|
|
Vol. 138, No. 15 — April 10, 2004
Organizations in the Province of British Columbia Exemption Order
Statutory Authority
Personal Information Protection and Electronic Documents Act
Sponsoring Department
Department of Industry
REGULATORY IMPACT
ANALYSIS STATEMENT
Description
Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) establishes rules to govern the collection, use and disclosure of personal information by organizations in the course of commercial activity. Part 1 of the Act was implemented in two stages. On January 1, 2001, the Act applied to the collection, use or disclosure of personal information in connection with the operation of federal works, undertakings or businesses and to the disclosure of personal information for consideration outside a province. On January 1, 2004, the Act's reach was extended to all collections, uses or disclosures of personal information in the course of commercial activity, either within or outside a province. Pursuant to paragraph 26(2)(b) of the Act, organizations or activities subject to provincial or territorial laws that have been deemed substantially similar by the Governor in Council, may, by order, be exempt from the PIPEDA in respect of the collection, use or disclosure of personal information within the province or territory.
Under the trade and commerce power conferred on Parliament by subsection 91(2) of The Constitution Act, 1867, PIPEDA establishes a set of economy-wide principles and rules for the protection of personal information. The Act helps to build trust and confidence in the Canadian marketplace, while encouraging provinces and territories to develop their own privacy laws in a manner that addresses their particular needs and circumstances. To this end, the Government of Canada included provisions in the PIPEDA to exempt from the federal Act organizations or activities subject to provincial or territorial laws that are deemed to be substantially similar.
On August 3, 2002, Industry Canada published the policy and criteria used to determine whether provincial or territorial legislation would be considered as substantially similar. The PIPEDA provides a standard around which provinces can legislate. Under the policy, laws that are substantially similar provide privacy protection that is consistent with and equivalent to that in the federal Act; incorporate the ten principles in the Canadian Standards Association (CSA) Model Code for the Protection of Personal Information, CAN/CSA-Q830-96, found in Schedule 1 of the PIPEDA; provide for an independent and effective oversight and redress mechanism with powers to investigate; and restrict the collection, use and disclosure of personal information to purposes that are appropriate or legitimate. In recognizing such laws as substantially similar, the PIPEDA provides a common standard for privacy protection across both federal and provincial domains.
The British Columbia Personal Information Protection Act, which came into force on January 1, 2004, is substantially similar to the PIPEDA. The purpose of this Order is thus to exempt from the PIPEDA organizations that are subject to this legislation for the collection, use or disclosure of personal information that occurs within the province of British Columbia. The PIPEDA will continue to apply to the collection, use or disclosure of personal information in connection with the operations of a federal work, undertaking or business (e.g. banks, airlines, telecommunications companies) in the province of British Columbia as well as to the collection, use or disclosure of personal information outside the province or territory.
Alternatives
The legislative framework in Part 1 of the Act requires that the designation of provincial or territorial laws as substantially similar to the Act be done through order in council. There are no alternatives to exempt from the federal Act organizations and activities subject to substantially similar provincial or territorial laws.
Benefits and costs
Benefits
The alignment of federal and provincial and territorial legislative regimes for the protection of privacy in the private sector makes privacy laws easier for individuals to understand and simpler for businesses to implement. Greater harmonization creates a consistent and seamless set of rules with regard to the protection of personal information, covering all businesses and organizations throughout the marketplace.
The PIPEDA's application to federal works, undertakings and businesses, and to cross-border flows of information, complements and enhances the privacy regimes of provinces where substantially similar laws are in place, thus making comprehensive privacy protection available to all Canadians.
Costs
The Order will have no adverse cost impact on the operations of organizations in British Columbia. Organizations subject to privacy legislation are expected to comply with a national standard set in the CSA Model Code for the Protection of Personal Information, CAN/CSA-Q830-96 that is embedded in the federal and in the provincial legislation. Both laws require that organizations comply with a set of 10 fair information principles and establish an independent oversight and redress mechanism. Following the issuance of this Order, complaints and investigations about the privacy-related practices of organizations in British Columbia will be handled solely by the Information and Privacy Commissioner for British Columbia in respect of transactions that take place within the province. Complaints and investigations involving federal works, businesses or undertakings and cross-border transactions will continue to involve the Privacy Commissioner of Canada.
Consultation
Canadian businesses and the general public, as well as provincial governments, have already been made aware of the federal government's commitment to exempt organizations subject to provincial and territorial laws that are substantially similar to the PIPEDA. During parliamentary consideration of the legislation, which included extensive hearings before the Standing Committee on Industry and the Senate Standing Committee on Social Affairs, Science and Technology, and through speeches, press releases and other communications to the public, the Government of Canada has clearly indicated that it intends to encourage provinces and territories to develop substantially similar privacy legislation, and that the federal Act would not apply to organizations subject to these laws for transactions taking place within the province or territory.
Provincial and territorial governments, along with the general public and the business community, were provided with additional information on the Act's substantially similar provision when Industry Canada published its policy and criteria for determining substantially similar provincial and territorial legislation in the Canada Gazette in August 2002.
Compliance and enforcement
This Order confirms that organizations in British Columbia will not be subject to the federal private sector privacy law. Compliance with privacy rules and enforcement of the British Columbia privacy law is delivered through the Information and Privacy Commissioner for British Columbia, in respect of the collection, use and disclosure of personal information that take place within the province. The Privacy Commissioner of Canada will continue to be responsible for providing oversight in relation to the activities of federal works, undertakings and businesses within the province and in relation to the collection, use and disclosure of personal information that crosses provincial boundaries in the course of commercial activity.
Contact
Mr. Richard Simpson, Director General, Electronic Commerce Branch, Industry Canada, 300 Slater Street, Room D2090, Ottawa, Ontario K1A 0C8, (613) 990-4292 (telephone), (613) 941-0178 (facsimile), simpson.richard@ic.gc.ca (electronic mail).
PROPOSED REGULATORY TEXT
Notice is hereby given that the Governor in Council, pursuant to paragraph 26(2)(b) of the Personal Information Protection and Electronic Documents Act, proposes to make the annexed Organizations in the Province of British Columbia Exemption Order.
Any interested person may make representations concerning the proposed Order within 15 days after the date of publication of this notice. All such representations must be addressed to Mr. Richard Simpson, Director General, Electronic Commerce Branch, Industry Canada, 300 Slater Street, Room D2090, Ottawa, Ontario K1A 0C8, and cite the Canada Gazette, Part I, and the date of this notice.
Ottawa, March 30, 2004
EILEEN BOYD
Assistant Clerk of the Privy Council
ORGANIZATIONS IN THE PROVINCE OF BRITISH COLUMBIA EXEMPTION ORDER
EXEMPTION
1. An organization, other than a federal work, undertaking or business, to which the Personal Information Protection Act, S.B.C. 2003, c. 63, of the Province of British Columbia, applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act, in respect of the collection, use and disclosure of personal information that occurs within the Province of British Columbia.
COMING INTO FORCE
2. This Order comes into force on the day on which it is registered.
[15-1-o]
|
