The Personal Information Protection and Electronic Documents Act (PIPEDA) sets out ground rules for how private sector organizations may collect, use or disclose personal information in the course of commercial activities.
When the Act took effect initially on January 1, 2001, it only applied to the commercial activities of what are known as federal works, undertakings or businesses, such as transportation and telecommunications companies, banks and broadcasters. It also applied to the personal information of employees in those companies, and it applied to personal information that is sold, leased, or bartered across provincial or national boundaries by provincially regulated organizations. It also applied to the commercial activities of businesses in the Territories.
As of January 1, 2004, PIPEDA began to cover the collection, use or disclosure of personal information in the course of all commercial activities in Canada, except in provinces which have enacted legislation that is deemed to be substantially similar to the federal law. The Act also applies to all personal information in all interprovincial and international transactions by all organizations subject to the Act in the course of their commercial activities.
Collection, use or disclosure of personal information in the course of commercial activities.
The Guide to PIPEDA helps businesses understand their obligations and comply with the Act. PIPEDA itself sets out ground rules for managing personal information in the private sector. It balances two things:
The Guide covers part I of the Act. For parts 2 to 5 of the Act (electronic documents and signatures as legal alternatives to original documents and signatures), please see Justice Canada's Web page about PIPEDA.
Commercial use of personal information within individual provinces
|
Organizations covered by PIPEDA must:
Personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as:
Personal information DOES NOT include the name, title, business address or telephone number of an employee of an organization.
The guide outlines a business's responsibilities under PIPEDA such as to:
Be accountable | Be accurate |
Identify the purpose | Use appropriate safeguards |
Obtain consent | Be open |
Limit collection | Give individuals access |
Limit use, disclosure and retention | Challenge compliance |
The Guide to PIPEDA for Businesses and Organizations is available on line or in hard copy (contact the Privacy Commissioner of Canada or visit their Web site). You will also find numerous handy fact sheets such as:
DISCLAIMER
Information contained in this section is of a general nature only and is not intended to constitute advice for any specific fact situation. For particular questions, the users are invited to contact their lawyer. For additional information, see contact(s) listed below.
Saskatchewan Contact(s):
See National Contact.