Provincial Privacy Laws in Canada: Every Province and Territory Compared

Frequently asked questions about provincial privacy law

Which provinces have their own private-sector privacy law instead of PIPEDA?

Three: Quebec, Alberta and British Columbia. Each has a private-sector statute the federal government declared substantially similar to PIPEDA under paragraph 26(2)(b), by SOR/2003-374 for Quebec, SOR/2004-219 for Alberta and SOR/2004-220 for British Columbia. In those provinces an ordinary business answers to the provincial law and the provincial regulator for its intra-provincial activity. Everywhere else the private sector is covered by PIPEDA and complaints go to the Privacy Commissioner of Canada. PIPEDA still applies in all three provinces to federally regulated businesses such as banks, airlines, railways and telecoms, and to information that crosses a provincial or national border.

Who regulates privacy in my province?

Ten of the thirteen jurisdictions have a dedicated information and privacy commissioner: Alberta, British Columbia, Newfoundland and Labrador, Nova Scotia, Ontario, Prince Edward Island, Quebec (the Commission d'accès à l'information), Saskatchewan, the Northwest Territories, Nunavut and Yukon. Two use an ombudsman office instead: Manitoba, where the Manitoba Ombudsman handles access and privacy, and New Brunswick, where the Ombud for New Brunswick does. Each office is listed with its official website in the table above. Complaints to any of them are free.

Does my province have a separate law for health records?

In most cases yes. Ontario has PHIPA, Alberta the Health Information Act, Saskatchewan the Health Information Protection Act, Manitoba, Nova Scotia and Newfoundland and Labrador the Personal Health Information Act, New Brunswick the Personal Health Information Privacy and Access Act, Prince Edward Island the Health Information Act, the Northwest Territories the Health Information Act and Yukon the Health Information Privacy and Management Act. British Columbia's health-specific statute is the E-Health Act, and Quebec's health privacy rules sit inside its health services, health insurance and RAMQ statutes. The Privacy Commissioner of Canada lists no separate health-information statute for Nunavut. The Ontario, New Brunswick, Nova Scotia and Newfoundland and Labrador health laws have been declared substantially similar to PIPEDA for health custodians.

Does provincial privacy law cover my employer, or does the federal one?

It depends on the employer, not on the province. Federally regulated employers, meaning banks, airlines, railways, interprovincial trucking firms, telecoms and broadcasters, are covered by PIPEDA for employee information wherever they operate. Employees of provincially regulated private businesses are covered by the provincial private-sector law in Quebec, Alberta and British Columbia, since those statutes reach employee personal information. In the other seven provinces and the three territories there is no general private-sector privacy statute governing an ordinary employer's handling of employee records, because PIPEDA reaches employee information only for federal works, undertakings and businesses. Public-sector employees are covered by their jurisdiction's access and privacy statute.