Personal Information Protection and Electronic Documents Act
Sections and provisions with full text and the judgments that cite each one.
Section 1 — Short title
This Act may be cited as the Personal Information Protection and Electronic Documents Act .
Section 2 — Definitions
The definitions in this subsection apply in this Part. alternative format , with respect to personal information, means a format that allows a person with a sensory disability to read or listen to…
Section 3 — Purpose
The purpose of this Part is to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of…
Section 4 — Application
This Part applies to every organization in respect of personal information that the organization collects, uses or discloses in the course of commercial activities; or is about an employee of, or an…
Section 4.01 — Business contact information
This Part does not apply to an organization in respect of the business contact information of an individual that the organization collects, uses or discloses solely for the purpose of communicating…
Section 4.1 — Certificate under Canada Evidence Act
If a certificate under section 38.13 or 38.41 of the Canada Evidence Act prohibiting the disclosure of personal information of a specific individual is issued before a complaint is filed by that…
Section 5 — Compliance with obligations
Subject to sections 6 to 9, every organization shall comply with the obligations set out in Schedule 1. The word should , when used in Schedule 1, indicates a recommendation and does not impose an…
Section 6 — Effect of designation of individual
The designation of an individual under clause 4.1 of Schedule 1 does not relieve the organization of the obligation to comply with the obligations set out in that Schedule.
Section 6.1 — Valid consent
For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization’s activities are directed would…
Section 7 — Collection without knowledge or consent
For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual…
Section 7.1 — Definitions
The following definitions apply in this section. access means to program, to execute programs on, to communicate with, to store data in, to retrieve data from, or to otherwise make use of any…
Section 7.2 — Prospective business transaction
In addition to the circumstances set out in subsections 7(2) and (3), for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, organizations that are parties to…
Section 7.3 — Employment relationship
In addition to the circumstances set out in section 7, for the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, a federal work, undertaking or business may…
Section 7.4 — Use without consent
Despite clause 4.5 of Schedule 1, an organization may use personal information for purposes other than those for which it was collected in any of the circumstances set out in subsection 7.2(1) or (2)…
Section 8 — Written request
A request under clause 4.9 of Schedule 1 must be made in writing. An organization shall assist any individual who informs the organization that they need assistance in preparing a request to the…
Section 9 — When access prohibited
Despite clause 4.9 of Schedule 1, an organization shall not give an individual access to personal information if doing so would likely reveal personal information about a third party. However, if the…
Section 10 — Sensory disability
An organization shall give access to personal information in an alternative format to an individual with a sensory disability who has a right of access to personal information under this Part and who…
Section 10.1 — Report to Commissioner
An organization shall report to the Commissioner any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach…
Section 10.2 — Notification to organizations
An organization that notifies an individual of a breach of security safeguards under subsection 10.1(3) shall notify any other organization, a government institution or a part of a government…
Section 10.3 — Records
An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control. An…
Section 11 — Contravention
An individual may file with the Commissioner a written complaint against an organization for contravening a provision of Division 1 or 1.1 or for not following a recommendation set out in Schedule 1.…
Section 12 — Examination of complaint by Commissioner
The Commissioner shall conduct an investigation in respect of a complaint, unless the Commissioner is of the opinion that the complainant ought first to exhaust grievance or review procedures…
Section 12.1 — Powers of Commissioner
In the conduct of an investigation of a complaint, the Commissioner may summon and enforce the appearance of persons before the Commissioner and compel them to give oral or written evidence on oath…
Section 12.2 — Reasons
The Commissioner may discontinue the investigation of a complaint if the Commissioner is of the opinion that there is insufficient evidence to pursue the investigation; the complaint is trivial,…
Section 13 — Contents
The Commissioner shall, within one year after the day on which a complaint is filed or is initiated by the Commissioner, prepare a report that contains the Commissioner’s findings and…
Section 14 — Application
A complainant may, after receiving the Commissioner’s report or being notified under subsection 12.2(3) that the investigation of the complaint has been discontinued, apply to the Court for a hearing…
Section 15 — Commissioner may apply or appear
