Federal Privacy Law in Canada: PIPEDA and the Privacy Act Explained

Canada's federal privacy framework rests on two statutes, and the first question in any privacy problem is which of them is in play. The Privacy Act governs the federal government itself: the Canada Revenue Agency, Immigration, Refugees and Citizenship Canada, Service Canada, the RCMP, CSIS and the other federal institutions listed in its schedule. The Personal Information Protection and Electronic Documents Act, PIPEDA, governs private organizations that collect, use or disclose personal information in the course of commercial activity. PIPEDA also covers federally regulated employers, meaning banks, airlines, railways, interprovincial trucking firms, telecoms and broadcasters, and for those employers alone it reaches employee information as well as customer information.

The two laws give an individual a similar core of rights by different routes. Under the Privacy Act, section 12(1) gives every Canadian citizen and permanent resident a right of access to their own personal information held by a federal institution. Section 12(2) lets that person request a correction where they believe there is an error or omission, and where the correction is refused, "require that a notation be attached to the information reflecting any correction requested but not made". Section 14 gives the institution thirty days after the request is received to give written notice of whether access will be given, and section 15 allows an extension of up to a further thirty days for operational interference or necessary consultations.

Under PIPEDA the clock is the same length but the wording is different. Section 8(3) says an organization "shall respond to a request with due diligence and in any case not later than thirty days after receipt of the request". Section 8(4) allows a single extension of up to thirty more days where meeting the limit would unreasonably interfere with the organization's activities. Section 8(5) matters most of all: if the organization fails to respond within the time limit, it "is deemed to have refused the request", which means silence itself is the thing an individual can complain about.

Paragraph 26(2)(b) of PIPEDA lets the Governor in Council exempt organizations in a province from the federal law where that province has passed legislation considered substantially similar to it. Three provinces have that exemption for their general private sector: Quebec by SOR/2003-374, Alberta by SOR/2004-219 and British Columbia by SOR/2004-220. Four more have it for health information custodians only: Ontario by SOR/2005-399, New Brunswick by SOR/2011-265, Newfoundland and Labrador by SI/2012-72, and Nova Scotia by SOR/2016-62. The Privacy Commissioner's guidance puts the effect plainly: wherever the substantially similar provincial law applies, that law applies instead of PIPEDA.

For someone living in Quebec, Alberta or British Columbia this changes the address, not the right. A complaint about an ordinary local business goes to the Commission d'accès à l'information du Québec, the Office of the Information and Privacy Commissioner of Alberta, or the Office of the Information and Privacy Commissioner for British Columbia rather than to Ottawa. Those provincial regulators also hold powers the federal Commissioner does not. In British Columbia, section 52 of PIPA requires the Commissioner to dispose of an inquiry by making an order, and section 53 requires the organization to comply within thirty days unless it brings a judicial review inside that window. The federal Commissioner, by contrast, issues findings and recommendations, and enforcement runs through the Federal Court.

PIPEDA does not vanish from those provinces. It continues to apply to federally regulated businesses operating there, and to personal information that crosses a provincial or a national border. A Quebec resident with a complaint about their bank is still on the federal track. The same resident with a complaint about a local retailer is on the provincial one. Where the information moved between provinces or out of the country, both regimes can be engaged at once, which is why the OPC and its provincial counterparts run joint investigations.