Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5)

Short Title

Marginal note:Short title

1 This Act may be cited as the Personal Information Protection and Electronic Documents Act.

PART 1Protection of Personal Information in the Private Sector

Interpretation

Marginal note:Definitions

• 2 (1) The definitions in this subsection apply in this Part.

  alternative format

  alternative format, with respect to personal information, means a format that allows a person with a sensory disability to read or listen to the personal information. (support de substitution)

  breach of security safeguards

  breach of security safeguards means the loss of, unauthorized access to or unauthorized disclosure of personal information resulting from a breach of an organization’s security safeguards that are referred to in clause 4.7 of Schedule 1 or from a failure to establish those safeguards. (atteinte aux mesures de sécurité)

  business contact information

  business contact information means any information that is used for the purpose of communicating or facilitating communication with an individual in relation to their employment, business or profession such as the individual’s name, position name or title, work address, work telephone number, work fax number or work electronic address. (coordonnées d’affaires)

  business transaction

  business transaction includes

  • (a) the purchase, sale or other acquisition or disposition of an organization or a part of an organization, or any of its assets;

  • (b) the merger or amalgamation of two or more organizations;

  • (c) the making of a loan or provision of other financing to an organization or a part of an organization;

  • (d) the creating of a charge on, or the taking of a security interest in or a security on, any assets or securities of an organization;

  • (e) the lease or licensing of any of an organization’s assets; and

  • (f) any other prescribed arrangement between two or more organizations to conduct a business activity. (transaction commerciale)

  commercial activity

  commercial activity means any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists. (activité commerciale)

  Commissioner

  Commissioner means the Privacy Commissioner appointed under section 53 of the Privacy Act. (commissaire)

  Court

  Court means the Federal Court. (Cour)

  federal work, undertaking or business

  federal work, undertaking or business means any work, undertaking or business that is within the legislative authority of Parliament. It includes

  • (a) a work, undertaking or business that is operated or carried on for or in connection with navigation and shipping, whether inland or maritime, including the operation of ships and transportation by ship anywhere in Canada;

  • (b) a railway, canal, telegraph or other work or undertaking that connects a province with another province, or that extends beyond the limits of a province;

  • (c) a line of ships that connects a province with another province, or that extends beyond the limits of a province;

  • (d) a ferry between a province and another province or between a province and a country other than Canada;

  • (e) aerodromes, aircraft or a line of air transportation;

  • (f) a radio broadcasting station;

  • (g) a bank or an authorized foreign bank as defined in section 2 of the Bank Act;

  • (h) a work that, although wholly situated within a province, is before or after its execution declared by Parliament to be for the general advantage of Canada or for the advantage of two or more provinces;

  • (i) a work, undertaking or business outside the exclusive legislative authority of the legislatures of the provinces; and

  • (j) a work, undertaking or business to which federal laws, within the meaning of section 2 of the Oceans Act, apply under section 20 of that Act and any regulations made under paragraph 26(1)(k) of that Act. (entreprises fédérales)

  organization

  organization includes an association, a partnership, a person and a trade union. (organisation)

  personal health information

  personal health information, with respect to an individual, whether living or deceased, means

  • (a) information concerning the physical or mental health of the individual;

  • (b) information concerning any health service provided to the individual;

  • (c) information concerning the donation by the individual of any body part or any bodily substance of the individual or information derived from the testing or examination of a body part or bodily substance of the individual;

  • (d) information that is collected in the course of providing health services to the individual; or

  • (e) information that is collected incidentally to the provision of health services to the individual. (renseignement personnel sur la santé)

  personal information

  personal information means information about an identifiable individual. (renseignement personnel)

  prescribed

  prescribed means prescribed by regulation. (Version anglaise seulement)

  record

  record includes any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microform, sound recording, videotape, machine-readable record and any other documentary material, regardless of physical form or characteristics, and any copy of any of those things. (document)

• Marginal note:Notes in Schedule 1

  (2) In this Part, a reference to clause 4.3 or 4.9 of Schedule 1 does not include a reference to the note that accompanies that clause.

Purpose

Marginal note:Purpose

3 The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

Application

Marginal note:Application

• 4 (1) This Part applies to every organization in respect of personal information that

  • (a) the organization collects, uses or discloses in the course of commercial activities; or

  • (b) is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

• Marginal note:Application

  (1.1) This Part applies to an organization set out in column 1 of Schedule 4 in respect of personal information set out in column 2.

