Canadian Privacy Law and Policy
What this domain tests
Canadian Privacy Law and Policy asks you to place a fact pattern in the right legal regime: the federal Privacy Act for the public sector, PIPEDA for private-sector commercial activity, provincial private-sector statutes where substantially similar, health-specific laws, and common-law torts. Expect questions on the ten PIPEDA principles, Quebec's Law 25, and the constitutional division of powers.
Core rules
- PIPEDA is built on Schedule 1's ten principles: Accountability; Identifying Purposes; Consent; Limiting Collection; Limiting Use, Disclosure and Retention; Accuracy; Safeguards; Openness; Individual Access; Challenging Compliance.
- PIPEDA covers personal information collected, used, or disclosed in commercial activity, plus federal works and undertakings (banks, telecom, airlines, rail, shipping) and interprovincial or cross-border activity.
- Quebec, British Columbia, and Alberta have private-sector laws deemed substantially similar, so PIPEDA is displaced for those organizations; Ontario's PHIPA is substantially similar for health information.
- The federal Privacy Act governs departments and most federal agencies, with the Privacy Commissioner overseeing complaints.
- Quebec's Law 25 added a privacy officer, breach notification, a confidentiality incident register, PIAs, and phased rights (portability, de-indexing, automated-decision transparency), with penalties up to $25 million or 4% of worldwide turnover.
- Common law matters: Jones v Tsige recognized the tort of intrusion upon seclusion.
Worked example
An Ontario hospital stores patient records with a US cloud vendor. The hospital is provincially regulated and the data is health information, so Ontario PHIPA applies, not PIPEDA. The vendor is a service provider or agent; the hospital remains accountable for the records. A patient access request goes to the hospital, and a breach may require notice to the Information and Privacy Commissioner of Ontario and affected patients if the threshold is met. Reasoning: identify the sector (health), the regulator (IPC), and the statute (PHIPA) before applying PIPEDA.
Traps
Assuming PIPEDA is a universal Canadian privacy code; confusing the Privacy Act with PIPEDA; treating the ten principles as statutory sections; forgetting that provincial health laws can displace PIPEDA; missing Law 25's phased dates or penalty caps.