Processes personal data, in Canada

S.C. 2000, c. 5, Part 1 · Read the law's page

• Obtain knowing, meaningful consent before collecting, using or disclosing personal information, and limit collection to what a reasonable person would consider appropriate for the stated purpose.
• Comply with the ten Schedule 1 fair information principles, including limiting use and disclosure to the purposes for which information was collected and keeping it only as long as necessary.
• Remain accountable for personal information transferred to a third party for processing, in Canada or abroad, and use contractual or other means to ensure a comparable level of protection.
• Give individuals access to their own personal information on request and a way to challenge the organization's compliance with these obligations.

S.C. 2000, c. 5, ss. 10.1-10.3 · Read the law's page

• Report any breach of security safeguards involving personal information under the organization's control to the Privacy Commissioner as soon as feasible, if it is reasonable to believe the breach creates a real risk of significant harm to an individual.
• Notify each affected individual directly, in a conspicuous form, with enough information to let them understand the significance of the breach and take steps to reduce or mitigate the resulting harm.

Bill C-36, An Act to enact the Protecting Privacy and Consumer Data Act, to amend the Personal Information Protection and Electronic Documents Act and to make amendments to other Acts, 45th Parliament, 1st Session · Read the law's page

• Would require organizations to be transparent about their use of automated decision making for significant decisions about individuals, set higher standards for handling children's information, and obtain meaningful consent supported by plain-language explanations.