Canada's PIPEDA governs personal information in commercial activities within federal scope and interprovincial or international transactions. Consent, limited collection and retention, safeguards and access sit with accountability and reporting for breaches posing significant harm.
TL;DR:
- Covered commercial data use requires accountability, safeguards and individual access rights.
- Breaches posing a real risk of significant harm require notification; all covered breaches need records.
- Provincial laws and cross-border flows affect how the federal regime applies.
Summary
Commercial personal information within scope
The Personal Information Protection and Electronic Documents Act, or PIPEDA, governs personal information in covered commercial activities. Its application depends on the organisation, activity and movement of information across borders. Federally regulated businesses are subject to the federal framework, while substantially similar provincial laws can govern certain activities within Alberta, British Columbia and Quebec.
Accountability, consent and limited use
PIPEDA connects organisational accountability with identifying purposes, meaningful consent where required, limiting collection, use, disclosure and retention, accuracy and safeguards. Individuals have rights concerning access and correction. In payments, identity, account, transaction, device and support information can be personal information when it relates to an identifiable person; a business purpose does not make all associated data nonpersonal.
Breaches and significant harm
Section 10.1 requires reporting to the Privacy Commissioner and notification to affected individuals where a breach of security safeguards creates a real risk of significant harm. The assessment considers factors including the sensitivity of the information and the probability of misuse. The Act separately requires records of every breach involving personal information under the organisation's control, rather than only those that meet the notification threshold. Financial loss and identity theft are among the harms identified in the Act.
Cross-border and sector context
The Privacy Commissioner's guidance explains that personal information crossing provincial or national borders can bring commercial processing within PIPEDA regardless of the organisation's province. Banks and payment providers must therefore consider the actual information flow as well as their institutional status. Other financial-sector confidentiality rules can also apply; a provincial location or a payment-network connection does not by itself resolve the complete privacy framework.
Keywords
- PIPEDA
- Canada privacy
- commercial data
- accountability
- consent requirements
- security safeguards
- breach records
- harm assessment
- provincial exemptions
- cross-border processing