The ''Personal Information Protection and Electronic Documents Act'' (PIPEDA; french: Loi sur la protection des
renseignements personnels et
les documents électroniques) is a Canadian law relating to
data privacy
Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as data pr ...
. It governs how
private sector
The private sector is the part of the economy, sometimes referred to as the citizen sector, which is owned by private groups, usually as a means of establishment for profit or non profit, rather than being owned by the government.
Employment
The ...
organizations collect, use and disclose personal information in the course of commercial business. In addition, the ''Act'' contains various provisions to facilitate the use of
electronic document
An electronic document is any electronic media content (other than computer programs or system files) that is intended to be used in either an electronic form or as printed output. Originally, any computer data were considered as something inter ...
s. PIPEDA became law on 13 April 2000 to promote consumer trust in
electronic commerce
E-commerce (electronic commerce) is the activity of electronically buying or selling of products on online services or over the Internet. E-commerce draws on technologies such as mobile commerce, electronic funds transfer, supply chain manageme ...
. The act was also intended to reassure the
European Union
The European Union (EU) is a supranational political and economic union of member states that are located primarily in Europe. The union has a total area of and an estimated total population of about 447million. The EU has often been des ...
that the
Canadian privacy law
Canadian privacy law is derived from the common law, statutes of the Parliament of Canada and the various provincial legislatures, and the ''Canadian Charter of Rights and Freedoms''. Perhaps ironically, Canada's legal conceptualization of privacy ...
was adequate to protect the personal information of
European citizens
European Union citizenship is afforded to all citizens of member states of the European Union (EU). It was formally created with the adoption of the 1992 Maastricht Treaty, at the same time as the creation of the EU. EU citizenship is additio ...
. In accordance with section 29 of PIPEDA, Part I of the ''Act'' ("Protection of Personal Information in the Private Sector") must be reviewed by
Parliament
In modern politics, and history, a parliament is a legislative body of government. Generally, a modern parliament has three functions: Representation (politics), representing the Election#Suffrage, electorate, making laws, and overseeing ...
every five years. The first Parliamentary review occurred in 2007.
PIPEDA incorporates and makes mandatory provisions of the
Canadian Standards Association
The CSA Group (formerly the Canadian Standards Association; CSA) is a standards organization which develops standards in 57 areas. CSA publishes standards in print and electronic form, and provides training and advisory services. CSA is composed ...
's Model Code for the Protection of Personal Information, developed in 1995. However, there are a number of exceptions to the Code where information can be collected, used and disclosed without the consent of the individual. Examples include reasons of national security, international affairs, and emergencies. Under the ''Act'', personal information can also be disclosed without knowledge or consent to investigations related to
law enforcement
Law enforcement is the activity of some members of government who act in an organized manner to enforce the law by discovering, deterring, rehabilitating, or punishing people who violate the rules and norms governing that society. The term en ...
, whether federal, provincial or foreign. There are also exceptions to the general rule that an individual shall be given access to his or her personal information. Exceptions may include information that would likely reveal personal information about a third party, information that cannot be disclosed for certain
legal
Law is a set of rules that are created and are enforceable by social or governmental institutions to regulate behavior,Robertson, ''Crimes against humanity'', 90. with its precise definition a matter of longstanding debate. It has been vario ...
,
security" \n\n\nsecurity.txt is a proposed standard for websites' security information that is meant to allow security researchers to easily report security vulnerabilities. The standard prescribes a text file called \"security.txt\" in the well known locat ...
, or commercial proprietary reasons, and information that is subject to
solicitor-client privilege
In common law jurisdictions, legal professional privilege protects all communications between a professional legal adviser (a solicitor, barrister or attorney) and his or her clients from being disclosed without the permission of the client. ...
.
Overview
"Personal Information", as specified in PIPEDA, is as follows: information about an identifiable individual, but does not include the name, title or business address, or telephone number of an employee of an organization.
