Correctional institutions, healthcare facilities, and residential care settings across Canada hold vast quantities of deeply personal information about the individuals in their custody or care. Every admission generates a trail of documentation that follows a person through their time in institutional settings and, in many cases, long after they have been released or discharged. This information encompasses medical histories, mental health assessments, criminal records, disciplinary proceedings, family circumstances, financial details, and intimate observations about behaviour, relationships, and personal struggles. The collection and retention of such sensitive material creates profound legal obligations for the institutions that hold it and for every staff member who accesses, creates, or transmits these records. Understanding what information may lawfully be collected, how it must be stored and protected, and when it can be shared is not merely a matter of administrative convenience but a fundamental component of lawful and ethical practice in controlled care environments.
The legal foundations for inmate and client record-keeping in Canada arise from multiple overlapping frameworks that govern both the collection and protection of personal information. At the federal level, the Privacy Act establishes the rules governing personal information held by federal government institutions, including Correctional Service Canada and federal penitentiaries. This legislation, as of the date of authorship, requires that personal information be collected only where it relates directly to an operating program or activity of the institution, that individuals be informed of the purpose for collection, and that the information be used only for the purpose for which it was collected or for a use consistent with that purpose. The Corrections and Conditional Release Act provides the specific statutory authority for the collection, use, and disclosure of offender information within the federal correctional system, establishing both the permissible scope of information gathering and the circumstances under which such information may be shared with other agencies, victims, or third parties.