Municipalities, Universities, Schools, and Hospitals

Our office is frequently asked about the application of the Personal Information Protection and Electronic Documents Act (PIPEDA) to the activities of municipalities, universities, schools, and hospitals, often referred to as the "MUSH" sector.

The Application of the Act

PIPEDA applies to every organization that collects, uses or discloses personal information in the course of commercial activities. PIPEDA defines commercial activity as:

"any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists."

The term organization "includes an association, a partnership, a person and a trade union." The definition of organization is intended to be broad and inclusive.

The federal government may exempt organizations and/or activities in provinces that are deemed to have adopted substantially similar privacy legislation. In those provinces that have passed substantially similar legislation, PIPEDA will continue to apply to the federally regulated private sector — such as banks, airlines, telephone and broadcasting companies, and railways — and to personal information in interprovincial and international transactions by all organizations engaged in commercial activities. To date, three provinces — Quebec, Alberta and British Columbia — have passed substantially similar legislation.

PIPEDA and the MUSH Sector

The Constitution Act, 1867 gives the provinces authority over municipal institutions, education and hospitals. PIPEDA is based on the federal government's jurisdiction over "the regulation of trade and commerce."

While municipalities, educational institutions and hospitals may occasionally provide services on a fee basis, they are not, on the whole, engaged in trade and commerce as contemplated by the Canadian Constitution. Furthermore, these institutions are completely or largely dependent on municipally or provincially levied taxes and provincial grants.

As a result, our Office is of the view that, as a general rule, PIPEDA does not apply to the core activities of municipalities, universities, schools, and hospitals. By core activities we mean those activities that are central to the mandate and responsibilities of these institutions.

Providing a service for a fee does not necessarily trigger the application of the Act if the service is part of the institution's core activities. For example, charging a fee for a private room or charging extra for a fiberglass cast does not automatically make a hospital or even that transaction subject to the Act. Similarly, a municipality can charge a per bag fee to collect garbage, or charge for the use of a playing field or arena, without becoming subject to the Act.

A municipality, university, school or hospital may become subject to the Act when it engages in a non-core commercial activity, unless substantially similar provincial legislation applies. For example, if a university sold or bartered an alumni list, that activity would be considered a commercial activity and that particular transaction would be subject to the Act. As well, personal information collected by a university or a hospital in the course of operating a parking garage would probably be subject to the Act since this would not be considered a core activity.

A coffee shop in a hospital or university, a TV rental service in a hospital, a university bookstore or any other business operated by a third party within one of these institutions would be subject to the Act just as a coffee shop in a shopping mall is subject to the Act, unless substantially similar provincial legislation applies.

Private educational institutions and private hospitals are in a different situation. These institutions are more clearly engaged in commercial activities and we would recommend that they operate on the assumption that they are subject to PIPEDA, unless substantially similar provincial legislation applies.

The Health Care Sector

The core activities of public hospitals or publicly funded long-term care facilities are not subject to PIPEDA. However, health care providers in private practice such as doctors, dentists and chiropractors are engaged in a commercial activity and thus subject to the Act, unless substantially similar provincial legislation applies. For additional information on the application of PIPEDA to the health care sector see http://e-com.ic.gc.ca/epic/internet/inecic-ceac.nsf/en/h_gv00207e.html. Alberta, Saskatchewan, Manitoba and Ontario have enacted personal health information legislation that applies to the health care sector, including hospitals. Quebec's Act respecting health services and social services also contains important provisions regarding personal health information.

Provincial Legislation

In many provinces, personal information collected by municipalities, universities, schools and hospitals is protected by provincial legislation. Typically, this is public sector legislation, often a Freedom of Information and Protection of Privacy Act. In some cases, health information protection acts and private sector acts may also apply. For additional information on relevant provincial legislation see http://www.privcom.gc.ca/information/comms_e.asp.

The Territories

The situation in the three Territories is somewhat more complex. PIPEDA applies to all federal works, undertakings and businesses (FWUBs) and to the personal information of employees of FWUBs. A FWUB is "any work, undertaking or business that is within the legislative authority of Parliament.

Since all organizations in the Territories are considered to be FWUBs, PIPEDA applies to information about employees of municipalities, universities, schools and hospitals in the Territories.

However, PIPEDA does not apply to patient or student information in publicly funded hospitals or schools in the Territories because they are not considered to be engaged in commercial activities.