PIPEDA

PIPEDA stands for the Personal Information Protection and Electronic Documents Act. It is a federal privacy law in Canada that governs how private-sector organizations collect, use, and disclose personal information in the course of commercial activities. It was enacted in 2000 and came into force in 2001. The act is administered and enforced by the Office of the Privacy Commissioner of Canada (OPC), which investigates complaints, conducts audits, and makes recommendations.

Scope and application: PIPEDA applies to organizations across Canada in the private sector. Where a province has enacted a substantially similar private-sector privacy law (notably Alberta, British Columbia, and Quebec), PIPEDA may not apply to private-sector activities in those provinces for matters covered by the provincial law. It covers personal information in the context of commercial activities, with certain exemptions for personal or domestic use and other specific situations.

Principles and rights: PIPEDA is built on ten fair information practices: accountability; identifying purposes; consent; limiting collection; limiting use, disclosure, and retention; accuracy; safeguards; openness; individual access; and challenging compliance. Individuals have the right to access personal information held by organizations, request corrections, and withdraw consent in certain circumstances. Organizations must obtain consent for collection, use, and disclosure, except in certain permitted circumstances, and must have clear privacy policies and procedures.

Security and breach notification: Organizations must safeguard personal information with appropriate security safeguards. Since the 2015 amendments, organizations must notify affected individuals and report to the OPC when a breach of security safeguards is likely to result in significant harm.

Enforcement: The OPC can investigate complaints, issue privacy orders, and refer matters to federal courts if necessary. PIPEDA does not generally create a private right of action for individuals.