The ''Act'' gives individuals the right to
* know why an organization collects, uses, or discloses their
personal information
Personal data, also known as personal information or personally identifiable information (PII), is any information related to an identifiable person.
The abbreviation PII is widely accepted in the United States, but the phrase it abbreviates ha ...
;
* expect an organization to collect, use or disclose their personal information reasonably and appropriately, and not use the information for any purpose other than that to which they have consented;
* know who in the organization is responsible for protecting their personal information;
* expect an organization to protect their personal information by taking appropriate security measures;
* expect the personal information an organization holds about them to be accurate, complete, and up-to-date;
* obtain access to their personal information and ask for corrections if necessary; and
* complain about how an organization handles their personal information if they feel their privacy rights have not been respected.
The ''Act'' requires organizations to
* obtain consent when they collect, use, or disclose their personal information;
* supply an individual with a product or a service even if they refuse consent for the collection, use, or disclosure of your personal information unless that information is essential to the transaction;
* collect information by fair and lawful means; and
* have personal information policies that are clear, understandable, and readily available.
Implementation
The implementation of PIPEDA occurred in three stages. Starting in 2001, the law applied to federally regulated industries (such as
airline
An airline is a company that provides civil aviation, air transport services for traveling passengers and freight. Airlines use aircraft to supply these services and may form partnerships or Airline alliance, alliances with other airlines for ...
s,
bank
A bank is a financial institution that accepts deposits from the public and creates a demand deposit while simultaneously making loans. Lending activities can be directly performed by the bank or indirectly through capital markets.
Because ...
ing and
broadcasting
Broadcasting is the distribution (business), distribution of sound, audio or video content to a dispersed audience via any electronic medium (communication), mass communications medium, but typically one using the electromagnetic spectrum (radio ...
). In 2002, the law was expanded to include the health sector. Finally in 2004, any organization that collects personal information in the course of commercial activity was covered by PIPEDA, except in provinces that have "substantially similar" privacy laws. As of October 2018, seven provinces have privacy laws that have been declared by the federal Governor in Council to be substantially similar to PIPEDA:
* ''An Act Respecting the Protection of Personal Information in the Private Sector'' (Quebec)
* ''The Personal Information Protection Act'' (British Columbia)
* ''The Personal Information Protection Act'' (Alberta)
* ''The Personal Health Information Protection Act'' (Ontario), "with respect to health information custodians"
* ''The Personal Health Information Privacy and Access Act'' (New Brunswick), "with respect to personal health information custodians"
* ''The Personal Health Information Act'' (Newfoundland and Labrador), "with respect to health information custodians"
* ''The Personal Health Information Act'' (Nova Scotia), "with respect to health information custodians"
* ''Memorandum of Understanding''
''Personal Information Protection Act'' (British Columbia)
Notable provisions of PIPA:
* Consent must be garnered for the collection of personal information
* Collection of personal information limited to reasonable purposes
* Limits use and disclosure of personal information
* Limits access to personal information
* Stored personal information must be accurate and complete
* Designates the role of the Privacy Officer
* Policies and procedures for breaches of privacy
* Measures for resolution of complaints
* Special rules for employment relationships
''Personal Health Information Protection Act'' (Ontario)
The ''Personal Health Information Protection Act'', known by its acronym PHIPA (typically pronounced 'pee-hip-ah'), established in 2004, outlines privacy regulations for health information custodians in
Ontario
Ontario ( ; ) is one of the thirteen provinces and territories of Canada.Ontario is located in the geographic eastern half of Canada, but it has historically and politically been considered to be part of Central Canada. Located in Central Ca ...
, Canada. Breaches of PHIPA are directed to the Ontario Information and Privacy Commissioner.
The ''Personal Health Information Protection Act'' serves three important functions:
* To govern the collection, use, and disclosure of personal health information by health information custodians.
* To provide patients with a right to request access to and correction of their records of personal health information held by health information custodians.
* To impose administrative requirements (regulations) on custodians with respect to records of personal health information.
