Overview of PIPEDA and Privacy Law in Canada

• Federal Works, Undertakings, and Businesses (FWUBs): This includes highly regulated sectors such as banks, airlines, telecommunications providers, and nuclear facilities.
• Trans-border Flows: PIPEDA's jurisdiction extends to the movement of information across provincial borders and internationally.
• Non-Residents: The Commissioner may investigate complaints involving the personal information of non-residents (e.g., U.S. residents) if a Canadian entity is handling that data.

Important Exemptions

It is just as important to know when PIPEDA does not apply:

1. Government Entities: Federal government organizations are governed by the Privacy Act, while provincial/territorial governments are governed by their own respective laws.
2. Personal/Domestic Use: Individuals acting for purely personal or domestic purposes are exempt.
3. Journalistic/Artistic Purposes: Organizations using information for journalistic, artistic, or literary purposes are excluded.
4. Non-Profit Activities: Most non-profits (like charities) are exempt because they do not engage in commercial activities. However, if a non-profit sells, barters, or leases its membership or donor lists, that specific activity becomes commercial and subject to PIPEDA.
5. Employment Information: Generally, information used for employment purposes is exempt, except when it concerns employees of a federal work, undertaking, or business (FWUB).

The 10 Fair Information Principles

To comply with PIPEDA, organizations must adhere to ten core principles outlined in Schedule 1 of the Act. These principles serve as the operational backbone for privacy management.

1. Accountability: Organizations must designate an individual to be responsible for privacy compliance and implement policies to protect data.
2. Identifying Purposes: The reason for collecting information must be identified at or before the time of collection.
3. Consent: Individuals must be informed of the nature, purpose, and consequences of the data collection and must provide consent. Consent can be express (explicit) or implied, depending on the sensitivity of the information.
4. Limiting Collection: Organizations should only collect the information necessary to fulfill their identified purposes and must use fair and lawful means.
5. Limiting Use, Disclosure, and Retention: Data should only be used for the purposes for which it was collected. Once it is no longer needed, it must be destroyed or anonymized.
6. Accuracy: Information must be kept accurate, complete, and up-to-date to minimize the risk of incorrect decisions being made about an individual.
7. Safeguards: Organizations must protect data against loss, theft, and unauthorized access using physical, organizational, and technological measures.
8. Openness: Organizations must make their privacy policies and procedures readily available to the public.
9. Individual Access: Upon request, individuals have the right to see their personal information and challenge its accuracy.
10. Challenging Compliance: Organizations must have a process in place for individuals to complain about their privacy practices.

Enforcement and Administration

The Office of the Privacy Commissioner (the Commissioner) is the body responsible for overseeing PIPEDA. The Commissioner has several tools at their disposal:

• Investigations and Audits: The Commissioner can investigate complaints (initiated by individuals or by the Commissioner themselves) and conduct audits to ensure compliance.
• Compliance Agreements: The Commissioner can enter into agreements with organizations to ensure they follow the law.
• Public Reporting: The Commissioner can issue public reports detailing investigation findings.

Critical Distinction: The Commissioner does not have "order-making powers". They cannot directly force an organization to change its ways or pay damages.

The Role of the Federal Court

While the Commissioner provides oversight and investigation, actual legal "teeth" come from the Federal Court. If an investigation is completed, the matter may move to litigation. The Federal Court has the authority to:

• Issue rulings and orders (e.g., requiring an organization to correct its practices).
• Award damages to complainants for matters such as humiliation.
• Impose fines and sanctions, and even pursue criminal liability for certain offences (such as knowingly destroying information subject to an access request).

Security Breaches and Mandatory Reporting

Since November 1, 2018, organizations must follow strict rules regarding security breaches. If a breach occurs that creates a "real risk of significant harm" to individuals, the organization must:

1. Notify the affected individuals.
2. Notify the Privacy Commissioner.
3. Notify any other organizations that may be able to mitigate the harm.

"Significant harm" is assessed based on the sensitivity of the information and the probability of misuse, and can include identity theft, financial loss, damage to reputation, or even bodily harm.

Note on Indigenous Data Sovereignty

It is important to note that First Nation councils are not considered federal government institutions and are therefore not governed by the Privacy Act. Many First Nations exercise their own jurisdiction over information through the OCAP® principles (Ownership, Control, Access, and Possession). This framework recognizes community privacy and the right of Indigenous peoples to govern their own data.