Privacy

Note: The information provided on this webpage is of a general nature and does not constitute legal advice. Moreover, it addresses only some issues in privacy law. If you have questions about how privacy law applies in a particular situation, you should consult a lawyer.

Introduction

With the continued growth of the internet and the ever increasing ability of online services to track and 'mine' personal information, the protection of personal information has become a hot topic.

In Canada, data protection in the private sector is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and substantially similar provincial laws in certain provinces. These statutes regulate the collection, use, and disclosure of personal information by private sector organizations. Organizations that operate wholly within Alberta, B.C., or Quebec are governed by the province’s privacy legislation. All other organizations engaged in commercial activities in Canada are subject to PIPEDA.

Public sector organizations are subject to separate privacy legislation. Federally, the Privacy Act governs government collection, use and disclosure of personal information. Each province has its own public sector privacy legislation, usually combined with access to information legislation – e.g., the Ontario Freedom of Information and Protection of Privacy Act. Some provinces (e.g., Alberta, Manitoba, Ontario and Saskatchewan) also have legislation specific to health privacy.

This webpage addresses issues surrounding PIPEDA, privacy in the private sector, and ways to protect your personal privacy while online. Information regarding provincial privacy legislation can be obtained by following the appropriate links under Resources.

For more information on privacy laws, see the Privacy Commissioner of Canada's website. Links to provincial privacy commissioners and relevant legislation are provided under Resources on that site. For information concerning your right to access information held by government organizations as well as private organizations, see CIPPIC's Access to Information User Manual.

F.A.Q.

 

What information is protected under PIPEDA?

Personal Information Protection and Electronic Documents Act (PIPEDA) is focused on the protection of "Personal Information". The definition of "Personal Information" for the purposes of the Act is broad, covering any "information about an identifiable individual" except the name, title, and business address or office telephone number of an employee of an organization. While not explicitly stated in the legislation, it is likely that business email addresses and facsimile numbers would also fall outside the definition of "personal information".

Anonymous data (i.e. information not associated with an individual) does not constitute 'personal information' and is therefore not subject to the restrictions in the Act.

To whom does PIPEDA apply?

PIPEDA, or substantial similar provincial legislation, applies to every business, organization, and individual that engages in the collection, use or disclosure of personal information in the course of a commercial activity. "Commercial activity" includes the selling, bartering or leasing of donor, membership or other fundraising lists.

The Act does not apply to information collected for personal purposes, such as recording the telephone numbers and addresses of friends and family in a personal address book. Nor does it apply to information collected, used, or disclosed for journalistic, artistic, or literary purposes.

What are my rights under PIPEDA?

Under PIPEDA you have the right to:

What does the law require of organizations collecting personal information?

All organizations in Canada are responsible for personal information under their control and are required to:

There are a number of exceptions to the above requirements. For example, organizations need not obtain the consent of an individual to:

How do I know what information an organization has about me?

You may ask an organization to disclose any and all personal information about you that it has collected. In most circumstances an organization must provide the information requested within a reasonable time and at minimal or no cost. For more information on your rights to access your personal information held by private sector companies or the government, see CIPPIC's Access to Information Manual.

There are a number of situations where an organization cannot, or can choose not to disclose personal information about you that it has collected. For example, an organization cannot disclose personal information about you that it has collected if it would likely reveal personal information about another individual unless that individual has consented to the disclosure of the information or there exists a life-threatening situation.

Similarly, an organization may choose not to disclose personal information about you that it has collected if to do so would reveal confidential commercial information, violate solicitor-client privilege, or threaten the life or security of a third party. It is important to note however, that an organization cannot choose to withhold information in situations where an individual's life, health or security is in jeopardy.

How can I correct information held about me by an organization?

Personal information is required to be as accurate, complete and up-to-date as is necessary for the purposes for which it is collected. Individuals may write to an organization that they believe has inaccurate information about them and request that the information be corrected. In these situations you may wish to attach supporting documentation to your request.

If the organization refuses to correct your personal information, you may require it to attach a statement of your disagreement to the file. This statement must be passed on to any other organization that is given access to the information.

How can I lodge a complaint against an organization?

The federal Office of the Privacy Commissioner encourages you try to settle the matter directly with the organization by contacting the person responsible for handling privacy issues within the organization.

However, if you are unsatisfied with an organization's response to your privacy concerns, you may lodge a complaint with the federal Office of the Privacy Commissioner by calling 1-800-282-1376. You may also complain to your provincial Privacy Commissioner by following the links below.

Some organizations are subject to PIPEDA, while others are subject to similar provincial legislation that is administered by that province's Privacy Commissioner. If the office you are complaining to does not have jurisdiction over the organization in question, they should refer you to the office that does have jurisdiction.

