Build trust in your business with PIPEDA compliance

PIPEDA defines personal information as any information about an identifiable individual. This can include data such as name, age, gender, race, marital status, home address, ID numbers, driver's license number, social insurance number etc.

PIPEDA requires heightened levels of protection for sensitive personal information. While the law does not define what constitutes sensitive personal information, it clarifies that any information can be sensitive depending on context. PIPEDA cites medical history and income records as examples.

There are some exceptions to the applicability of PIPEDA. It does not apply to

• Government organisations covered by the Privacy Act
• An individual's collection, use, or disclosure of personal information strictly for personal or domestic purposes.
• An organization's collection, use, or disclosure of personal information solely for journalistic, artistic or literary purposes.

PIPEDA does not apply to organizations that operate only within the provinces of Alberta, British Columbia and Quebec, as they are required to follow provincial privacy laws similar to PIPEDA.

The Office of the Privacy Commissioner of Canada (OPC) is the supervisory authority for the implementation of PIPEDA. It is the only federal agency responsible for overseeing compliance with PIPEDA, while each province and territory designates its supervisory authority under the applicable privacy law.

The OPC has investigatory powers to probe complaints related to the handling of personal information, and promoting the privacy rights of individuals. The OPC also holds the power to conduct audits of organizations and resolve complaints through dispute-resolution mechanisms. However, the OPC has limited corrective powers.

Yes, PIPEDA allows for the transfer of personal information outside of Canada. However, PIPEDA does not contain any specific provisions related to cross-border data transfer. But all transfers of personal information to any third-party processor, whether within Canada or internationally, are subject to the accountability principle under PIPEDA. As per this principle, organizations are responsible for personal information that has been transferred to a third party and are required to use contractual or other means to ensure that the third party provides a comparable level of protection.

Canada is not subject to the General Data Protection Regulation (GDPR) because GDPR oversees the data privacy and protection of EU and EEA residents. However, GDPR has extra-territorial scope, meaning it applies to the processing of personal data of individuals in the EU, regardless of where the processing takes place. Therefore, it can be applied to businesses in Canada that offer goods or services to individuals in the EU, or monitor the behaviour of individuals in the EU.

Here are some links you can refer to for additional reading:

• PIPEDA Official Text 
• Simplified Guide on Canada's PIPEDA