Personal Information Protection Act, comprehensive regime

The Act applies to every organization and in respect of all personal information, subject to the exceptions it states. It defines an organization to include a corporation, an unincorporated association, a trade union, a partnership and an individual acting in a commercial capacity, and it excludes an individual acting in a personal or domestic capacity. It does not apply to a public body or to any personal information that is in the custody of or under the control of a public body.

It does not apply to personal information in the custody of an organization if the Protection of Privacy Act applies to that information. A non-profit organization is outside the Act except for personal information that it collects, uses or discloses in connection with a commercial activity. The Act does not apply to health information, as defined in the Health Information Act, to which that Act applies.

An organization may not collect, use or disclose personal information about an individual without the individual's consent, except where the Act provides otherwise. An organization may not, as a condition of supplying a product or service, require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide the product or service.

An individual is deemed to consent where the individual voluntarily provides the information to the organization for a particular purpose and it is reasonable that a person would voluntarily provide it.

An organization may also collect, use or disclose personal information for particular purposes after giving the individual notice and a reasonable opportunity to decline, where the individual does not respond and the collection, use or disclosure is reasonable having regard to the sensitivity of the information. Consent obtained through false or misleading information, or through deceptive or misleading practices, is negated.

An individual may withdraw or vary consent at any time on giving reasonable notice. An organization may collect personal information only for purposes that are reasonable, and only to the extent reasonable for meeting those purposes. The same limits apply to the use and the disclosure of personal information.

Before or at the time of collecting personal information from the individual, an organization must notify the individual in writing or orally of the purposes of the collection and of the name or position name or title of a person who can answer questions about it.

Sections 14, 17 and 20 list the circumstances in which an organization may collect, use or disclose personal information without consent, including where a statute or regulation of Alberta or Canada authorizes or requires it and where it is reasonable for an investigation or a legal proceeding. Collection, use and disclosure without consent is also permitted where the information is publicly available as prescribed or otherwise determined by the regulations.

The Personal Information Protection Act Regulation provides that personal information is publicly available only in the circumstances it lists, which include a telephone directory, a professional or business directory, a government or non-governmental registry, a record of a quasi-judicial body and a publication available to the public.

Section 22 of the Act permits parties to a business transaction to collect, use and disclose personal information without consent under an agreement that restricts its use to the transaction, and it does not apply where the primary purpose, objective or result of the transaction is the purchase, sale, lease, transfer, disposal or disclosure of personal information.

An organization is responsible for personal information in its custody or under its control and must designate one or more individuals to be responsible for ensuring that it complies with the Act. An organization must develop and follow policies and practices that are reasonable for it to meet its obligations under the Act. On a written request, an organization must provide an applicant with access to the applicant's personal information that is in its custody or under its control.

An organization must also tell the applicant, on request, the purposes for which the personal information has been and is being used and the names of the persons to whom and circumstances in which it has been and is being disclosed. An organization must respond to a request not later than 45 days from the day that it receives the written request, unless the period is extended under section 31.

An organization must correct an error or omission in personal information as soon as reasonably possible when an individual asks, and must annotate the information with the correction that was requested but not made. An organization may not charge a fee for a request to correct personal information. An organization must make a reasonable effort to ensure that personal information it collects, uses or discloses is accurate and complete to the extent that is reasonable for its purposes.

An organization must protect personal information in its custody or under its control by making reasonable security arrangements against such risks as unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction. An organization may retain personal information only for as long as it reasonably requires the information for legal or business purposes.

Within a reasonable period after that, the organization must destroy the records containing the personal information or render the information non-identifying. The Commissioner may order an organization to stop collecting, using or disclosing personal information in contravention of the Act and to destroy personal information collected in contravention of the Act. An organization must comply with a Commissioner's order not later than 50 days from the day that it is given a copy of the order.

A person who collects, uses or discloses personal information in contravention of Part 2 commits an offence. A person who commits an offence under the Act is liable to a fine of not more than $10,000 if an individual and not more than $100,000 if a person other than an individual.

Neither an organization nor an individual is guilty of an offence under the Act if it is established to the satisfaction of the court that the organization or individual acted reasonably in the circumstances that gave rise to the offence. An individual affected by a Commissioner's order that has become final has a cause of action against the organization for damages for loss or injury suffered as a result of its breach of the Act or the regulations.