CanadaPersonal Information Protection and Electronic Documents Act (PIPEDA)
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Obtain knowing, meaningful consent before collecting, using or disclosing personal information, and limit collection to what a reasonable person would consider appropriate for the stated purpose.NIST Privacy FrameworkCT.PO-P1
- Comply with the ten Schedule 1 fair information principles, including limiting use and disclosure to the purposes for which information was collected and keeping it only as long as necessary.NIST Privacy FrameworkGV.PO-P1
- Remain accountable for personal information transferred to a third party for processing, in Canada or abroad, and use contractual or other means to ensure a comparable level of protection.NIST Privacy FrameworkID.DE-P3
- Give individuals access to their own personal information on request and a way to challenge the organization's compliance with these obligations.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text. Also read by: Office of the Privacy Commissioner of Canada (guidance, recorded ); R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212 (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://decisions.scc-csc.ca/scc-csc/scc-csc/en/item/14233/index.do?iframe=true
- Guidance link
- https://www.priv.gc.ca/en/privacy-topics/collecting-personal-information/consent/gd_53_201805/
- Case citation
- R. v. Spencer, 2014 SCC 43, [2014] 2 S.C.R. 212
- Guidance body
- Office of the Privacy Commissioner of Canada
- Open questions
- Is training a commercial machine-learning model on personal information collected from public web pages a purpose that 'a reasonable person would consider are appropriate in the circumstances' under subsection 5(3) of the Personal Information Protection and Electronic Documents Act?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 5(1) makes the Schedule 1 principles binding, and clause 4.2.1 requires the organization to document the purposes for which it collects personal information, which a record of purposes must carry. No log of processing is named. Clause 4.9.6 requires a record of an unresolved challenge to the accuracy of information. Where the Act sets a record duty of its own, the breach record in section 10.3, it is coded on the row for sections 10.1 to 10.3 and not borrowed here.
- Kind
- Implicit
- As of
- Provision
- Schedule 1, clause 4.2.1, made binding by section 5(1)
- Trigger
- personal_data_processing
What this law does
Governs the collection, use and disclosure of personal information by private-sector organizations in the course of commercial activity, and by any organization in connection with the personal information of its employees where the organization is a federal work, undertaking or business.
Every organization must comply with the ten Schedule 1 fair information principles (accountability, identifying purposes, consent, limiting collection, limiting use and disclosure and retention, accuracy, safeguards, openness, individual access, and challenging compliance) and may collect, use or disclose personal information only for purposes a reasonable person would consider appropriate.
It excludes government institutions covered by the Privacy Act, purely personal or domestic use, and journalistic, artistic or literary purposes.
When LexLint raises it
When your app profile says your app publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content or processes personal data.
Back to the example · Lint your app
Page updated .