Personal Information Protection and Electronic Documents Act (PIPEDA)

PIPEDA has been implemented over the last four years with the final enactment being in place as of January 1, 2004. Generally this legislation establishes the rules, exceptions and remedies for how organizations may collect, use, or disclose information about you in the course of commercial activities. This law also gives persons the right to review information that organizations may have collected about you and provides you with the opportunity to ask for corrections to this information if it is incorrect.

The Department of Justice has indicated that the purpose of the Personal Information Protection and Electronic Documents Act

“is to provide Canadians with a right of privacy with respect to their personal information that is collected, used , or disclosed by an organization in the private sector in an era in which technology increasingly facilitates the collection and free flow of information”.

The Department has further indicated that

"Personal information" under the Act means information about an "identifiable individual."

Personal information includes:

• name, age, weight, height
• medical records
• income , purchases, and spending habits
• race, ethnic origin, and colour
• blood type, DNA code, fingerprints
• marital status and religion
• education; and
• home address and phone number

Personal information does not include:

• the name, job title, business address , or office telephone number of an employee of an organization.

Rules, exceptions and remedies

PIPEDA has been implemented over the last four years with the final enactment being in place as of January 1, 2004. Generally this legislation establishes the rules, exceptions , and remedies for how organizations may collect, use, or disclose information about you in the course of commercial activities. This law also gives you the right to review information that organizations may have collected and provides you with the opportunity to ask for correction to this information if it is incorrect.

The law also gives you the right to see and ask for corrections to information an organization may have collected about you. If you think an organization covered by the Act is not living up to its responsibilities under the law, you have the right to lodge an official complaint.

The PIPEDA Guide, prepared by the Federal Department of justice explains as follows:

The PIPEDA gives you the right to:

• know why an organization collects, uses , or discloses your personal information;
• expect an organization to collect, use , or disclose your personal information reasonably and appropriately, and not use the information for any purpose other than that to which you have consented;
• know who in the organization is responsible for protecting your personal information;
• expect an organization to protect your personal information by taking appropriate security measures;
• expect the personal information an organization holds about you to be accurate, complete , and up-to-date;
• obtain access to your personal information and ask for corrections if necessary; and
• complain about how an organization handles your personal information if you feel your privacy rights have not been respected.

This law requires organizations to:

• obtain your consent when they collect, use , or disclose your personal information;
• supply you with a product or a service even if you refuse consent for the collection, use , or disclosure of your personal information unless that information is essential to the transaction;
• collect information by fair and lawful means; and
• have personal information policies that are clear, understandable , and readily available.

An organization should also, destroy, erase , or make anonymous personal information about you when it is no longer needed, in order to fulfill the purpose for which it was collected.

Exceptions

The department of Justice allows certain exceptions to these principles. For example, organizations may not need your consent in obtaining information about you if collecting the information clearly benefits you and your consent cannot be obtained in a timely way; if the information is needed by a law enforcement agency for an investigation and getting consent might compromise the information's investigative integrity.

You can find out about the information that an organization has collected about you by:

• Sending a written request to the organization that holds your personal information. However, you must provide details that will allow the organization to identify the information you want. This could include dates, subscription, account numbers , or reference numbers, or the names and positions of the people you may have dealt with at the organization , or who may have collected this information .
• Organizations must provide the information requested within a reasonable time and at minimal or no cost.

If you find there are errors or omissions in your personal information you may:

• Write to the organization and explain what the correction is that you are requesting, and why you are making the request. Supply copies of any documents that you have that support your request.
• If the organization declines to make the corrections that you are requesting, you may require it to attach a statement of your disagreement or request to your file. This statement must then be passed on to any other organization that may be allowed access to the information.

If you believe your privacy rights are not being respected, the Act allows you to make a complaint if:

• An organization refuses to divulge the personal information it has collected about you, or it refuses to correct the information that you have told them is inaccurate or incorrect, or if you think that that this information has been improperly collected used or disclosed .
• If you believe an organization is not following the provisions of PIPEDA .

You can send your complaint to:
Office of the Privacy Commissioner of Canada at
112 Kent Street
Place de Ville
Tower B, 3rd Floor
Ottawa , Ontario
K1A 1H3
or call,1-800-282-1376 if you need more information or advice on how you should proceed.

The role of the privacy commissioner is to:

• Attempt to resolve disputes through negotiation, mediation , and conciliation.
• Investigate your complaint.
• Initiate an investigation or a review regarding how an organization handles personal information.
• Recommend that the organization release your personal information to you or correct any inaccuracies.
• Recommend to organizations that they change their personal information handling practices.
• Report the findings of the investigation to you and the organization.

If the organization ignores the recommendations of the Privacy Commissioner:

• The Commissioner has the power to make public any information about the personal information handling practices of an organization.
• The Commissioner may take the complaint to the Federal Court of Canada.
• You may, under certain circumstances, take your complaint to the Federal Court of Canada.
• The Court can order an organization to correct any practices that do not comply with the law, and publish notices of how it has or will correct its practices.
• The Court can also award damages to the complainant .

PIPEDA does not cover:

• Federal government organizations already covered by the Privacy Act.
• Provincial or territorial governments and their agents.
• Organizations that collect, use , or disclose personal information , solely , for journalistic, artistic , or literary purposes.
• Individual’s that collect, use , or disclosure personal information for their own purposes, such as genealogical research shared with other family members .