Law / Canada / British Columbia
Personal Information Protection Act, comprehensive regime
Also known as PIPA.
Personal Information Protection Act, S.B.C. 2003, c. 63
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/03063_01In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Consent, Disclosure, Data subject rights, Governance, Security, Retention
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not collect, use or disclose personal information about an individual without the individual's consent, unless the Act authorizes it without consent or deems the consent given. Consent obtained by false or misleading information, or by deceptive or misleading practices, is not validly given.NIST Privacy FrameworkCT.PO-P1
- Do not require an individual to consent to the collection, use or disclosure of personal information beyond what is necessary to provide a product or service, as a condition of supplying it.NIST Privacy FrameworkCT.PO-P1
- On or before collecting personal information from an individual, disclose the purposes of the collection verbally or in writing and, on request, the position name or title and contact information of an officer or employee who can answer the individual's questions. This does not apply to a collection covered by implicit consent under section 8 (1) or (2).NIST Privacy FrameworkCM.AW-P1
- Collect, use and disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances and that fulfil the purposes you disclosed or are otherwise permitted by the Act.NIST Privacy FrameworkGV.PO-P1
- Personal information available to the public may be collected, used or disclosed without consent on that basis only from a source the Regulations prescribe: a telephone directory or directory assistance service, a professional or business directory, a registry to which the public has a right of access, or a printed or electronic publication that is available to the public, on the conditions the Regulations state.
- Do not collect, use or disclose personal information from a publication where a court has prohibited its publication or the commissioner has ordered that the information was published contrary to the Act.NIST Privacy FrameworkCT.PO-P1
- Designate one or more individuals to be responsible for ensuring that you comply with the Act, and make their position names or titles and contact information available to the public. You remain responsible for personal information under your control, including information not in your custody.NIST Privacy FrameworkGV.PO-P3
- Develop and follow the policies and practices you need to meet the Act, develop a process for responding to complaints, and make information about both available on request.NIST Privacy FrameworkGV.PO-P1NIST Privacy FrameworkGV.MT-P7
- On an individual's written request, give them their personal information under your control, the ways it has been and is being used, and the names of the individuals and organizations it has been disclosed to, subject to the exceptions and prohibitions in section 23.NIST Privacy FrameworkCT.DM-P1
- Correct an error or omission in an individual's personal information when satisfied on reasonable grounds that a correction request should be implemented, send the corrected information to each organization it was disclosed to during the previous year, and annotate the information with the correction requested when you make none.NIST Privacy FrameworkCT.DM-P3NIST Privacy FrameworkCM.AW-P5
- On reasonable notice, allow an individual to withdraw consent at any time, tell them the likely consequences of withdrawing, and then stop collecting, using and disclosing the information unless the Act permits it without consent. An individual may not withdraw consent where doing so would frustrate the performance of a legal obligation.NIST Privacy FrameworkCT.PO-P1
- Protect personal information in your custody or under your control by making reasonable security arrangements against unauthorized access, collection, use, disclosure, copying, modification or disposal or similar risks.NIST Privacy FrameworkPR.DS-P5
- Keep personal information you used to make a decision that directly affects an individual for at least one year after using it, so that the individual has a reasonable opportunity to obtain access to it.NIST Privacy FrameworkCT.DM-P1
- Destroy documents containing personal information, or remove the means by which it can be associated with particular individuals, as soon as it is reasonable to assume that the purpose of collection is no longer served and retention is no longer necessary for legal or business purposes.NIST Privacy FrameworkCT.DM-P5
- Comply with an order of the commissioner not later than 30 days after being given a copy, unless an application for judicial review is brought before that period ends.NIST Privacy FrameworkGV.PO-P5
These lines are LexLint's reading of the law's text. Also read by: Office of the Information and Privacy Commissioner for British Columbia (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.PO-P3Roles and responsibilities for the workforce are established with respect to privacy.
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DM-P1Data elements can be accessed for review.
5 more
- CT.DM-P3Data elements can be accessed for alteration.
- CT.DM-P5Data are destroyed according to policy.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P5Data corrections or deletions can be communicated to individuals or organizations (e.g., data sources) in the data processing ecosystem.
