Privacy Laws


Call toll free 1-800-390-3291

What is PIPEDA?

Federally Regulated Privacy Law

• The Personal Information Protection and Electronic Documents Act (PIPEDA) was passed under Bill C-6 in 2001.


• Effective January 2004 PIPEDA applies to any commercial activity within a province unless substantially similar provincial legislation is in place.


• To date only Quebec has private sector privacy legislation approved by the Privacy Commissioner as being substantially similar.


• British Columbia (Bill 38) and Alberta (Bill 44) have proposed Privacy legislation but the Federal Government has not approved either as substantially similar.

What is the Purpose of Privacy Legislation?

Section 3 of PIPEDA states:

• The purpose... is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances

What is Personal Information?

Factual information recorded or not about an individual that includes:

• Age, Name, ID numbers, Income, Ethnic origin, or Blood type


• Opinions, Evaluations, Comments, Social Status, Disciplinary actions


• Employee files, credit records, loan records, medical records

but does not include:

• Title, business address, business telephone

Does it apply to your business?

YES !!

All commercial activities that involve the collection, use and disclosure of personal information such as:

• Development / Use of client list


• Joint Marketing


• Contests


• On-line activities


• Subscriptions


• Customer Profiling

What about Employment data?

Legal opinions say:

• If your company is not a federal work or undertaking such as a bank etc., and if your company does not have operations in BC, Alberta or Quebec, privacy legislation does not apply to your company with respect to employees’ personal information.

The Canadian Privacy Institute says:

• Personal Information about employees such as that disclosed to banks, payroll service bureaus, benefits carriers, pension companies etc. constitute a commercial transaction with a 3rd party and therefore is covered under the privacy legislation.

How does PIPEDA Work?

Revolves around 3 issues:

• Collection of personal information
• Use of personal information within your organization
• Disclosure of personal information to 3rd Parties

What the Commissioner wants:

• Clear policies
• Consent for each use
• Ability to opt out

What about obtaining consents?

Purposes for collection, use and disclosure must be limited and reasonable (reasonable person test)

• No vague statements
• No over-reaching
• No coercion

Rights of access and correction:

• Right to access information in databases
• Right to correct any erroneous information
• Right to have disagreement noted
• Right to have corrected information or a notice of disagreement sent to persons to whom the information has already been disclosed

How is PIPEDA Enforced?

Accountability / Supervision

• There must be someone responsible for your organization’s compliance

Existence of a public body to enforce the privacy law

• Hear and resolve complaints
• Investigate
• Mediate
• Recommend
• Issue orders to comply