CanadaPersonal Information Protection and Electronic Documents Act (PIPEDA), scraped personal data
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- Do not assume a public web page's personal information falls outside PIPEDA merely because it was publicly accessible; the no-consent carve-out applies only to information specified as publicly available by regulation.
- Apply PIPEDA's purpose-limitation and accountability obligations to personal information collected by crawling, the same as personal information collected any other way.
These lines are LexLint's reading of the law's text. Also read by: Office of the Privacy Commissioner of Canada, in joint findings with the Commission d'accès à l'information du Québec, the Information and Privacy Commissioner for British Columbia and the Information Privacy Commissioner of Alberta (PIPEDA Findings 2021-001, Clearview AI) (guidance, recorded ).
In the frameworks
- NIST AI RMF
- GOVERN 2.1Roles and responsibilities and lines of communication related to mapping, measuring, and managing AI risks are documented and are clear to individuals and teams throughout the organization.
- MEASURE 2.10Privacy risk of the AI system – as identified in the MAP function – is examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.priv.gc.ca/en/opc-actions-and-decisions/investigations/investigations-into-businesses/2021/pipeda-2021-001/
- Guidance body
- Office of the Privacy Commissioner of Canada, in joint findings with the Commission d'accès à l'information du Québec, the Information and Privacy Commissioner for British Columbia and the Information Privacy Commissioner of Alberta (PIPEDA Findings 2021-001, Clearview AI)
- Open questions
- Does personal information that an individual posted on a personal blog or a self-published website count as information that 'appears in a publication, including a magazine, book or newspaper, in printed or electronic form' under paragraph 1(e) of the Regulations Specifying Publicly Available Information, so that section 7(1)(d) of the Act permits collection without consent?
What it makes you log
Logging duty
The text this row cites is section 4, which states to whom Part 1 applies and the exclusions from it, and it requires no log or record. Part 1 elsewhere carries a breach-of-security-safeguards record (s. 10.3) and the Schedule 1 accountability principle; those provisions are not cited by this row and are researched in the privacy topic's PIPEDA entry, so they are named here and not read into this row.
- Kind
- None
- As of
What this law does
Applies to personal information an organization collects, uses or discloses in the course of commercial activity, without a general exemption for information that happens to be publicly accessible on the web.
A narrow regulatory carve-out lets an organization collect, use or disclose personal information without consent where it is both publicly available and specified by regulation, but that carve-out is defined by regulation rather than by the fact of public accessibility alone, so scraping a public page does not, by itself, take the resulting personal information outside PIPEDA's other obligations, including purpose limitation and accountability for onward transfer.
The full obligations this instrument imposes are set out in the PIPEDA entry in the privacy topic for this jurisdiction; this entry covers only the personal-data dimension of scraping. This is the same underlying statute as that PIPEDA instrument.
When LexLint raises it
When your app profile says your app crawls the web, trains models, reuses other publishers' content, processes biometric data or processes voice recordings.
Back to the example · Lint your app
Page updated .