Complying with the Personal Information Protection and Electronic Documents ActIn Canada, we are protected by two federal privacy laws. The Privacy Act covers the personal information-handling practices of the federal government and the Personal Information Protection and Electronic Documents (PIPED) Act is Canada's new private sector privacy law, which came fully into effect on January 1, 2004. The Office of the Privacy Commissioner of Canada is here to help provide information and guidance to businesses across Canada as they gear up for the implementation of the PIPED Act. Good privacy is good businessIn an increasingly competitive marketplace, businesses rely on personal information to identify and stay in touch with their customers. They use it to seek out new customers who might be interested in their products. They want to find out what the market is looking for and what it will bear. And they want information about their employees, so that they can administer benefits and ensure a safe and productive workplace. Obtaining and using that personal information in ways that don't offend the fundamental human right of privacy is the challenge for modern businesses. Respecting and protecting privacy is a key element of good customer relations — and that makes it a key element of competitive advantage. Your customers want privacy, your employees need it and your competitors are going to provide it. It's not an abstract legal concept. It's simple consideration, respect and courtesy — the essence of a good relationship with your customers and employees. Showing respect for privacy is part of showing respect for your customer, and respecting your customer is the cornerstone of a strong customer relationship. The PIPED Act in briefThe PIPED Act sets out ground rules for how private sector organizations can collect, use or disclose personal information in the course of commercial activities. It balances an individual's right to privacy with the need of organizations to collect, use or disclose personal information for legitimate business purposes. The PIPED Act has been coming into effect in stages. As of January 2001, the Act has applied to personal information about customers or employees in the federally-regulated sector in the course of commercial activities. It also applies to information sold across provincial and territorial boundaries. As of January 2002, the Act has also applied to personal health information collected, used or disclosed by these organizations. Since January 1, 2004, the PIPED Act applies right across the board — to all personal information collected, used or disclosed in the course of commercial activities by all private sector organizations, except provinces which have, by then, enacted legislation that is deemed to be substantially similar to the federal law. To date, Quebec is the only province with legislation that is substantially similar to the PIPED Act. Although the application of the Act expanded in 2004 to commercial activities that normally fall under provincial jurisdiction, it does not extend to employment in those activities. The only place the PIPED Act applies to employment is in federal works, undertakings, or businesses. This means that if you are operating a federal work, undertaking or business — the PIPED Act applies to your employment practices. But for the rest of businesses, it does not. It's a good idea for businesses and organizations to review their privacy practices in employment anyway, because it's very likely that provincial privacy laws will apply to employment. The basic outline of the PIPED Act looks like this:
Your responsibilities under the PIPED ActThe PIPED Act reflects the realities of the business world. It's based on the Canadian Standards Association's Model Code for the Protection of Personal Information, which is incorporated into the legislation. The Code came out of a collaborative effort by representatives of government, consumers and business groups, and lists 10 principles of fair information practices, which are summarized as follows:
Individuals who feel their privacy rights have been infringed upon can complain to the Privacy Commissioner of Canada. The Commissioner's role is that of an ombudsman, trying to find solutions to privacy problems, resolving complaints through negotiation and persuasion, and using mediation and conciliation if appropriate. What is personal information?Personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as:
Personal information does not include the name, title, business address or telephone number of an employee of an organization. What is not covered by the Act?
For more informationWe recognize that gearing up to protect privacy isn't easy. It takes time, attention and resources. But part of our job is to help you with it. For more information to help your business prepare for the implementation of the PIPED Act, contact the Office of the Privacy Commissioner of Canada at 1-800-282-1376 and request a copy of our Guide for Businesses and Organizations: Your Privacy Responsibilities free of charge This Guide also includes a Privacy Questionnaire with some common sense questions you can use to help you get started. For this and other useful information, such as the Commissioner's findings under the PIPED Act, you can also visit our Web site at www.privcom.gc.ca or you can write to us at: Office of the Privacy Commissioner of Canada112 Kent Street Ottawa, ON K1A 1H3 |
Date published: 2004-02-02 |
Important Notices |