Section 7.2 — Personal Information Protection and Electronic Documents Act: Prospective business transaction

In addition to the circumstances set out in subsections 7(2) and (3), for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, organizations that are parties to a prospective business transaction may use and disclose personal information without the knowledge or consent of the individual if the organizations have entered into an agreement that requires the organization that receives the personal information to use and disclose that information solely for purposes related to the transaction, to protect that information by security safeguards appropriate to the sensitivity of the information, and if the transaction does not proceed, to return that information to the organization that disclosed it, or destroy it, within a reasonable time; and the personal information is necessary to determine whether to proceed with the transaction, and if the determination is made to proceed with the transaction, to complete it. In addition to the circumstances set out in subsections 7(2) and (3), for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, if the business transaction is completed, organizations that are parties to the transaction may use and disclose personal information, which was disclosed under subsection (1), without the knowledge or consent of the individual if the organizations have entered into an agreement that requires each of them to use and disclose the personal information under its control solely for the purposes for which the personal information was collected, permitted to be used or disclosed before the transaction was completed, to protect that information by security safeguards appropriate to the sensitivity of the information, and to give effect to any withdrawal of consent made under clause 4.3.8 of Schedule 1; the personal information is necessary for carrying on the business or activity that was the object of the transaction; and one of the parties notifies the individual, within a reasonable time after the transaction is completed, that the transaction has been completed and that their personal information has been disclosed under subsection (1). An organization shall comply with the terms of any agreement into which it enters under paragraph (1)(a) or (2)(a). Subsections (1) and (2) do not apply to a business transaction of which the primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.