compassionate grounds, it is recommended that the institutions consider making such disclosures part of the program itself.

For example, some programs in the federal government have an extra duty of care to the individuals involved. These include our correctional services and the inmates they serve, as well as our armed forces and the individuals who serve. Recognizing this higher standard, some programs have introduced processes to support compassionate disclosures to family members following a death.

By creating or modifying an existing program to enable these disclosures where consent cannot be obtained, it ensures structured processes for compassionate disclosures, allowing for broader and adapted releases. If institutions consider this approach, they should consult with their legal services to confirm whether a legal authority exists to implement these disclosures in their programs. They also have to complete or update their privacy impact assessments and personal information banks to reflect these disclosures.

5.3 Preliminary steps to processing requests for compassionate disclosures

Before an institution can assess whether the public interest in disclosure outweighs the associated privacy concerns, a number of preliminary steps must first be taken. First, the institution should assess if access may be granted under one of the mechanisms outlined in section 5.2 of this document. As always, the ATIA and the Privacy Act are meant to complement, not replace, other means of receiving information.

Next, in addition to the standard procedures to validate and accept a request for information, the institution should confirm that the subject of the request is in fact deceased and therefore cannot provide consent to the disclosure. This may be evident based on the nature of the request. As an example, a request for a fatality incident report implies the subject is deceased. If the individual’s passing can be known to the institution with minimal inquiries, for example, if they are an employee, the ATIP team may wish to conduct this research rather than request input from the requester. If the institution is unaware of the deceased’s passing, the requester should provide a proof of death. Examples could include a death certificate or the published obituary.

Next, it is necessary to validate the requester’s relationship with the deceased to discern whether the deceased might otherwise have consented to the release. Some questions institutions should consider include:

Are they named as the deceased’s next of kin or emergency contact?
Are they the executor of the estate or otherwise named in the will or the published obituary?
Were they named as a power of attorney for health or financial decisions for the deceased?
Does the government already have consent to release the deceased’s information to this individual? If so, is that consent related to the information requested?
Is the identity of the requester consistent with the information held by the government institution? For example, does their name appear in related files? Does the information provided by the requester correspond to information found in the institution’s records?

If there is no information available on the relationship to the deceased, the institution should proceed with an assessment on the individual requesting the information.

Is there any existing evidence or precedent indicating that the subject of the information would want this person to receive their personal information? Have they stated this previously, and is there any documentation to support it?

For instance, with the requester’s consent, institutions can seek confirmation of the relationship from the executor of the estate. This would require the requester to provide the executor’s contact information. If the requester also consents to the nature of the inquiry being shared, the executor may also have a view on whether the deceased would have wanted the information shared with the requester. This could inform the invasion-of-privacy test (see section 5.5.2 of this document), but not override it.

Finally, the government institution should evaluate the nature of the request. Consider whether the request is too general. Institutions should clarify and narrow the scope, if possible, for clearly defined requests are necessary to properly apply the invasion-of-privacy test.

5.4 Exercising discretion

In this context, the exercise of discretion by the head of the institution plays a crucial role. Discretion allows decision makers to act in good faith, weighing all relevant facts and circumstances when applying the Privacy Act. Discretion can be considered by heads of institutions or their delegates to respond to compassionate requests, recognizing that the circumstances may justify the release of personal information in the public interest.

When there is an access request seeking a deceased person’s information, it is likely subject to section 19 (Personal information) of the ATIA or section 26 (Information about another individual) of the Privacy Act if the person has been deceased for less than 20 years. These sections are mandatory exemptions with particular discretionary elements, based on a class test.

Subsection 19(1) of the ATIA requires heads of institutions to refuse to disclose any record requested that contains personal information. However, the discretionary element in paragraph 19(2)(c) allows for the disclosure of personal information in accordance with section 8 of the Privacy Act. This identifies legal requirements for the disclosure of personal information.

Subsection 8(2) of the Privacy Act enumerates several circumstances where personal information may be disclosed without the consent of the individual to whom it relates. Disclosure without consent is subject to strict conditions. It is therefore crucial for institutions to have a clear understanding of the appropriate use of the provisions.

Subparagraph 8(2)(m)(i) of the Privacy Act allows federal institutions to balance individual privacy rights with the broader public interest. This provision is significant in scenarios where withholding information could lead to harm or prevent critical public benefits. Government institutions have a duty to consider its application when faced with information that would not be disclosed without consent. In Canada (Information Commissioner) v. Canada (Commissioner of the Royal Canadian Mounted Police), 2003 SCC 8,^{Footnote 2} the Court found that the institution did not consider whether the information might properly have been disclosed under subparagraph 8(2)(m)(i) of the Privacy Act, and that the institution thereby failed in its exercise of the discretion it is required to exercise under subsection 19(2) of the ATIA.

