PIPEDA Changes in the Digital Privacy Act

A federal law, as of yesterday

The Digital Privacy Act received royal assent yesterday. It amends PIPEDA, the federal law that governs how businesses in much of Canada collect, use and disclose personal information.

Most of its changes took effect immediately. The most discussed one, mandatory reporting of breaches, did not: it is written into the law but waits for a date that has not been set.

For a small business, the change that matters most right now concerns consent, and it touches every form and sign-up box on a website.

This is a summary for owners, not legal advice.

Which businesses this touches

PIPEDA governs how businesses treat personal information across most of the country, and it also applies when that information moves between provinces or out of Canada.

A few provinces have passed their own private-sector privacy laws, and which one applies to a given business turns on where it operates and what it does with the information.

Even where PIPEDA is not the main law, its new consent wording is a sensible standard to write to. It describes what good practice already looked like.

What took effect yesterday

• Valid consent: people must be able to understand what they are agreeing to.
• Business contact details used only for business communication fall outside the law.
• Selling a business: customer records can be shared under set conditions.
• New exceptions for contacting next of kin or reporting suspected financial abuse.
• Fraud and investigations: limited sharing between organisations without consent.

The first is the one that reaches every business. The others apply in particular situations, and the second is narrower than it sounds.

Consent the people asked would understand

Consent is now valid only if it is reasonable to expect that the people a business's activities are aimed at would understand the nature, purpose and consequences of what they are agreeing to.

The test is the audience, not the lawyer. A consent line that a lawyer finds precise but a customer cannot follow does not meet it.

That has practical effects. A box ticked in advance beside a link to a long policy shows very little understanding. So does wording that mentions partners and affiliates without saying who they are.

A business whose customers include teenagers, or people reading in a second language, has to write for them.

Breach reporting, added but not in force

The Act adds a duty to report a breach of security safeguards to the Privacy Commissioner, and to tell the people affected, whenever the breach poses what the Act calls a real risk of significant harm.

It also requires organisations to keep a record of every breach, reported or not.

None of that applies yet. Those sections come into force on a date still to be fixed, and the details of what a report must contain have not been published.

Preparing costs little. Knowing what personal information you hold, and where, is the first thing any breach response needs.

A worked example

A wilderness first aid school runs weekend and week-long courses for guides, camp counsellors and hikers, and takes registrations through a form on its website.

The form asks for contact details, a date of birth for the certificate, an emergency contact and any health conditions the instructors should know about during outdoor scenarios.

At the bottom sat a box, already ticked, beside the words I agree to the privacy policy. The policy had been copied from a larger company's site and mentioned affiliates the school did not have.

It said nothing about the course list, with names and birth dates, that goes to the organisation issuing the certificates, or the scenario photographs posted on the school's Facebook page.

Many registrants are camp staff of sixteen or seventeen. The owner replaced the box with three plain sentences: what is collected, who receives it and why, and when the health answers are deleted.

Photographs now have a separate box, left unticked, and the privacy page was rewritten to match.

Selling or buying a business

Until now, selling a business raised an awkward question: could a buyer look at customer records during negotiations without each customer's consent?

The Act now allows it, under conditions. The parties need a written agreement limiting use of the information to the transaction, protecting it, and returning or destroying it if the sale does not go ahead.

After the sale, the buyer can keep using the information for the original purposes, and customers must be told within a reasonable time. Anyone planning a sale should still have a lawyer draft that agreement.

Business contact details

PIPEDA no longer applies to business contact information, such as a name, title, work email and work phone number, when it is used only to communicate with someone about their job or business.

That settles the status of a business card in a drawer or a supplier's address in your contacts.

It does not change Canada's anti-spam law. Sending commercial email to that work address still needs consent under CASL, a separate law with separate rules.

The privacy page worth updating

Many small business privacy pages were copied from somewhere else years ago. This is a good week to replace yours with one written for your own customers.

Say what each form collects and why, which outside services receive it (a mailing service, a payment processor, a certifying body), when it is deleted, and how someone can ask what you hold about them.

Name a person or role to contact, with a working email address. And put a plain version of each consent beside the form it belongs to, not only on the policy page.

The counter-case

For many small businesses this is not a large change. A shop with a single enquiry form, no newsletter and nothing sensitive on file was probably close to the new standard already.

Businesses mainly covered by a provincial law should check how that law treats consent rather than assume the federal wording applies.

And the breach provisions are not in force, so there is no deadline this month. The consent change is in force, though, and the place to start is the wording beside every form.

This month

1. List every form that collects personal information.
2. Read each consent line as a customer would.
3. Untick any boxes ticked in advance.
4. Rewrite consent in plain words beside each form.
5. Replace a copied privacy policy with your own.
6. Choose one person to answer privacy questions.
7. Note where personal information is stored.

Step four is the change the law now asks for. A policy page can carry the details, but the sentence beside the button is what people actually read when they agree.

Canada's anti-spam law has consent rules of its own for installing programs, covered separately in CASL rules on installing software start today.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.