Personal Information Protection and Electronic Documents Act (PIPEDA)
Private-sector organizations handling personal information in commercial activity, federally regulated works, and information crossing provincial or national borders, with AB, BC and QC organizations generally exempt for activity inside those provinces.
This is general information, not legal advice.
Status: In force. Bill C-36 would replace Part 1, but it has only had first reading; the Library of Parliament says PIPEDA stays in force and the federal Privacy Commissioner keeps overseeing it until the replacement law takes effect.
What to check
- Follow the 10 fair information principles, including accountability, identifying purposes, consent, limiting collection and use, accuracy, safeguards, openness and individual access. Source
- Report a breach to the federal Privacy Commissioner and notify affected people when it poses a real risk of significant harm. Source
- Keep a record of every breach of security safeguards for two years, whether or not it was reportable. Source
- Before using AI, establish your legal authority to use the personal information, and make any consent you rely on valid and meaningful. Source
- Tell people how AI uses their information and when generative AI was used to create content or make decisions. Source
Penalties
An organization that knowingly breaches specified provisions, or obstructs the Commissioner, faces a fine of up to $10,000 on summary conviction or up to $100,000 on an indictable offence (section 28).