• Marginal note:Limit

  (2) This Part does not apply to

  • (a) any government institution to which the Privacy Act applies;

  • (b) any individual in respect of personal information that the individual collects, uses or discloses for personal or domestic purposes and does not collect, use or disclose for any other purpose; or

  • (c) any organization in respect of personal information that the organization collects, uses or discloses for journalistic, artistic or literary purposes and does not collect, use or disclose for any other purpose.

• Marginal note:Other Acts

  Footnote ^*(3) Every provision of this Part applies despite any provision, enacted after this subsection comes into force, of any other Act of Parliament, unless the other Act expressly declares that that provision operates despite the provision of this Part.

  • Return to footnote ^*[Note: Subsection 4(3) in force January 1, 2001, see SI/2000-29.]

Marginal note:Business contact information

4.01 This Part does not apply to an organization in respect of the business contact information of an individual that the organization collects, uses or discloses solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession.

Marginal note:Certificate under Canada Evidence Act

• 4.1 (1) If a certificate under section 38.13 or 38.41 of the Canada Evidence Act prohibiting the disclosure of personal information of a specific individual is issued before a complaint is filed by that individual under this Part in respect of a request for access to that information, the provisions of this Part respecting that individual’s right of access to their personal information do not apply to the information that is subject to the certificate.

• Marginal note:Certificate following filing of complaint

  (2) Despite any other provision of this Part, if a certificate under section 38.13 or 38.41 of the Canada Evidence Act prohibiting the disclosure of personal information of a specific individual is issued after the filing of a complaint under this Part in relation to a request for access to that information:

  • (a) all proceedings under this Part in respect of that information, including an investigation, audit, appeal or judicial review, are discontinued;

  • (b) the Commissioner shall not disclose the information and shall take all necessary precautions to prevent its disclosure; and

  • (c) the Commissioner shall, within 10 days after the certificate is published in the Canada Gazette, return the information to the organization that provided the information.

• Marginal note:Information not to be disclosed

  (3) The Commissioner and every person acting on behalf or under the direction of the Commissioner, in carrying out their functions under this Part, shall not disclose information subject to a certificate issued under section 38.13 or 38.41 of the Canada Evidence Act, and shall take every reasonable precaution to avoid the disclosure of that information.

• Marginal note:Power to delegate

  (4) The Commissioner may not delegate the investigation of any complaint relating to information subject to a certificate issued under section 38.13 or 38.41 of the Canada Evidence Act except to one of a maximum of four officers or employees of the Commissioner specifically designated by the Commissioner for the purpose of conducting that investigation.

DIVISION 1Protection of Personal Information

Marginal note:Compliance with obligations

• 5 (1) Subject to sections 6 to 9, every organization shall comply with the obligations set out in Schedule 1.

• Meaning of should

  (2) The word should, when used in Schedule 1, indicates a recommendation and does not impose an obligation.

• Marginal note:Appropriate purposes

  (3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

Marginal note:Effect of designation of individual

6 The designation of an individual under clause 4.1 of Schedule 1 does not relieve the organization of the obligation to comply with the obligations set out in that Schedule.

Marginal note:Valid consent

6.1 For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.

Marginal note:Collection without knowledge or consent

• 7 (1) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual only if

  • (a) the collection is clearly in the interests of the individual and consent cannot be obtained in a timely way;

  • (b) it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province;

  • (b.1) it is contained in a witness statement and the collection is necessary to assess, process or settle an insurance claim;

  • (b.2) it was produced by the individual in the course of their employment, business or profession and the collection is consistent with the purposes for which the information was produced;

  • (c) the collection is solely for journalistic, artistic or literary purposes;

  • (d) the information is publicly available and is specified by the regulations; or

  • (e) the collection is made for the purpose of making a disclosure

    • (i) under subparagraph (3)(c.1)(i) or (d)(ii), or

    • (ii) that is required by law.

