Personal Information Protection and Electronic Documents Act

The following nformation from The Office of the Privacy Commissioner of Canada to help organizations fulfill their responsibilities under the Personal Information Protection and Electronic Documents Act (PIPEDA).

PIPEDA in Brief

Organizations covered by the Act must obtain an individual's consent when they collect, use or disclose the individual's personal information.

How the Act Applies

PIPEDA applies to the collection, use or disclosure of personal information in the course of a commercial activity.

A commercial activity is defined as any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fund-raising lists.

What is “personal information”?

Under PIPEDA, personal information includes any factual or subjective information, recorded or not, about an identifiable individual. This includes information in any form, such as:

age, name, ID numbers, income, ethnic origin, or blood type;
opinions, evaluations, comments, social status, or disciplinary actions; and
employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs.)

What is not covered by PIPEDA?

There are some instances where PIPEDA does not apply. Some examples include:

Personal information collected, used or disclosed by federal government organizations listed under the Privacy Act
Provincial or territorial governments and their agents
An employee's name, title, business address or telephone number
An individual's collection, use or disclosure of personal information strictly for personal purposes (e.g. personal greeting card list)
An organization's collection, use or disclosure of personal information solely for journalistic, artistic or literary purposes
Employee information — except in the federally-regulated sector

Pillars