Your
Privacy Rights
Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA)
Introduction
The Office of the Privacy Commissioner
of Canada has prepared this guide to help individuals learn about their rights under the Personal Information
Protection and Electronic
Documents Act (PIPEDA), Canada’s new private sector privacy law.
What is PIPEDA?
Part 1 of PIPEDA sets ground rules for how organizations may collect,
use or disclose information about you in the course of commercial activities. The law also gives you the right to see and
ask for corrections to information an organization may have collected about you. If you think an organization covered by the
Act is not living up to its responsibilities under the law, you have the right to lodge an official complaint.
What is personal information?
“Personal information”
under the Act means information about an “identifiable individual.”
For example, “personal information” includes
your:
■ name, age, weight, height;
■ medical records;
■ income, purchases
and spending habits;
■ race, ethnic origin and colour;
■ blood type, DNA code, fingerprints;
■
marital status and religion;
■ education; and
■ home address and phone number.
“Personal information” does not include the name, job title, business address or office
telephone number of an employee of an organization.
How does the Act protect my personal information?
Your ability to control your personal information is key to your right
to privacy. The Act gives you control over your personal information by requiring organizations to obtain your consent to
collect, use or disclose information about you. The Act confers certain rights on individuals, and imposes specific obligations
on organizations.
The law gives you the right
to:
■ know why an organization collects, uses or discloses
your personal information;
■ expect an organization to collect,
use or disclose your personal information reasonably and appropriately, and not use the information for any purpose other
than that to which you have consented;
■ know who in the
organization is responsible for protecting your personal information;
■ expect an organization to protect your personal information by taking appropriate security measures;
■ expect the personal information an organization holds about you to be accurate, complete and up-to-date;
■ obtain access to your personal information and ask for corrections if necessary; and complain about how an
organization handles your personal information if you feel your privacy rights have not been respected.
The law requires organizations
to:
■ obtain your consent when they collect, use or disclose
your personal information;
■ supply you with a product or
a service even if you refuse consent for the collection, use or disclosure of your personal information unless that information
is essential to the transaction;
■ collect information
by fair and lawful means; and
■ have personal
information policies that are clear, understandable and readily available.
An organization should destroy, erase or make anonymous
personal information about you that it no longer needs in order to fulfil the purpose for which it was collected.
There are certain exceptions
to these principles. For example, an organization may not need to obtain your consent if collecting the information clearly
benefits you and your consent cannot be obtained in a timely way; or if the information is needed by a law enforcement agency
for an investigation, and getting consent might compromise the information’s accuracy.
How can I see the personal information an organization
has about me?
■ Send a written request to the organization that
holds your personal information. You must provide enough detail to allow the organization to identify the information you
want. For example, include dates, account numbers, and the names or positions of people you may have dealt with at the organization.
■ Organizations must provide the information requested within a reasonable time and at minimal or no cost.
How can I correct errors
or omissions in my personal information?
■ Write to the
organization that has personal information about you and explain the correction you are requesting and why. Supply copies
of any documents that support your request, if you have them.
■ If the organization refuses to correct your personal information, you may require it to attach a statement
of your disagreement to the file. This statement must be passed on to any other organization that may have access to the information.
What if I believe my privacy
rights are not being respected?
The Act gives you the right to make a complaint if:
■
you run into any difficulties obtaining your personal information, if an organization refuses to correct information you consider
inaccurate or incomplete, or if you suspect your personal information has been improperly collected, used or disclosed; or
■ you believe an organization is not following any provision of PIPEDA.
Where do I complain?
■ Contact the Office of the Privacy Commissioner of Canada by calling
1-800-282-1376 if you need more information
or advice on how you should proceed.
■ We encourage
you to first try to settle the matter directly with the organization about which you are complaining by contacting the person
responsible for handling privacy issues within the organization.
■ If you are not satisfied with the organization’s response, you may contact the organization’s
industry association, ombudsman or complaint office, if there is one. For example, the Canadian Marketing Association and
the Canadian Banking Ombudsman handle customers’ complaints about their member companies.
■ If you are not satisfied with the way the organization or industry association handles the matter, contact
the Office of the Privacy Commissioner of Canada. There is no fee for making a complaint to our Office.
What is the role of the
Privacy Commissioner of Canada?
■ The Privacy Commissioner is
an ombudsman who attempts to resolve disputes through negotiation, mediation and conciliation.
■ The Commissioner has the power to investigate your complaint.
■ The Commissioner may also initiate her own investigation or review regarding how an organization handles personal
information.
■ The Commissioner can recommend
that the organization release your personal information to you or correct any inaccuracies.
■ The Commissioner may recommend to an organization that they change their personal information handling practices.
■ The Commissioner will report the findings of the investigation to you and the organization.
What if the organization
ignores the recommendations of the Privacy Commissioner?
■ The Privacy Commissioner
has the power to make public any information about the personal information handling practices of an organization. Few organizations
would like to be publicly identified as having violated the privacy rights of individuals.
■ The Privacy Commissioner may also take the complaint to the Federal Court of Canada on your behalf if she
supports you, but has been unable to resolve the dispute.
■
Once you have received the Privacy Commissioner’s report you may, under certain circumstances, take your complaint to
the Federal Court of Canada yourself.
■ The Court can
order an organization to correct any practices that do not comply with the law, and to publish notices of how it has or will
correct its practices.
■ The Court can also award damages
to the complainant, including damages for humiliation suffered.
What is not covered by PIPEDA?
■ Any federal government organization already covered by the Privacy Act
■ Provincial or territorial governments, and their agents
■ Any organization that collects, uses or discloses personal information solely for journalistic, artistic or
literary purposes
■ An individual’s collection,
use or disclosure of personal information for personal purposes, such as genealogical research shared with other family members
For more information
If you have any questions
about how an organization handles your personal information or wish to make a complaint under the new law, please contact
us at:
Office
of the Privacy Commissioner of Canada
112 Kent Street
Ottawa, ON K1A 1H3
Telephone: (613) 995-8210
Toll-free: 1-800-282-1376
Fax: (613) 947-6850
Web site: www.privcom.gc.ca
E-mail: info@privcom.gc.ca
Please do not make complaints or provide personal information by email, as security cannot be ensured.
Note that this brochure
summarizes the law. As such, it has no legal status.
To obtain the full text of PIPEDA, visit our Web site or contact the Office of the Privacy Commissioner
of Canada.
IP54-1/2004
ISBN: 0-662-68003-0
Updated March 2004
