Provincial laws that may apply instead of PIPEDA

Reviewed: May 2020

Overview

Not all privacy issues fall under the oversight of the Office of the Privacy Commissioner of Canada. The federal regulator ensures that businesses comply with the federal private sector privacy law, the Personal Information Protection and Electronic Documents Act (PIPEDA). This law applies to the collection, use and disclosure of personal information in the course of commercial activities.

PIPEDA sets national standards for privacy practices in the private sector. A few provinces have privacy laws deemed substantially similar to PIPEDA. This means that in many circumstances, the provincial law applies instead of the federal law. Determining which law applies must be done on a case-by-case basis.

On this page:

• Provinces with privacy laws similar to PIPEDA
• Provinces with substantially similar health information laws
• Privacy protections provided by provincial laws
• When more than one law applies, you must comply with both
• Which privacy law may apply?

Provinces with privacy laws similar to PIPEDA

Alberta, British Columbia (B.C.) and Quebec have their own private-sector privacy laws that have been deemed substantially similar to PIPEDA. Organizations subject to a substantially similar provincial privacy law are generally exempt from PIPEDA with respect to the collection, use or disclosure of personal information that occurs within that province.

The following provincial privacy laws are considered equivalent in terms and protection to PIPEDA:

Alberta:

Personal Information Protection Act overseen by the Office of the Information and Privacy Commissioner of Alberta

B.C.:

Personal Information Protection Act overseen by the Office of the Information and Privacy Commissioner for British Columbia

Quebec:

Act Respecting the Protection of Personal Information in the Private Sector overseen by the Commission d’accès à l’information du Québec

These laws apply to most organizations that operate within B.C., Alberta or Quebec. However, even in those provinces, PIPEDA still applies to:

• transactions involving personal information transferred across borders
• federal works, undertakings or businesses (FWUBs) such as banks, telecommunications and transportation companies

PIPEDA also applies to organizations in the Northwest Territories, Yukon and Nunavut, as they are considered federally- regulated.

Provinces with substantially similar health information laws

In addition to more comprehensive privacy laws that apply to organizations in B.C., Alberta and Quebec, there are also four provincial health information laws that are considered substantially similar to PIPEDA. These laws apply to personal health information within their respective provinces:

• New Brunswick: Personal Health Information Privacy and Access Act
• Newfoundland and Labrador: Personal Health Information Act
• Nova Scotia: Personal Health Information Act
• Ontario: Personal Health Information Protection Act

For more information, see who to contact with concerns about the protection of your personal health information.

Privacy protections provided by provincial laws

A provincial privacy law is considered substantially similar to PIPEDA if it:

• provides equal privacy protection
• contains the 10 PIPEDA fair information principles
• provides for independent oversight and redress with the power to investigate
• allows the collection, use and disclosure of personal information only for appropriate or legitimate purposes

When more than one law applies, you must comply with both

It is possible that more than one privacy law could apply to an organization. One part of an organization’s activities, such as collecting personal information within a province, may be subject to a provincial privacy law while another part, such as disclosure across provincial borders, may be subject to PIPEDA.

For example, an organization (in B.C.) provides counselling services to employees of an airline under an employee assistance program. The counselling services company is obliged by contract to follow PIPEDA regarding the airline employees’ personal information because it is a FWUB (federal works, undertakings or businesses). For the rest of the business’s operations, it would follow B.C.'s Personal Information Protection Act (PIPA).

For more information on contracting and privacy, see our section on Outsourcing.

Which privacy law may apply?

If you are unsure which privacy law may apply to your situation or who to contact about your issue, try using the Find the right organization to contact about your privacy issue tool on our website.

To find contacts and links to privacy laws in Canada, consult Provincial and territorial privacy laws and oversight.