The subparagraph should be applied only in exceptional cases not covered elsewhere in subsection 8(2). It does not grant a right of access, but allows the head of an institution to disclose information, at their discretion, when specific conditions are met. To balance privacy considerations and the public interest in disclosure, the institution should disclose only what is necessary to fulfill the compassionate request. For further details, refer to sections 6.12 and 10.13.3 of the Personal Information Request Manual.

5.5 Public interest outweighs privacy invasion

5.5.1 Defining the public interest

Subparagraph 8(2)(m)(i) may be applied when the public interest in disclosure clearly outweighs any invasion of privacy that could result. When considering this clause, institutions should assess the potential benefits of making the information known to another individual. This could include providing emotional closure to the loved ones of a deceased individual, helping relatives retrace their steps, offering support to grieving families and demonstrating empathy, which can enhance accountability and public trust. Examples of records in which there could be a public interest in disclosing for compassionate reasons include disclosing:

parts of military or RCMP records of deceased individuals
loved ones’ suicide notes
a digital file saved on the work device of a deceased public servant, like family photos
police reports from fatal accidents

The Information and Privacy Commissioner of Ontario has published a public interest disclosure fact sheet to guide the application of a similar provision in the Ontario Freedom of Information and Protection of Privacy Act. In it, it identifies that a public interest “may be found to exist even when a requester has a private interest in the records, if the records also raise issues of a more general character.”

5.5.2 Invasion-of-privacy test

The invasion-of-privacy test helps government institutions assess the privacy risks involved in a disclosure by focusing on three interrelated factors:

the sensitivity of the information
the expectations of the individual
the probability and degree of injury

Institutions should apply this test to determine whether subparagraph 8(2)(m)(i) should be used to release personal information.

Best practices for applying the invasion-of-privacy test

As described above, institutions should assess the sensitivity of the information, the expectations of the individual and the probability and degree of injury for the application the invasion-of-privacy test. The following questions are intended to guide decision-making in applying the invasion-of-privacy test.

1) Sensitivity of the information

Institutions should evaluate whether the type of information is of a detailed or highly personal nature. Questions to consider include:

Is the information highly personal or relatively harmless? Some examples of sensitive information include political or religious beliefs, genetic or biometric data or sexual orientation.
Could releasing a seemingly benign piece of information be sensitive in context?
Is the information current, making it more sensitive, or has it become less sensitive over time?
Could disclosing the information still cause harm, even after time has passed?

2) Expectations of the individual

When evaluating whether to disclose personal information, institutions should consider the conditions under which the information was collected and what the individual would have expected regarding their privacy. Assessing the established expectations is essential. Questions to consider are:

Was the information collected with an expectation of privacy or confidentiality?
Was the information given freely, with little expectation of privacy?
Has the deceased already made this information public, reducing its private nature?
Has the deceased expressed or implied any wishes regarding the information?
Were the limits of privacy established in prior documentation, such as a privacy notice statement?

The disclosure of publicly available information is covered in more depth in the Privacy Implementation Notice 2023-03: Guidance pertaining to the collection, use, retention and disclosure of personal information that is publicly available online.

3) Probability and degree of injury

Institutions should examine the probability and degree or gravity of injury of a release. In each case, the institutions should identify and assess factors tailored to their framework to help determine the acceptable level of harm when considering whether to release personal information. Questions to consider are:

Could the disclosure affect decision-making processes?
Could the disclosure of this information be used for purposes beyond the stated intent? For example, could it be used to support litigation, to publish a book or to assume the identity of the deceased individual?
Could the disclosure lead to tangible negative consequences for the individuals concerned? Examples could include:
- endangering the physical well-being of any of the family of the deceased
- tarnishing the reputation of the deceased (who cannot defend themself) or causing harm to their family due to their loss of reputation
Is there evidence that an immediate family member or former spouse does not want the information released?
If there are possible negative consequences, how severe and how likely are they?

It is important to note that, even if information may be upsetting or have consequences when disclosed, it doesn’t automatically preclude the release of the information. Rather, it highlights the need for institutions to communicate thoughtfully with requesters, ensuring that even if the information is considered distressing, it could still be disclosed in a respectful manner.

When communicating with requesters, considerations may include their awareness of potential negative consequences of disclosure and whether there are circumstances in which they might prefer not to receive certain information.

In the same vein, information about an individual’s death or a tragic fatal accident can be difficult to process. While loved ones may seek closure, it is important to recognize that the details provided may be difficult to process or reveal things they were unaware of. Consequently, institutions should consider suggesting to loved ones that they may wish to seek appropriate support services, possibly directing them to the GC mental health support webpage.

