DEFINITION OF PERSONAL INFORMATION “Personal information” means information about an identifiable individual, and it is given a broad interpretation by courts and regulators. A person’s name and address, age, gender, ethnicity, religion, government identification numbers, health information and financial information are all considered personal information. The term is generally interpreted as including both information that can directly identify an individual (such as a person’s name and address) and information that can be used indirectly to identify an individual, whether alone or in combination with other data. However, business contact information is excluded from the application of PIPEDA provided it is collected, used or disclosed solely to communicate with an individual in relation to their employment, business or profession. The substantially similar provincial laws each provide a similar definition and carve-out for business contact information. APPLICATION OF PIPEDA AND INTERACTION WITH OTHER CANADIAN PRIVACY LAWS PIPEDA applies in all provinces of Canada other than those provinces that have enacted privacy legislation that the federal government has determined to be substantially similar to the privacy provisions of PIPEDA. Québec, Alberta and British Columbia (but notably, not Ontario) have all enacted such legislation. The provincial legislation applies to the intraprovincial collection, use and disclosure of personal information by private sector businesses in those provinces, but PIPEDA continues to apply to federal works, undertakings or businesses (such as banks, railways and telecommunications companies) and to all personal information that crosses a border, whether interprovincial or international. Organizations located in the territories of Yukon, Nunavut and the Northwest Territories are considered to be federal works, undertakings and businesses for the purposes of PIPEDA.
some circumstances). CASL provides for administrative monetary penalties to be imposed on offenders: up to $10 million for corporations and $1 million for individuals. CASL also permits alleged violators to voluntarily enter into undertakings with the Canadian Radio-television and Telecommunications Commission (CRTC). Reports issued twice yearly by the CRTC on the enforcement of CASL indicate that a significant number of complaints regarding alleged violations of CASL have resulted in undertakings being entered into or sanctions being imposed. CASL also provides for a private right of action that would permit consumers and businesses to commence enforcement proceedings and recover damages of up to $1 million per day. Although the private right of action was scheduled to come into force on July 1, 2017, implementation has been suspended while the government considers how to respond to concerns raised in regard to this remedy. CASL and the regulations made under it contain detailed requirements and rules on matters such as the form of electronic messages, exemptions from the consent requirement and inclusion of a mandatory unsubscribe mechanism in such messages. Businesses should consult with counsel to understand the highly complex provisions of CASL and its impact on their operations in Canada. Data Protection and Privacy PIPEDA provides the framework for the collection, use and disclosure of personal information in the course of any private sector commercial activity within Canada, except within those provinces that have enacted legislation deemed substantially similar to PIPEDA, as discussed further below.
102
Doing Business in Canada
Powered by FlippingBook