My basic understanding of the difference is the kind of information you can access. That is, while you can access many kind of records (e.g government institutions, corporations, and individual) via the Access to Information Act, you usually access information that are personal in nature under the Privacy Act. For instance, if I want to know about the day to day workings, budget expenditures, internal memos etc. of IRCC I would have to request that under the Access to Information Act rather than the Privacy Act. In addition (and following from above), I can request the information on someone else's behalf only via the Access to Information Act. Having said that, I'm not sure if the information you get via two are exactly the same.