Privacy Guide for Businesses
Total Page:16
File Type:pdf, Size:1020Kb
Privacy Guide for Businesses What Canadian businesses need to know to comply with federal privacy law For more information, contact: Office of the Privacy Commissioner of Canada 30 Victoria Street, 8th floor Gatineau, QC K1A 1H3 Telephone: (819) 994-5444 Toll-free: 1-800-282-1376 TTY: (819) 994-6591 For more information visit: priv.gc.ca/business Follow us on Twitter: @privacyprivee While prepared with care to ensure accuracy and completeness, this guide has no legal status. For the official text of the law, visit our website at priv.gc.ca/business or call the Office of the Privacy Commissioner of Canada. Cat. No. IP54-94/2019E ISBN 978-0-660-32104-2 Updated September 2020 This guide deals only with Part 1 of the Act. All references to the Act in this document refer only to Part 1. Parts 2 to 5 of the Act concern the use of electronic documents and signatures as legal alternatives to original documents and signatures. For information on these, please contact the Department of Justice. Table of contents Overview .................................................................................... .2 Role of the Office of the Privacy Commissioner of Canada .......................................... 3 PIPEDA in brief ..................................................................................... 3 How the act applies ................................................................................ 4 What is personal information? ...................................................................... 5 What is not covered by PIPEDA? .................................................................... 5 Your responsibilities under PIPEDA ................................................................. 5 Fair information principles ................................................................... 6 1 Be accountable. 7 2 Identify the purpose ........................................................................... 10 3 Obtain valid, informed consent ................................................................. 12 4 Limit collection ................................................................................ 15 5 Limit use, disclosure and retention ............................................................. 16 6 Be accurate .................................................................................... 18 7 Use appropriate safeguards .................................................................... 19 8 Be open ........................................................................................ 21 9 Give individuals access ........................................................................ 23 10 Challenging compliance ....................................................................... 25 Dealing with a breach ....................................................................... 26 Real risk of significant harm ....................................................................... 27 What your breach report to the OPC should contain ............................................... 27 What your notification to affected individuals needs to contain .................................... 27 What you need to include in your own breach records ............................................ 28 Complaints to the Privacy Commissioner of Canada ........................................ 29 Complaint process ............................................................................... .30 Audits ............................................................................................ 34 Applying for a hearing to the Federal Court ................................................. 35 Canada’s anti-spam legislation and PIPEDA ................................................. 37 Advisory services for businesses ........................................................... 39 1 Overview 2 Canadians are increasingly concerned about their privacy. More and more, they are choosing to do business with organizations that are sensitive to those concerns and can demonstrate they will handle personal information with care. The Personal Information Protection and Electronic The OPC also seeks to ensure that organizations comply Documents Act (PIPEDA) is Canada’s federal private- with their privacy obligations by providing them with sector privacy law. It sets out the ground rules for how information and guidance. The Office also undertakes businesses must handle personal information in the engagement activities, which include outreach and course of commercial activities. advisory services. The Office of the Privacy Commissioner of Canada PIPEDA in brief (OPC) has prepared this guide to help organizations understand and meet their obligations under PIPEDA. There are a number of requirements to comply with the law. Organizations covered by PIPEDA must generally Role of the Office of the Privacy obtain an individual’s consent when they collect, use or Commissioner of Canada disclose that individual’s personal information. People have the right to access their personal information The OPC’s mission is to protect and promote held by an organization. They also have the right to privacy rights. As an Agent of Parliament, the challenge its accuracy. Privacy Commissioner reports directly to the House of Commons and the Senate of Canada. This Personal information can only be used for the purposes independence helps ensure the Commissioner is for which it was collected. If an organization is going to impartial in exercising the role of ombudsman for use it for another purpose, it must obtain consent again. privacy issues. Personal information must be protected by appropriate safeguards. The OPC oversees compliance with PIPEDA by conducting independent and impartial investigations and/or audits into the personal information handling practices of businesses. 3 Information that crosses borders All businesses that operate in Canada and handle personal information that crosses provincial or national borders in the course of commercial activities are subject to PIPEDA, regardless of the province or territory in which they are based (including provinces with substantially similar legislation). How the act applies Federally regulated organizations PIPEDA applies to private-sector organizations Federally regulated organizations that conduct business across Canada that collect, use or disclose personal in Canada are always subject to PIPEDA. The Act also information in the course of a commercial activity. applies to their employees’ personal information. The law defines a commercial activity as any particular These organizations include: transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the ■ airports, aircraft and airlines; selling, bartering or leasing of donor, membership or ■ banks and authorized foreign banks; other fundraising lists. ■ inter-provincial or international transportation companies; Provincial privacy laws ■ telecommunications companies; ■ offshore drilling operations; and Alberta, British Columbia and Quebec have their own ■ radio and television broadcasters. private-sector privacy laws that have been deemed substantially similar to PIPEDA. Organizations subject Note: Organizations in the Northwest Territories, to a substantially similar provincial privacy law are Yukon and Nunavut are considered federally regulated, generally exempt from PIPEDA with respect to the and are therefore also covered by PIPEDA. collection, use or disclosure of personal information that occurs within that province. Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador have also adopted substantially similar legislation regarding the collection, use and disclosure of personal health information. 4 What is personal information? Unless they are engaging in commercial activities that are not central to their mandate and involve personal Under PIPEDA, personal information includes information, PIPEDA does not generally apply to: any factual or subjective information, recorded or not, about an identifiable individual. This includes ■ not-for-profit and charity groups; or information in any form, such as: ■ political parties and associations. ■ age, name, ID numbers, income, ethnic origin, or Municipalities, universities, schools, and hospitals are blood type; generally covered by provincial laws. PIPEDA may ■ opinions, evaluations, comments, social status, or apply in certain situations. disciplinary actions; and ■ employee files, credit records, loan records, medical Your responsibilities records, existence of a dispute between a consumer under PIPEDA and a merchant, intentions (for example, to acquire goods or services, or change jobs). Businesses must follow the 10 fair information principles to protect personal information, which are What is not covered by PIPEDA? set out in Schedule 1 of PIPEDA. There are some instances where PIPEDA does not By following these principles, you will contribute apply. Some examples include: to building trust in your business and in the digital economy. ■ personal information handled by federal government organizations listed under the Privacy Act; The principles are: ■ provincial or territorial governments and their agents; ■ business contact information such as an employee’s 1. Accountability name, title, business address, telephone number or 2. Identifying purposes email address that is collected, used or disclosed 3. Consent solely for the purpose of communicating with that 4. Limiting collection person in relation to their employment or