Amendment
On June 18, 2015, the ''Digital Privacy Act'' (Senate Bill S-4) became law, amending the PIPEDA to include a business transaction exemption, mandatory breach notification requirements, enhanced powers for the Privacy Commissioner, and various other updates.
The PIPEDA sets out ground rules for how private sector organizations may collect, use or disclose personal information in the course of commercial activities. PIPEDA also applies to federal works, undertaking,s and business in respect of employee personal information. The law gives individuals the right to access and request correction of the personal information these organizations may have collected about them.
In general, PIPEDA applies to organizations' commercial activities in all provinces, except organizations that collect, use or disclose personal information entirely within provinces that have their own privacy laws, which have been declared substantially similar to the federal law. In such cases, it is the substantially similar provincial law that will apply instead of PIPEDA, although PIPEDA continues to apply to federal works, undertakings or businesses and to interprovincial or international transfers of personal information.
Remedies
The ''Act'' does not create an automatic right to
sue for violations of the law's obligations. Instead, PIPEDA follows an
ombudsman model in which complaints are taken to the
Office of the Privacy Commissioner of Canada
The privacy commissioner of Canada (french: Commissaire à la protection de la vie privée du Canada) is a non-partisan ombudsman and officer of the Parliament of Canada. The commissioner investigates complaints regarding violations of the fed ...
. The Commissioner is required to investigate the complaint and to produce a report at its conclusion. The report is not binding on the parties but is more of a recommendation. The Commissioner does not have any powers to order compliance, award damages, or levy penalties. The organization complained about does not have to follow the recommendations. The complainant, with the report in hand, can then take the matter to the
Federal Court of Canada
The Federal Court of Canada, which succeeded the Exchequer Court of Canada in 1971, was a national court of Canada that had limited jurisdiction to hear certain types of disputes arising under the federal government's legislative jurisdiction. ...
. The responding organization cannot take the matter to the courts, because the report is not a decision and PIPEDA does not explicitly grant the responding organization the right to do so.
PIPEDA provides, at section 14, the complainant the right to apply to the
Federal Court of Canada
The Federal Court of Canada, which succeeded the Exchequer Court of Canada in 1971, was a national court of Canada that had limited jurisdiction to hear certain types of disputes arising under the federal government's legislative jurisdiction. ...
for a hearing with respect to the subject matter of the complaint. The Court has the power to order the organization to correct its practices, to publicize the steps it will take to correct its practices, and to award damages.
Proposed Bill C-475
As a result of long-enduring and central gap in Canada's privacy protections, Bill C-475 was proposed in February 2013 by Charmaine Borg, MP, proposing several amendments to the ''Act''. Bill C-475 was defeated in January 2014.
See also
* ''
Fighting Internet and Wireless Spam Act
The ''Fighting Internet and Wireless Spam Act'' (the ''Act'', french: Loi visant l’élimination des pourriels sur les réseaux Internet et sans fil), is Canada's anti-spam legislation (also known as CASTL) that received Royal Assent on December 1 ...
''
*
Information privacy law
Information privacy, data privacy or data protection laws provide a legal framework on how to obtain, use and store data of natural persons. The various laws around the world describe the rights of natural persons to control who is using its dat ...
*
Information privacy
Information privacy is the relationship between the collection and dissemination of data, technology, the public expectation of privacy, contextual information norms, and the legal and political issues surrounding them. It is also known as data pr ...
References
External links
''Personal Information Protection and Electronic Documents Act''*
ttp://www.privacylawyer.ca/blog/index.html The Canadian Privacy Law Blog:A regularly updated blog on issues related to privacy law and PIPEDA written by David T. S. Fraser, a Canadian privacy lawyer.
Overview of Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA):An overview of Canada's PIPEDA, where Canadian federal is discussed thoroughly.
{{DEFAULTSORT:Personal Information Protection And Electronic Documents Act
2000 in Canadian law
Canadian federal legislation
Information privacy
Privacy in Canada
Privacy legislation in Canada