What is the role of the Privacy Commissioner?

The Privacy Commissioner of Canada acts as an ombudsman who investigates complaints and negotiates solutions between you and the organization. While the Commissioner does not have the authority to order an organization to change their personal information policies or procedures she may make public any information relating to the personal information management practices of an organization.

While they also provide ombudsman-type services, Privacy Commissioners in Quebec, Alberta and B.C. have broader enforcement powers, including the ability to make rulings that are binding on the organization. For more information on the powers of the various provincial Privacy Commissioners, follow the links under "Resources", below.

What remedies exist beyond the Office of the Privacy Commissioner of Canada?

If you are not satisfied with the outcome of the actions taken by the Privacy Commissioner of Canada, it is possible to take the matter to the Federal Court of Canada. The Court has the authority to order an organization to change its personal information collection practices. The Court also has the discretion to order an organization to compensate you for damages (including humiliation) suffered as a result of a violation of PIPEDA.

What level of privacy can I expect online?

Almost nothing you do on the internet is truly private. Every time you access content or services through the internet there is the potential for websites and online services to collect details about your location, your ISP (Internet Service Provider), previous websites you have visited, your interests, and your computer's technical configuration.

Information about a consumer's behaviour and interests is invaluable for marketing purposes. A 1999 study conducted by Georgetown University found that 92.8% of websites collect at least one type of personal identifying information (e.g. name, email address, postal address), and that 56.8% collected at least one type of demographic information (e.g. gender, preferences, postal code). Only 6.6% of the websites analyzed collected no personal information.

Some individuals use online aliases in chat rooms and news groups to protect their identity and privacy, but an online alias is not an absolute barrier against the discovery of an individual's true identity. In short, it is naive to believe that one's online activities usually go unnoticed.

How do online services track and record personal information?

Websites and online services employ a number of techniques to track and collect personal information from users.

A cookie is a text file containing certain information that a website or online service can store on a user's hard disk. Every time you re-visit a website the contents of the cookie are read from your computer. Cookies allow websites and online services to track information such as website traffic, user preferences, and online purchases. In some instances companies have engaged in cross-site profiling which allowed them to collect and analyze information across a number of different websites and create vast databases of user profiles.

A web bug is a graphic on a Web page or in an e-mail message that enables a third party to monitor who is reading the page or message. Web bugs are often invisible because they are typically only 1-by-1 pixels in size. In many cases, Web bugs are placed on Web pages by third parties interested in collecting data about visitors to those pages. A web bug can confirm when a message or web page is viewed and record the IP address of the viewer. Like cookies, web bugs can be used to collect and record user data that can compromise an individual's privacy.

Spyware is software installed on your computer, often without your knowledge, which is designed to track and report you're movements as you surf the web. Spyware can be used to collect more detailed personal information about you and in some cases can be used to capture credit card numbers and other sensitive information. Adware is a similar program that is often combined with other programmes to display or re-route your internet browser to advertisements on the internet.

In addition, users often volunteer personal information such home addresses, phone numbers, and email addresses, to websites or online services when filling out online registration forms. When companies combine information collected surreptitiously with information provided voluntarily, it is possible to create a detailed profile of an individual.

What can I do to protect my privacy while online?

There are various ways to protect your privacy while online. While none of these options are fool-proof, their use may help to preserve your personal information.

Encryption software makes it more difficult for third parties to read your messages and documents. Encryption software works by encoding files so that they become gibberish to anyone but the intended recipient. Encrypted transfers are particularly important when sending sensitive information, such as credit card numbers and other financial information, over the internet.

Some websites use encryption software to ensure information sent by users will be kept confidential. These sites usually indicate that transfers are secure and your internet browser will often display a symbol – usually a small padlock - in the lower right hand corner of the page.

Cookie deflectors make the file where a browser stores its cookies unreadable or do not allow a website to copy a cookie to your hard drive in the first place. Also, most internet browsers can now be configured to restrict cookies from being stored on your computer.

A remailer is a computer service which privatizes your email. Unlike average email servers which log incoming and outgoing traffic and add identifying and traceable information to outgoing mail, anonymous remailers strip emails of any identifiable information. When delivered to the recipient, the email will only reveal that it was sent from an anonymous source (usually the remailer's name and email address).

Anonymous web surfing programmes act as an intermediary between your computer and any websites you visit and prevent the websites recording information about you.

Resources

Legislation Governing Privacy in the Private Sector

Government Resources

Canadian Non-Government Resources

International Resources

Resources for Small Businesses

Other

Back to top

This page last updated: June 2, 2007