Institutions may have other factors unique to their own information holdings that should be added to an invasion-of-privacy test. For this reason, institutions are encouraged to develop guidelines and internal procedures for disclosures pursuant to subparagraph 8(2)(m)(i) for ATIP practitioners, including a threshold for these types of disclosures to guide decision-making. Further guidance on this test can be found in the Office of the Privacy Commissioner’s guidance on Public interest disclosures by federal institutions under the Privacy Act.

5.5.3 Balancing privacy against the public interest

The determination of whether the disclosure of personal information is in the public interest is made by the head of the government institution or their delegate on a case-by-case basis. They may wish to consult legal services in complex scenarios.

The head must weigh the right to privacy against the public interest in disclosure to determine whether releasing the information would constitute an unwarranted invasion of privacy. The head’s decision to approve a disclosure, along with the process and any supporting details leading to it, should be documented to maintain accountability.

5.6 Notifying the Office of the Privacy Commissioner

Subsection 8(5) of the Privacy Act provides that the head of a government institution must notify the Privacy Commissioner of any disclosure of personal information under paragraph 8(2)(m), either prior to the disclosure or, if this is not practicable, at the time of disclosure. This provision provides an additional level of oversight as these disclosures are considered on a case-by-case basis.

The Privacy Commissioner may also express an opinion about the disclosure and may make recommendations to the institution. However, the Commissioner has no authority to prevent the disclosure, and it is ultimately the head of the institution or their delegate’s decision to release the information. Institutions must report disclosure under paragraph 8(2)(m) and notice of disclosure under subsection 8(5) in their annual reports to Parliament on the administration of the Privacy Act.

The Office of the Privacy Commissioner (OPC) has developed a central portal^{Footnote 3} for institutions to notify it in a secure and efficient manner. The public interest disclosure notification online submission portal is accessible to all institutions. By submitting notifications via the portal, institutions will be prompted to provide the elements of information necessary to allow the OPC to assess the disclosure. The OPC may follow up with institutions who do not use the portal when it needs more information. Institutions should expect to provide the OPC with the following information:

the name(s) of the individual(s) involved
a description of what personal information elements were or are proposed to be disclosed
to whom the personal information will be disclosed
the purpose of the disclosure and a statement as to why the public interest overrides privacy concerns in this instance, or how the disclosure would clearly benefit the individual
the name and signature of the person authorizing the disclosure

Note that institutions should limit the personal information shared with the OPC to what is necessary to answer the questions.

5.7 Other exemptions that apply

Institutions must ensure that the information considered for disclosure is not subject to other exemptions or exclusions of the ATIA or the Privacy Act. For example, information related to national security or ongoing investigations likely cannot be disclosed.

This is a likely scenario when an accident occurs, and someone loses their life as a result. An investigation typically takes place and, concurrently, a loved one may request access to information about the accident. In this case, it might not be possible to provide access to the information because an investigation is underway, and doing so might impede the investigation proceedings pursuant to section 16 of the ATIA or section 22(1) of the Privacy Act, even if these are discretionary exemptions.

Nonetheless, once the investigation is complete and the matter is resolved, the requester can always resubmit their request. Institutions could consider developing a program in which investigations reports are routinely provided to loved ones once an investigation has concluded, where possible and in accordance with the Privacy Act and any relevant legislation.

When considering these disclosures, ATIP officials must examine the records thoroughly and apply relevant exemptions and exclusions. For more information on the application of exemptions, review the Access to Information Manual and the Personal Information Request Manual.

5.8 Limits of the use of paragraph 8(2)(m)

Institutions must recognize the limitations of paragraph 8(2)(m) when considering compassionate disclosures. In some cases, personal information may be subject to a law or an Act that explicitly prohibits its release. These are identified in Schedule II of the ATIA.

For example, subsection 241(2) of the Income Tax Act states that no government official or representative can be compelled to disclose taxpayer information in legal proceedings. In such instances, a compassionate disclosure would not be permitted, as the Income Tax Act takes precedence. Therefore, institutions must carefully assess whether other legislative requirements restrict the application of paragraph 8(2)(m) before proceeding with a disclosure.

6. Application

This implementation notice applies to government institutions as defined in sections 3 of the ATIA and the Privacy Act, including parent Crown corporations and any wholly owned subsidiary of these corporations. It does not apply to the Bank of Canada.

7. References

7.1 Legislation and regulations

7.2 Policies and directives

7.3 Guidance

8. Inquiries

Members of the public may contact TBS Public Enquiries for information about this implementation notice.

Employees of government institutions may contact their Access to Information and Privacy (ATIP) coordinator for information about this implementation notice.

ATIP coordinators may contact ippd-dpiprp@tbs-sct.gc.ca for information about this implementation notice.

Page details

2025-11-17

Language selection

Search