Processes personal data, in Alberta

Personal Information Protection Act, S.A. 2003, c. P-6.5 · Read the law's page

• Do not collect, use or disclose personal information about an individual without the individual's consent, unless the Act provides otherwise. Consent obtained or attempted by providing false or misleading information, or by deceptive or misleading practices, is negated.
• Do not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.
• Where you rely on notice and an opportunity to object instead of express consent, give the individual a notice in a form the individual can reasonably be expected to understand and a reasonable opportunity to decline, and proceed only if it is reasonable to do so having regard to the sensitivity of the information.
• Before or at the time of collecting personal information from an individual, tell the individual in writing or orally the purposes of the collection and the name or position name or title of a person who can answer questions about it. This does not apply where the individual is deemed to consent under section 8(2).
• Collect, use and disclose personal information only for purposes that are reasonable, and only to the extent that is reasonable for meeting those purposes.
• Collect, use or disclose personal information without consent only in a circumstance the Act lists in section 14, 17 or 20, for personal employee information under section 15, 18 or 21, or for a business transaction under section 22. Publicly available information counts only where the Regulation says it does.
• Do not rely on the business-transaction provisions where the primary purpose, objective or result of the transaction is the purchase, sale, lease, transfer, disposal or disclosure of personal information.
• Designate one or more individuals to be responsible for ensuring that you comply with the Act, and remain responsible for personal information in your custody or under your control, including for a person you engage as an agent or by contract.
• Develop and follow policies and practices that are reasonable for you to meet your obligations under the Act, and make written information about them available on request.
• On a written request, give an applicant access to the applicant's personal information in your custody or under your control and, on request, the purposes for which it has been and is being used and the names of the persons to whom and circumstances in which it has been and is being disclosed, subject to the exceptions in section 24.
• Respond to an access or correction request not later than 45 days after receiving it. For an access request, or a request for information about use and disclosure, the period may be extended under section 31, and you must then respond by the end of the extended period.
• Correct an error or omission in an individual's personal information as soon as reasonably possible, notify each organization to which you disclosed the incorrect information where it is reasonable to do so, and annotate the information with the correction requested where you make none. Do not charge a fee for a correction request.
• On reasonable notice, let an individual withdraw or vary consent at any time, tell the individual the likely consequences unless they are reasonably obvious, and stop collecting, using and disclosing the information if consent is withdrawn, unless the Act permits it without consent.
• Make a reasonable effort to ensure that personal information you collect, use or disclose is accurate and complete to the extent that is reasonable for your purposes.
• Protect personal information in your custody or under your control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.
• Retain personal information only for as long as you reasonably require it for legal or business purposes, and within a reasonable period after that destroy the records or render the information non-identifying.
• Comply with a Commissioner's order not later than 50 days from the day you are given a copy of it, and take no step to comply until the period for applying for judicial review has ended.

S.A. 2003, c. P-6.5, ss. 34.1, 37.1; Alta. Reg. 366/2003, ss. 19, 19.1 · Read the law's page

• Give written notice to the Commissioner, without unreasonable delay, of any incident involving the loss of or unauthorized access to or disclosure of personal information under your control where a reasonable person would consider that there exists a real risk of significant harm to an individual.
• Include in the notice a description of the circumstances, the date or period of the incident, a description of the personal information involved, an assessment of the risk of harm, an estimate of the number of individuals to whom there is a real risk of significant harm, the steps taken to reduce the risk and to notify individuals, and the name and contact information of a person who can answer the Commissioner's questions.
• If the Commissioner requires it, notify the individuals to whom there is a real risk of significant harm in the form and manner prescribed and within the time the Commissioner sets, and give the Commissioner any additional information and meet any terms the Commissioner requires.
• Give a notification to an individual directly, unless the Commissioner determines that direct notification would be unreasonable, and include the circumstances, the date or period, the personal information involved, the steps taken to reduce the risk of harm and a contact person.

S.A. 2003, c. P-6.5, ss. 6 (2), 13.1 · Read the law's page

• If you use a service provider outside Canada to collect, use, disclose or store personal information for you, include in your policies and practices the countries outside Canada in which that is occurring or may occur and the purposes for which the service provider has been authorized to collect, use or disclose personal information.
• Before or at the time of collecting personal information with the individual's consent through a service provider outside Canada, or of transferring to one personal information that was collected with the individual's consent, notify the individual in writing or orally.
• In that notice, tell the individual how to obtain access to written information about your policies and practices on service providers outside Canada, and give the name or position name or title of a person who can answer the individual's questions about the collection, use, disclosure or storage of personal information by those providers.
• Give this notice in addition to the notice of purposes you owe under section 13 when you collect personal information from the individual.