Three buckets of law
Canadian privacy law has three main buckets:
- Private-sector: PIPEDA federally, BC PIPA, Alberta PIPA, Quebec Law 25 provincially.
- Public-sector: Privacy Act federally, FIPPA/FOIP/ATIPP provincially.
- Health: dedicated statutes like PHIPA, HIA, HIPA, PHIA.
How PIPEDA interacts with provincial laws
Where a province has 'substantially similar' private-sector legislation, PIPEDA generally does not apply to intraprovincial activities.
PIPEDA still applies to interprovincial and international flows of personal information, and to federally regulated businesses in all provinces.
When multiple laws apply
An incident can involve multiple regimes. For example, a health care organization in BC that sends data to an Ontario service provider triggers BC PIPA, Ontario PHIPA, and potentially PIPEDA for the cross-border flow.