PIPEDA also requires the Commissioner
to undertake and publish research about
protecting personal information so as
to increase knowledge and improve
compliance with the Act’s fair information
principles. The Commissioner may conduct
independent research on privacy issues
in conjunction with academic or other
researchers. He or she may also provide
grants and contributions for academic or
other research on privacy issues.
The Commissioner reports annually to
Parliament on privacy issues.
PIPEDA IN BRIEF
Organizations covered by the Act must
obtain an individual’s consent when they
collect, use or disclose the individual’s
personal information. The individual has
a right to access personal information held
by an organization and to challenge its
accuracy, if need be. Personal information
can only be used for the purposes for which
it was collected. If an organization is going
to use it for another purpose, consent must
be obtained again. Individuals should also
be assured that their information will be
protected by appropriate safeguards.
Under PIPEDA, the definition of
organization includes an association, a
partnership, a person or a trade union.
HOW THE ACT APPLIES
PIPEDA applies to the collection, use or
disclosure of personal information in the
course of a commercial activity.
A commercial activity is defined as any
particular transaction, act, or conduct, or
any regular course of conduct that is of a
commercial character, including the selling,
bartering or leasing of donor, membership or
other fund-raising lists.
The federal government may exempt from
PIPEDA organizations and/or activities in
provinces that have adopted substantially
similar privacy legislation. To date,
Quebec, British Columbia and Alberta
have adopted private sector legislation
deemed substantially similar to the federal
law. As well, Ontario, New Brunswick and
Newfoundland and Labrador have adopted
substantially similar legislation with respect
to personal health information.
Even in those provinces which have
adopted substantially similar privacy
legislation, PIPEDA continues to apply in all
interprovincial and international transactions
by all organizations subject to the Act in the
course of their commercial activities.
As well, PIPEDA continues to apply in those
provinces to federally regulated organizations
– “federal works, undertakings or businesses”
– such as banks, telecommunications and