Canada Personal Information Protection and Electronic Documents Act | PIPEDA

Personal Information Protection and Electronic Documents Act (PIPEDA)- Canada

The Personal Information Protection and Electronic Documents Act (PIPEDA) is a Canadian federal law relating to data privacy and contains various provisions to facilitate the use of electronic documents.

PIPEDA was initially introduced on 13 April 2000 and entered into force in stages, beginning on 1 January 2001 and extending to organizations in Canada from 1 January 2004. PIPEDA, as known today, governs how businesses in Canada can collect, use and disclose personal information in the course of commercial activities.

PIPEDA sets out 10 fair information principles which are as follows

Accountability: organizations should appoint someone to be responsible for compliance.

Identifying purposes: organizations must define the purpose for collecting personal information.

Consent: organizations must inform the data subject of the collection, use, and disclosure of personal information.

Limiting collection: Personal data is categorized into general personal data and specific personal data under the PDP law.

Limiting use, disclosure, and retention:organizations must not use or disclose personal information for a purpose different from the purpose it was collected for, except under certain circumstances.

Accuracy: organizations must keep personal information accurate.

Safeguards: organizations must protect personal information against loss or theft.

Openness: privacy policy and practices must be understandable and easily available.

Individual access:data subjects have a right to access the personal information an organization holds about them.

Resource:organizations must develop accessible complaint procedures.

Key obligations and consequences

Understand whether and when PIPEDA affects you. If you are handling personal information in the course of commercial activities in Canada, PIPEDA normally applies.

The main exceptions are for activity within a province that has its own laws on personal information, and for non-business groups carrying out their main purpose (such as charity work or political campaigning.)

Understand the key requirements: you must get specific, informed consent from the individual to use information for a specific purpose, you must let them see and if necessary correct the information, and you must safeguard the information.

Designate a senior person from your organization to take responsibility for PIPEDA compliance.

Develop clear policies and procedures to make sure you follow the 10 principles of PIPEDA, bearing in mind these principles are part of the law rather than general guidelines. Have a Privacy Policy to disclose your policies and procedures.

Keep records of the purpose for which you gather information, the consent you've gathered, the ways in which you use or share the information, and when you should dispose of it.

Make sure individuals know how you handle information, how they can access and correct it, and how they can complain if they think you've breached PIPEDA. Make sure you have systems in place to deal with any of these requests or complaints.

Never destroy information after a valid access request, retaliate against an employee's legitimate behavior in relation to PIPEDA, or obstruct any investigation into alleged breaches. These are all criminal offenses.

Key Challenges in brief:

Fulfillment of Data Subject Rights

Privacy notices:-
The purposes for which personal information is collected must be identified by the organization at or before the time the information is collected.
Rights to access information:-
Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An organization shall respond to an individual’s request within a reasonable time and at minimal or no cost to the individual. The requested information shall be provided or made available in a form that is generally understandable. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

Consent Requirement

An individual may withdraw consent to the collection, use and disclosure of personal information at any time, subject to legal or contractual restrictions and reasonable notice. If an individual withdraws consent to the collection, use and disclosure of personal information and/or if the purpose of collection has been fulfilled, then the organization should delete such information, in particular, where requested by the individual in question.

Data Breach Notification

An organization must report any breach of security safeguards involving personal information under its control to the Privacy Commissioner if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual. Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

Cross Border Data Transfer

PIPEDA does not contain any specific restrictions related to cross-border data flows. However, all transfers of personal information to a third-party processor, whether within Canada or cross-border, are subject to the “accountability” principle under PIPEDA. Specifically, an organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.

Solutions

Data discovery, inventory and mapping

Our AI-based, patented solution, TurtleShield PI (Privacy Intelligence) discovers all personal and sensitive data in structured and unstructured data systems across on-premises and multi-cloud environments. TurtleShield DI (Data Inventory) enables organizations to inventory & map their entire “Data footprint”, enabling them to protect what matters the most.

