The Personal Information Protection and Electronic Documents Act (PIPEDA)
In Canada, the right to privacy is essentially protected as a quasi-constitutional right. At the federal level, two laws provide specific guarantees for the protection of personal information: the Privacy Act for the public sector and the Personal Information Protection and Electronic Documents Act (PIPEDA) for the private sector.
- Valid consent under PIPEDA requires a clear understanding on the part of individuals. It must be given in a reasonably understandable manner regarding the nature, purposes, and implications of the collection, use, or disclosure of personal data.
- Consent is required only for necessary and legitimate actions. For non-essential data, individuals must have a choice.
- The form of consent depends on the sensitivity of the collected data and the circumstances.
- Withdrawal of consent is possible, except in cases of legal or contractual restrictions, with reasonable notice. The consequences of withdrawal must be communicated.
How to Fulfill Your Responsibilities
Ensure that information about privacy protection is easily accessible in its complete form, by emphasizing or drawing attention to four key questions:
- What personal information is collected?
- How is this information used?
- With whom is this information shared?
- How is this information secured?
10 Compliance Tips for PIPEDA - Personal Information Protection Law and Electronic Documents:
Privacy protection is becoming increasingly important for consumers, which is why good privacy protection practices are good for business. Here are some tips to protect your clients' personal information and comply with federal law.
1
Obtain consent from your clients to collect their personal information and limit your collection and retention period.2
Ensure your employees receive adequate training on personal information protection.
3
Limit and control access to personal information and take appropriate measures when an employee accesses this information without authorization.4
Think carefully before collecting sensitive personal information, such as driver's license numbers.5
Inform your clients if you use video surveillance.
6
Have a privacy protection policy and be transparent about the personal information you collect and use.7
Protect personal information on laptops, USB drives, or hard drives using safeguards like encryption and passwords.8
Respond to requests for access to personal information in a timely manner.
9
Protect personal information against privacy breaches and report breaches that could result in serious harm to an individual.10
Ensure that your clients know whom to contact if they have questions about privacy protection.
