British Columbia

The Act applies to every organization, which it defines to include a person, an unincorporated association, a trade union, a trust or a not for profit organization, and defines not to include a public body. An organization must not collect, use or disclose personal information about an individual unless the individual consents, the Act authorizes the collection, use or disclosure without consent, or the Act deems it to be consented to by the individual.

Each collection, use or disclosure must also be for purposes that a reasonable person would consider appropriate in the circumstances. One exception to the consent rule covers personal information that is available to the public from a source prescribed for that purpose.

The Personal Information Protection Act Regulations prescribe four such sources: a telephone directory or directory assistance service, a professional or business directory, a registry to which the public has a right of access, and a printed or electronic publication that is available to the public, including a magazine, book or newspaper.

The directory sources apply only where the individual is permitted to refuse to be included, and the registry source applies only where the information is collected under the authority of an enactment, the laws of Canada or a province, or a municipal bylaw. The Regulations withdraw the publication source where a court has prohibited the publication of the personal information or the commissioner has ordered that it was published contrary to the Act.

The Act does not apply to collection, use or disclosure for an individual's personal or domestic purposes and no other purpose, for journalistic, artistic or literary purposes and no other purpose, or where the federal Personal Information Protection and Electronic Documents Act applies to it.

On request, an organization must give an individual their personal information under its control, the ways it has been and is being used, and the names of the individuals and organizations to whom it has been disclosed, subject to the exceptions in section 23. An organization must protect personal information in its custody or under its control by making reasonable security arrangements.

An organization must destroy documents containing personal information, or remove the means by which it can be associated with particular individuals, as soon as it is reasonable to assume that the purpose of collection is no longer served and retention is no longer necessary for legal or business purposes. Using deception or coercion to collect personal information in contravention of the Act, and failing to comply with an order of the commissioner, are among the offences the Act creates.

An individual who commits an offence is liable to a fine of not more than $10,000, and a person other than an individual to a fine of not more than $100,000. An individual affected by a commissioner's order that has become final has a cause of action against the organization for damages for actual harm suffered as a result of its breach of the Act.

A person affected by the conduct behind an offence of which an organization has been convicted, where the conviction has become final, has a cause of action against the organization for damages for actual harm.