What is PIPEDA?

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian law on data privacy. It provides guidelines for businesses in the private sector, non-profit companies, and government organizations on gathering, handling, and sharing personal information during their commercial activities, including selling, trading, or renting any fundraising or membership lists.

What does PIPEDA classify as personal information?

PIPEDA Canada considers personal information as any data, whether combined with other information or by itself, that can identify an individual. Some categories include:

• Nationality, ethnicity, or race
• Name, age, identification numbers, and financial details
• DNA information
• Blood type
• Marital status
• Biometrics data, including fingerprints, facial recognition, and retinal scans
• IP addresses or device identifiers
• Sexual orientation or gender identity
• Opinions, comments, social status, evaluations, and disciplinary records
• Social insurance number or driver’s license, employment, medical, and educational history
• Employee records, loan information, and credit reports

Exemptions to PIPEDA

PIPEDA does not cover all personal information or apply to every organization. There are exceptions, such as organizations that operate entirely within provinces or territories with similar privacy laws, those handling personal information for journalistic or artistic purposes, and when someone uses employee data for employment reasons. Business owners can check if PIPEDA applies to their operations, and if it does, they can align their practices with its guidelines. Not doing so can result in fines, damage a company’s reputation, and disintegrate customer trust.

Provincial and territorial compliance with PIPEDA

Although PIPEDA is a federal privacy law that applies across Canada, some provinces and territories have rules on how businesses can collect, use, and share personal information. These laws may align with or differ from PIPEDA’s requirements. For instance, Quebec, British Columbia, and Alberta have their private-sector privacy laws. Businesses operating solely within these provinces may follow provincial regulations rather than PIPEDA. However, if a company operates in multiple regions, PIPEDA might still apply.

In Ontario, PIPEDA covers most private-sector organizations, but the province also has its law, the Personal Health Information Protection Act (PHIPA), governing healthcare providers’  handling of health data. Provinces like New Brunswick, Nova Scotia, Newfoundland, and Labrador do not have separate private-sector privacy laws, but they do have legislation concerning personal health information. Businesses in these provinces still need to comply with PIPEDA. Federally regulated companies, like banks, telecom providers, and airlines, follow PIPEDA and may have other rules to meet. For example, the General Data Protection Regulation (GDPR) is a privacy law that applies to businesses in the European Union and can also affect organizations outside the EU if they handle personal data from EU residents.

Primary requirements of PIPEDA

The Personal Information Protection and Electronic Documents Act expects organizations to follow several guidelines regarding personal information, including:

Transparency

Be clear about your policies and practices for managing personal information and ensure that this information is easily accessible to the public.

Accountability

Organizations are responsible for any personal data they collect and must designate someone to ensure compliance with privacy laws in Canada.

Consent

Ask for consent before collecting, using, or sharing an individual’s information.

Collection restriction

Restrict collecting personal information to only what is necessary for the original purpose.

Limit use and retention

Only use or share personal data for its original purpose unless the individual consents otherwise and retain the information only for as long as needed.

Identify the purpose

Specify the reasons for collecting personal information at the time of collection.

Safeguards

Use security measures to protect personal information based on sensitivity.

Accuracy

Ensure all personal data is as accurate and current as possible to meet its intended purpose.

Individual access

Individuals have the right to know how companies use, disclose, share, and store their personal information. They can ask for access and corrections to this data to ensure accuracy.

Challenge compliance

Individuals can challenge how your organization follows these principles and direct their concerns to the designated person responsible for PIPEDA compliance.

Who oversees PIPEDA?

The Office of the Privacy Commissioner of Canada (OPC) oversees how well organizations comply with PIPEDA and works to protect individuals’ rights. The OPC deals with privacy-related complaints and can enforce actions against businesses that breach the Canadian Privacy Act. Not complying could lead to severe consequences for organizations. For instance, fines can reach up to $100,000 per violation. Individuals impacted by a breach might be entitled to compensation for any harm they experience. Prioritizing PIPEDA compliance can help avoid penalties and maintain customer trust. Setting clear policies and procedures for safeguarding personal information, training employees on PIPEDA guidelines, regularly reviewing policies, and updating privacy practices can keep you compliant with ongoing law changes.

Compliance checklist

To ensure your company is following PIPEDA guidelines, consider using this compliance checklist:

• Assign someone within your organization to oversee compliance.
• Learn the key PIPEDA requirements.
• Determine if PIPEDA applies to your company, especially if you handle personal information for commercial purposes in Canada.
• Create explicit policies to meet PIPEDA standards and outline these procedures to make them transparent to consumers.
• Keep thorough records of the personal information you collect, who provides consent, how you plan to use the data, and when you will dispose of it.
• Inform individuals about how you will handle their personal information and explain how they can access and correct their data if needed.

Data discovery

Businesses may struggle with balancing PIPEDA compliance while using data to stimulate company growth. Data discovery can help you answer essential questions such as:

• What personal or sensitive information does the company have?
• Where is this information stored?
• Why was it collected?
• How is it being used?
• When does the organization dispose of the data?

Data discovery tools can empower your company to locate, track, and manage data on desktops, servers, databases, and e-mails, in the cloud, or on-site. The most advanced data discovery tools can keep your organization compliant with PIPEDA and prepare you for future regulations. These tools often come with built-in intelligence that monitors compliance with laws like PIPEDA and automatically detects personal and sensitive data, especially during breaches.

Frequently asked questions about PIPEDA

Here are answers to some frequently asked questions about PIPEDA:

What consumer rights does PIPEDA protect?

PIPEDA gives consumers essential rights over their personal information. They have the right to know how organizations collect, use, store, and share their data. Consumers can access their information and ask for corrections if needed. They can also withdraw consent for companies to collect or use their data anytime. If they feel companies are violating their privacy rights, they can submit a complaint to the OPC. Organizations must protect personal information with proper security measures based on its sensitivity.

What happens when there’s a breach?

When a PIPEDA breach occurs, organizations must notify the OPC and the affected individuals if there is a significant risk of harm, providing detailed information about the breach and protective measures. They must maintain records of all violations for at least two years to ensure transparency and accountability. The OPC may investigate the violation to assess compliance, possibly leading to corrective actions. Organizations that fail to report breaches or keep adequate records can face financial penalties of up to $100,000 per violation. Breaches can damage an organization’s reputation such that it loses consumer trust, while affected individuals may pursue compensation through lawsuits or settlements, impacting the organization legally and financially.

How can individuals request access to their personal information?

Individuals can request to see their personal information by contacting the organization directly. The organization must respond within a reasonable time frame and provide a copy of the requested information. If the company denies access, it must give individuals the reasons for refusal.

What can consumers do if an organization refuses to correct inaccurate information?

If an organization refuses to correct inaccurate personal information, consumers can challenge the decision by speaking with the OPC, who may investigate and issue recommendations to resolve the matter.