The Commissioner may, in respect of a complaint that the Commissioner did not initiate, apply to the Court, within the time limited by section 14, for a hearing in respect of any matter described in…
Section 16 — Remedies
The Court may, in addition to any other remedies it may give, order an organization to correct its practices in order to comply with Divisions 1 and 1.1; order an organization to publish a notice of…
Section 17 — Summary hearings
An application made under section 14 or 15 shall be heard and determined without delay and in a summary way unless the Court considers it inappropriate to do so. In any proceedings arising from an…
Section 17.1 — Compliance agreement
If the Commissioner believes on reasonable grounds that an organization has committed, is about to commit or is likely to commit an act or omission that could constitute a contravention of a…
Section 17.2 — Agreement complied with
If the Commissioner is of the opinion that a compliance agreement has been complied with, the Commissioner shall provide written notice to that effect to the organization and withdraw any…
Section 18 — To ensure compliance
The Commissioner may, on reasonable notice and at any reasonable time, audit the personal information management practices of an organization if the Commissioner has reasonable grounds to believe…
Section 19 — Report of findings and recommendations
After an audit, the Commissioner shall provide the audited organization with a report that contains the findings of the audit and any recommendations that the Commissioner considers appropriate. The…
Section 20 — Confidentiality
Subject to subsections (2) to (7), 12(3), 12.2(3), 13(3), 19(1), 23(3) and 23.1(1) and section 25, the Commissioner or any person acting on behalf or under the direction of the Commissioner shall not…
Section 21 — Not competent witness
The Commissioner or person acting on behalf or under the direction of the Commissioner is not a competent witness in respect of any matter that comes to their knowledge as a result of the performance…
Section 22 — Protection of Commissioner
No criminal or civil proceedings lie against the Commissioner, or against any person acting on behalf or under the direction of the Commissioner, for anything done, reported or said in good faith as…
Section 23 — Consultations with provinces
If the Commissioner considers it appropriate to do so, or on the request of an interested person, the Commissioner may, in order to ensure that personal information is protected in as consistent a…
Section 23.1 — Disclosure of information to foreign state
Subject to subsection (3), the Commissioner may, in accordance with any procedure established under paragraph (4)(b), disclose information referred to in subsection (2) that has come to the…
Section 24 — Promoting the purposes of the Part
The Commissioner shall develop and conduct information programs to foster public understanding, and recognition of the purposes, of this Part; undertake and publish research that is related to the…
Section 25 — Annual report
The Commissioner shall, within three months after the end of each financial year, submit to Parliament a report concerning the application of this Part, the extent to which the provinces have enacted…
Section 26 — Regulations
The Governor in Council may make regulations for carrying out the purposes and provisions of this Part, including regulations specifying, by name or by class, what is a government institution or part…
Section 27 — Whistleblowing
Any person who has reasonable grounds to believe that a person has contravened or intends to contravene a provision of Division 1 or 1.1 may notify the Commissioner of the particulars of the matter…
Section 27.1 — Prohibition
No employer shall dismiss, suspend, demote, discipline, harass or otherwise disadvantage an employee, or deny an employee a benefit of employment, by reason that the employee, acting in good faith…
Section 28 — Offence and punishment
Every organization that knowingly contravenes subsection 8(8), section 10.1 or subsection 10.3(1) or 27.1(1) or that obstructs the Commissioner or the Commissioner’s delegate in the investigation of…
Section * 29 — Review of Part by parliamentary committee
The administration of this Part shall, every five years after this Part comes into force, be reviewed by the committee of the House of Commons, or of both Houses of Parliament, that may be designated…
Section 30 — Application
This Part does not apply to any organization in respect of personal information that it collects, uses or discloses within a province whose legislature has the power to regulate the collection, use…
Section 31 — Definitions
The definitions in this subsection apply in this Part. data means representations of information or concepts, in any form. ( données ) electronic document means data that is recorded or stored on any…
Section 32 — Purpose
The purpose of this Part is to provide for the use of electronic alternatives in the manner provided for in this Part where federal laws contemplate the use of paper to record or communicate…
Section 33 — Collection, storage, etc.
A minister of the Crown and any department, branch, office, board, agency, commission, corporation or body for the administration of affairs of which a minister of the Crown is accountable to the…
Section 34 — Electronic payment
A payment that is required to be made to the Government of Canada may be made in electronic form in any manner specified by the Receiver General.