The Personal Information Protection and Electronic Documents Act (PIPEDA), which may also be referred to as the PIPED Act) is a Canadian law relating to data privacy. It governs how private sector organizations collect, disclose, and utilize personal information in the process of conducting commercial business.
Until PIPEDA came into effect, the organizations we speak with have largely applied their own protocols in terms of how they collect, store, and share personal information with both external and internal stakeholders. Although data is recognized as “the new oil”, organizations need to understand the nuances behind what is allowable and what is illegal.
To streamline the process of reigning in Big Data to remain compliant, Next Pathway offers Cornerstone®, which serves companies of all sizes in adhering to the PIPED Act.
Making Sense of PIPEDA’s Implications
Before your company can follow the rules of this important privacy act, you must understand what is acceptable and what is not under the new law. You also need to know whom the act applies to and who will be affected.
These are some of the PIPEDA fundamentals you should know:
- Where It Applies: This act generally applies to privately run organizations in the Canadian territories or provinces of Newfoundland and Labrador, New Brunswick, Manitoba, Nova Scotia, Ontario, Nunavut, Northwest Territories, Prince Edward Island, Yukon, or Saskatchewan. However, the act does not govern how such organizations handle employee information.
- Across Borders: The act also generally applies to private-sector organizations that do business in Canada if the personal information that they collect, disclose, or use in any way crosses national or provincial borders. Again, this inclusion does not extend to the handling of employee information.
- Regulated Federally: The rules also extend to organizations that conduct commercial activity in Canada, such as telephone and broadcasting companies, airlines, and banks. In these cases, the law does include the handling of employee information, as well as health information.
- Different from GDPR: The critical difference between this law and Europe’s recently-enacted General Data Protection Regulation (GDPR) is that the GDPR contains a clause that guarantees the right of an individual to “forget,” or erase, personal data if it affects that person’s well-being. The PIPED Act does not include such a clause.
- Personal Information: While PIPEDA may not allow for personal information to be erased, it does protect such information nonetheless. This personal data includes names, ages, ethnic origins, religions, and blood types. It also extends to comments, evaluations, opinions, disciplinary actions, and social statuses. Also included are incomes, credit records, employment histories, and medical records. Unless an organization is federally regulated, the personal information involved does not include the names, titles, telephone numbers, or business addresses of the organization’s employees.
- Compliance: To remain compliant, applicable organizations must have the clear consent of an individual before they collect, disclose, or use personal information about that person. They may only use such information for the purposes for which they have received consent. They must protect this personal information from being accessed without proper authorization. They must also keep such information updated and filed correctly, so any decisions are based on accurate details. Applicable organizations are required to destroy this information when they no longer need it for their original, authorized purpose, and they must implement accountability mechanisms to ensure total compliance.
Next Pathway assists organizations in matters related to digital transformation and Big Data. The Cornerstone® platform offers security features that allow data to be locked down, with access control enforced at a highly detailed level. This ensures that data is accessed only by those who are authorized within PIPEDA laws.
If your organization is concerned about adhering to PIPEDA, please feel free to contact us for more information.