What is PIPEDA?
 When does PIPEDA take effect?
 What industries are impacted by PIPEDA?
 What does the Act govern?
 What is not governed by the Act?
 I have a four-person company. Do I need to do anything to become PIPEDA compliant?

What is PIPEDA?

The PIPED Act was introduced by Industry Canada in 2001. It establishes rules to govern the collection, use and disclosure of personal information in a manner that balances the right of privacy of all individuals with the need of organizations to collect, use or disclose personal information for a reasonable purpose.

When does PIPEDA take effect?

Implementation will take place in three phases. Phase 1: January 1, 2001 – The law applied to federally regulated private sector, out of province/country exchanges Phase 2: January 1, 2002 – Personal Health information for federally regulated private sector Phase 3: January 1, 2004 – Every organization that collects, uses or discloses personal information in the course of commercial activity.

What industries are impacted by PIPEDA?

This Act affects every Canadian, and every organization that does business in Canada. Organizations are, once the Act takes effect, required to obtain the individual’s consent to disclose personal information. The operating guideline is that no one will be able to make use of an individual’s personal information without that person’s permission.

What does the Act govern?

Personal information includes any factual or subjective information about an identifiable individual. This includes information in any form, such as:  age, name, ID numbers, income, ethnic origin, or blood type  opinions, evaluations, comments, social status, or disciplinary actions  employee files, credit records, loan records, medical records, existence of a dispute between a consumer and a merchant, intentions (for example, to acquire goods or services, or change jobs) Personal information does not include the name, title, business address or telephone number of an employee of an organization.

What is not governed by the Act?

The collection, use or disclosure of personal information by federal government organizations listed under the Privacy Act  Provincial or territorial governments and their agents  An employee's name, title, business address or telephone number  An individual's collection, use or disclosure of personal information strictly for personal purposes (e.g. personal greeting card list)  An organization's collection, use or disclosure of personal information solely for journalistic, artistic or literary purposes

I have a four-person company. Do I need to do anything to become PIPEDA compliant?

It depends. This booklet from CICA will provide you with some guidelines. Get the booklet here.