Protection of Personal Information - Your Responsibilities

To Whom Does This Apply?

Since the Act took effect on January 1, 2001 it has applied mainly to the commercial activities of what are known as federal works, undertakings or businesses, such as transportation and telecommunications companies, banks and broadcasters. It also applies to the personal information of employees in those companies, and it applies to personal information that is sold, leased, or bartered across provincial or national boundaries by provincially regulated organizations. And it applies to the commercial activities of businesses in the Territories.

As of January 1, 2002, the personal health information collected, used or disclosed by these organizations is also covered.

As of January 1, 2004, the PIPED Act covers the collection, use or disclosure of personal information in the course of all commercial activities in Canada, except in provinces which have enacted legislation that is deemed to be substantially similar to the federal law.

Eligible Activities

Collection, use or disclosure of personal information in the course of commercial activities.

Summary

The Guide to the Act helps businesses understand their obligations and comply with the Act. The Act itself sets out ground rules for managing personal information in the private sector. It balances two things:

• an individual's right to the privacy of personal information; and
• the need of organizations to collect, use or disclose personal information for legitimate business purposes.

The Guide covers part I of the Act. For parts 2 to 5 of the Act (electronic documents and signatures as legal alternatives to original documents and signatures), please see Justice Canada's Web page about the Act.

The Act in Brief

Organizations covered by the Act must:

• obtain an individual's consent when they collect, use or disclose the individual's personal information;
• allow the individual to access their personal information;
• allow the individual to challenge the accuracy of their personal information;
• only use the personal information for the purposes for which it was collected;
• obtain additional consent if the personal information is going to be used for another purpose;
• assure the individuals that their information will be protected by specific safeguards e.g., locked cabinets, computer passwords or encryption.

Personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as:

• age, name, ID numbers, income, ethnic origin, or blood type;
• opinions, evaluations, comments, social status, or disciplinary actions;
• employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs).

Personal information DOES NOT include the name, title, business address or telephone number of an employee of an organization.

The guide outlines a business's responsibilities under the Act such as to:

The Guide to PIPEDA for Businesses and Organizations is available on line or in hard copy (contact the Privacy Commissioner of Canada or visit their Web site). You will also find numerous handy fact sheets such as:

Examples of Fact Sheets

• The Application of the PIPEDA to Charitable and Non-Profit Organizations
• Application of the PIPEDA to Employee Records
• Privacy in the workplace

DISCLAIMER
Information contained in this section is of a general nature only and is not intended to constitute advice for any specific fact situation. For particular questions, the users are invited to contact their lawyer. For additional information, see contact(s) listed below.

Yukon Contact(s):
See National Contact.