Federal vs. Provincial Privacy Law: Which Applies to You
How to figure out whether PIPEDA, a provincial private-sector law, a public-sector law, or a health privacy law applies to your issue.
TL;DR
The right law depends on who holds the information (private sector, public sector, health custodian), where the organization operates, and whether the activity is interprovincial or international. PIPEDA fills the gaps but can be displaced by 'substantially similar' provincial laws in BC, Alberta, and Quebec.
Three buckets of law
Canadian privacy law has three main buckets:
Private-sector: PIPEDA federally, BC PIPA, Alberta PIPA, Quebec Law 25 provincially.
Health: dedicated statutes like PHIPA, HIA, HIPA, PHIA.
How PIPEDA interacts with provincial laws
Where a province has 'substantially similar' private-sector legislation, PIPEDA generally does not apply to intraprovincial activities.
PIPEDA still applies to interprovincial and international flows of personal information, and to federally regulated businesses in all provinces.
When multiple laws apply
An incident can involve multiple regimes. For example, a health care organization in BC that sends data to an Ontario service provider triggers BC PIPA, Ontario PHIPA, and potentially PIPEDA for the cross-border flow.