The Treasury Board of Canada Secretariat's Directive on Privacy Impact Assessments applies to government institutions as defined in section 3 of the Privacy Act. While ministries, the Bank of Canada, and most Crown corporations are listed as government institutions subject to the Privacy Act, the Act contains a specific and broad exemption for "confidences of the Queen's Privy Council for Canada," which includes Cabinet confidences. Therefore, the functions and confidential records of the Cabinet as a collective body are not subject to the Privacy Act or its associated directives, including the one on PIAs.

A. The Ministry of Health is a core government department and is explicitly subject to the Privacy Act and its directives.
B. The Bank of Canada is listed in the Schedule of the Privacy Act as a government institution to which the Act applies.
C. Parent Crown corporations are generally defined as government institutions under the Privacy Act and are therefore subject to the directive.

1. Privacy Act, R.S.C., 1985, c. P-21, Section 3 (Definition of "government institution") and the Schedule.

2. Privacy Act, R.S.C., 1985, c. P-21, Section 70(1), which states the Act does not apply to confidences of the Queen's Privy Council for Canada.

3. Treasury Board of Canada Secretariat. (2010). Directive on Privacy Impact Assessment. Section 5.1 states the directive applies to government institutions as defined in section 3 of the Privacy Act.