• Marginal note:Use without knowledge or consent

  (2) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may, without the knowledge or consent of the individual, use personal information only if

  • (a) in the course of its activities, the organization becomes aware of information that it has reasonable grounds to believe could be useful in the investigation of a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed, and the information is used for the purpose of investigating that contravention;

  • (b) it is used for the purpose of acting in respect of an emergency that threatens the life, health or security of an individual;

  • (b.1) the information is contained in a witness statement and the use is necessary to assess, process or settle an insurance claim;

  • (b.2) the information was produced by the individual in the course of their employment, business or profession and the use is consistent with the purposes for which the information was produced;

  • (c) it is used for statistical, or scholarly study or research, purposes that cannot be achieved without using the information, the information is used in a manner that will ensure its confidentiality, it is impracticable to obtain consent and the organization informs the Commissioner of the use before the information is used;

  • (c.1) it is publicly available and is specified by the regulations; or

  • (d) it was collected under paragraph (1)(a), (b) or (e).

• Marginal note:Disclosure without knowledge or consent

  (3) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is

  • (a) made to, in the Province of Quebec, an advocate or notary or, in any other province, a barrister or solicitor who is representing the organization;

  • (b) for the purpose of collecting a debt owed by the individual to the organization;

  • (c) required to comply with a subpoena or warrant issued or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with rules of court relating to the production of records;

  • (c.1) made to a government institution or part of a government institution that has made a request for the information, identified its lawful authority to obtain the information and indicated that

    • (i) it suspects that the information relates to national security, the defence of Canada or the conduct of international affairs,

    • (ii) the disclosure is requested for the purpose of enforcing any law of Canada, a province or a foreign jurisdiction, carrying out an investigation relating to the enforcement of any such law or gathering intelligence for the purpose of enforcing any such law,

    • (iii) the disclosure is requested for the purpose of administering any law of Canada or a province, or

    • (iv) the disclosure is requested for the purpose of communicating with the next of kin or authorized representative of an injured, ill or deceased individual;

  • (c.2) made to the government institution mentioned in section 7 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act as required by that section;

  • (d) made on the initiative of the organization to a government institution or a part of a government institution and the organization

    • (i) has reasonable grounds to believe that the information relates to a contravention of the laws of Canada, a province or a foreign jurisdiction that has been, is being or is about to be committed, or

    • (ii) suspects that the information relates to national security, the defence of Canada or the conduct of international affairs;

  • (d.1) made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation;

  • (d.2) made to another organization and is reasonable for the purposes of detecting or suppressing fraud or of preventing fraud that is likely to be committed and it is reasonable to expect that the disclosure with the knowledge or consent of the individual would compromise the ability to prevent, detect or suppress the fraud;

  • (d.3) made on the initiative of the organization to a government institution, a part of a government institution or the individual’s next of kin or authorized representative and

    • (i) the organization has reasonable grounds to believe that the individual has been, is or may be the victim of financial abuse,

    • (ii) the disclosure is made solely for purposes related to preventing or investigating the abuse, and

    • (iii) it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the ability to prevent or investigate the abuse;

  • (d.4) necessary to identify the individual who is injured, ill or deceased, made to a government institution, a part of a government institution or the individual’s next of kin or authorized representative and, if the individual is alive, the organization informs that individual in writing without delay of the disclosure;

  • (e) made to a person who needs the information because of an emergency that threatens the life, health or security of an individual and, if the individual whom the information is about is alive, the organization informs that individual in writing without delay of the disclosure;

  • (e.1) of information that is contained in a witness statement and the disclosure is necessary to assess, process or settle an insurance claim;

  • (e.2) of information that was produced by the individual in the course of their employment, business or profession and the disclosure is consistent with the purposes for which the information was produced;

  • (f) for statistical, or scholarly study or research, purposes that cannot be achieved without disclosing the information, it is impracticable to obtain consent and the organization informs the Commissioner of the disclosure before the information is disclosed;

  • (g) made to an institution whose functions include the conservation of records of historic or archival importance, and the disclosure is made for the purpose of such conservation;

  • (h) made after the earlier of

    • (i) one hundred years after the record containing the information was created, and

    • (ii) twenty years after the death of the individual whom the information is about;

  • (h.1) of information that is publicly available and is specified by the regulations; or

  • (h.2) [Repealed, 2015, c. 32, s. 6]

  • (i) required by law.

• Marginal note:Use without consent

  (4) Despite clause 4.5 of Schedule 1, an organization may use personal information for purposes other than those for which it was collected in any of the circumstances set out in subsection (2).

• Marginal note:Disclosure without consent

  (5) Despite clause 4.5 of Schedule 1, an organization may disclose personal information for purposes other than those for which it was collected in any of the circumstances set out in paragraphs (3)(a) to (h.1).