The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to all businesses in Canada except those in B.C., Alberta, and Quebec.
The Office of the Privacy Commissioner of Canada (OPC) notes that PIPEDA states that any collection, use, or disclosure of personal information must only be for purposes that a reasonable person would consider appropriate in the circumstances.
PIPEDA is based on 10 fair principles for the collection and use of personal data of employees, customers and partners. Three of these are, arguably, the most important:
— the knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate;
— the collection of personal information must be limited to what is needed for the purposes identified by the organization. Information must be collected by fair and lawful means;
— unless the individual consents otherwise or it is required by law, personal information can only be used or disclosed for the purposes for which it was collected. Personal information must only be kept as long as required to serve those purposes.
To make it clearer, the OPC says the following purposes would generally be considered inappropriate — or, what it calls no-go zones — by a reasonable person:
- collecting, using, or disclosing personal information in ways that are otherwise unlawful;
- profiling or categorizing individuals in a way that leads to unfair, unethical, or discriminatory treatment contrary to human rights law;
- collecting, using, or disclosing personal information for purposes that are known to, or likely to, cause significant harm to the individual;
- publishing personal information with the intent of charging people for its removal;
- requiring employees to provide passwords to their social media accounts to employers for the purpose of employee screening; and
- conducting surveillance on an individual using their own device’s audio or video functions.