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
7 more
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 56 makes it an offence to use deception or coercion to collect personal information in contravention of the Act, to dispose of personal information with intent to evade an access request, to obstruct the commissioner, to make a false statement to or mislead the commissioner, to contravene the employee-protection section, or to fail to comply with a commissioner's order, and section 56(2) sets a fine for each.
Penalty structure
Section 56(2) sets the fine for an offence under section 56(1) at not more than $100,000 for a person other than an individual and not more than $10,000 for an individual.
- Rule
- Fixed only
- As of
- Currency
- CAD
- Fixed cap
- 100,000
Who enforces it
Enforcement body
Information and Privacy Commissioner for British Columbia
Settledness
The guide is the fifth publication, dated October 2015.
- As of
- Guidance link
- https://www.oipc.bc.ca/documents/guidance-documents/1371
- Guidance body
- Office of the Information and Privacy Commissioner for British Columbia
- Open questions
- Does "actual harm" in section 57(1) include non-pecuniary harm such as distress, once an order of the commissioner has become final?
- Does the duty in section 34 to make reasonable security arrangements to prevent unauthorized access require an organization to notify the commissioner or the affected individuals after a breach, when the Act contains no breach-notification provision?
What record it asks for
Who may demand the log
Regulator
Logging duty
On request an organization must tell an individual how their personal information has been and is being used and the names of the individuals and organizations it was disclosed to, which can be answered only from records of use and disclosure. The Act names no log or register. Section 35(1) keeps the personal information used in a decision for one year so the individual can obtain access, which limits the data and is not a period for a record of processing. Section 3 applies the Act to every organization and states no territorial hook.
- Kind
- Implicit
- As of
- Provision
- Personal Information Protection Act, section 23(1)(b) and (c)
- Trigger
- personal_data_processing
What this law does
The Act applies to every organization, which it defines to include a person, an unincorporated association, a trade union, a trust or a not for profit organization, and defines not to include a public body. An organization must not collect, use or disclose personal information about an individual unless the individual consents, the Act authorizes the collection, use or disclosure without consent, or the Act deems it to be consented to by the individual.
Each collection, use or disclosure must also be for purposes that a reasonable person would consider appropriate in the circumstances. One exception to the consent rule covers personal information that is available to the public from a source prescribed for that purpose.
The Personal Information Protection Act Regulations prescribe four such sources: a telephone directory or directory assistance service, a professional or business directory, a registry to which the public has a right of access, and a printed or electronic publication that is available to the public, including a magazine, book or newspaper.
The directory sources apply only where the individual is permitted to refuse to be included, and the registry source applies only where the information is collected under the authority of an enactment, the laws of Canada or a province, or a municipal bylaw. The Regulations withdraw the publication source where a court has prohibited the publication of the personal information or the commissioner has ordered that it was published contrary to the Act.
The Act does not apply to collection, use or disclosure for an individual's personal or domestic purposes and no other purpose, for journalistic, artistic or literary purposes and no other purpose, or where the federal Personal Information Protection and Electronic Documents Act applies to it.
On request, an organization must give an individual their personal information under its control, the ways it has been and is being used, and the names of the individuals and organizations to whom it has been disclosed, subject to the exceptions in section 23. An organization must protect personal information in its custody or under its control by making reasonable security arrangements.
An organization must destroy documents containing personal information, or remove the means by which it can be associated with particular individuals, as soon as it is reasonable to assume that the purpose of collection is no longer served and retention is no longer necessary for legal or business purposes. Using deception or coercion to collect personal information in contravention of the Act, and failing to comply with an order of the commissioner, are among the offences the Act creates.
An individual who commits an offence is liable to a fine of not more than $10,000, and a person other than an individual to a fine of not more than $100,000. An individual affected by a commissioner's order that has become final has a cause of action against the organization for damages for actual harm suffered as a result of its breach of the Act.
A person affected by the conduct behind an offence of which an organization has been convicted, where the conviction has become final, has a cause of action against the organization for damages for actual harm.
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content or processes personal data.
Back to the example · Lint your app
Page updated .
PIPA ; ca-bc-personal-information-protection-s-b-c-2003