PIPEDA
and Personal Information

By Caterina Chiocchio

PIPEDA sounds like a mythical creature, but the Personal Information Protection and Electronics Document Act (the "PIPEDA") is slowly becoming a part of our daily lives. PIPEDA compels an organization engaged in commercial activity to establish a privacy policy so that consumers will know in advance how their personal information will be collected, used and disclosed.

Take a Privacy Quiz!

PIPEDA defines personal information as "information about an identifiable individual but does not include the name, title or business address or telephone number of an employee of an organization." In other words, your name and employment information are not considered personal information but your home address, telephone number, personal health information and in a recently expanded definition of "personal information" your email address is private. In certain circumstances even a photograph can be personal information.

...the university Bookstore may be bound by PIPEDA when it collects customer information. Similarly, the sale or barter of alumni information may be covered by the statute.

To date, Universities in Ontario are not directly covered by PIPEDA or by any other statute to regulate the collection, use and disclosure of personal information. However, some University activities may fall under the statute. For example, the university Bookstore may be bound by PIPEDA when it collects customer information. Similarly, the sale or barter of alumni information may be covered by the statute. Any activity that a University engages in that is of a commercial nature but not part of the core mission of the University is likely subject to PIPEDA.

How does PIPEDA protect you? When asked for information you now have the right to question whether the:

• Information falls under the statutory definition of "personal information"
• Organization has collected, used or disclosed your personal information in the course of commercial activities or in connection with the operation of a federal work or undertaking.
• Organization breached one of the guidelines for the appropriate use, collection and disclosure of personal information including rules regarding consent, limiting the collection of the information, maintaining appropriate safeguards, and accuracy of personal information. (See Schedule A )

A company may use personal information without an individual’s knowledge or consent when in the course of the organization's activities it is believed that the information can be used in the investigation of an illegal act, or when the information is used in an emergency to ensure the health, safety and security of a person.

Finally, a company may disclose personal information without an individual’s knowledge or consent at the request: of a lawyer, by warrant or subpoena, by a government institution to carry on its activities, or a person who needs the information for an emergency that threatens life, health or security of an individual.

PIPEDA must be followed by any business wishing to conduct commercial activities here. Unlike the unicorn, PIPEDA is the reality in Canada.

For more information on PIPEDA visit the website: http://www.privcom.gc.ca/legislation/02_06_01_01_e.asp

Caterina Chiocchio is a student in the Faculty of Law at the University of Windsor.
e-Law is a recurring feature edited by Professor Myra Tawfik, Faculty of Law, University of Windsor.

© 2006, Caterina Chiocchio. All rights reserved.