Third party Privacy Intelligence (monitors third party sharing)

Often there are silos within entities or business and IT teams and it is challenging to get a full picture of data going outside organization and which is coming into organization, especially when data is shared with third parties, vendors, business partners and much more. Our TurtleShield PI (Privacy Intelligence) creates a data map based on your “data sharing”, to facilitate you to take action on it.

Data Minimization

TurtleShield DM (Data Minimization) helps businesses minimize excess data and adhere to data minimization principle. This is data hygiene control and we are approaching it from a risk reduction and compliance perspective. We scan large data sets to scan for excess data using Machine Learning and find out excess data including personal data. This can eliminate operational inefficiencies and save cost by removing the unwanted data and legal cost of having it with respect to regulatory compliance.

Right to be Forgotten (RTBF) with Assured Deletion

With TurtleShield RTBF (Right to Be Forgotten) provides the businesses the capabilities to comply with mandatory deletion of personal data by providing the capabilities to delete the data on request along with the validation of the deletion.

Enable Data subject rights with cost savings and compliance in totality

Search capability in large datasets to fulfill data subject requests in totality and at rapid space. Assumption that data only exists in databases and nowhere else is often not reality as customer data exists in many sources. Using Machine learning and AI we crawl across data sources and predict where PII can exist.

Key Obligations & Consequences

Understand whether and when PIPEDA affects you. If you are handling personal information in the course of commercial activities in Canada, PIPEDA normally applies.

Designate a senior person from your organization to take responsibility for PIPEDA compliance.

Keep records of the purpose for which you gather information, the consent you've gathered, the ways in which you use or share the information, and when you should dispose of it.

Key Challenges in brief:

Fulfillment of Data Subject Rights

Privacy notices:-
The purposes for which personal information is collected must be identified by the organization at or before the time the information is collected.
Rights to access information:-
Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An organization shall respond to an individual’s request within a reasonable time and at minimal or no cost to the individual. The requested information shall be provided or made available in a form that is generally understandable. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

Consent Requirement

Data Breach Notification

Cross Border Data Transfer

Solutions

Data discovery, inventory and mapping: Our AI-based, patented solution, TurtleShield PI (Privacy Intelligence) discovers all personal and sensitive data in structured and unstructured data systems across on-premises and multi-cloud environments.
TurtleShield DI (Data Inventory) enables organizations to inventory & map their entire “Data footprint”, enabling them to protect what matters the most.

Third party Privacy Intelligence (monitors third party sharing): Often there are silos within entities or business and IT teams and it is challenging to get a full picture of data going outside organization and which is coming into organization, especially when data is shared with third parties, vendors, business partners and much more. Our TurtleShield PI (Privacy Intelligence) creates a data map based on your “data sharing”, to facilitate you to take action on it.

Data Minimization: TurtleShield DM (Data Minimization) helps businesses minimize excess data and adhere to data minimization principle. This is data hygiene control and we are approaching it from a risk reduction and compliance perspective. We scan large data sets to scan for excess data using Machine Learning and find out excess data including personal data. This can eliminate operational inefficiencies and save cost by removing the unwanted data and legal cost of having it with respect to regulatory compliance.

Right to be Forgotten (RTBF) with Assured Deletion: With TurtleShield RTBF (Right to Be Forgotten) provides the businesses the capabilities to comply with mandatory deletion of personal data by providing the capabilities to delete the data on request along with the validation of the deletion.

Enable Data subject rights with cost savings and compliance in totality: Search capability in large datasets to fulfill data subject requests in totality and at rapid space. Assumption that data only exists in databases and nowhere else is often not reality as customer data exists in many sources. Using Machine learning and AI we crawl across data sources and predict where PII can exist.

Featured News & Blogs

Understanding NYDFS Rules: A Comprehensive Guide to Financial Regulation in New York

Personal Information Protection and Electronic Documents Act (PIPEDA)- Canada