|
|
An Act to support and promote electronic
commerce by protecting personal
information that is collected, used or
disclosed in certain circumstances, by
providing for the use of electronic means
to communicate or record information or
transactions and by amending the
Canada Evidence Act, the Statutory
Instruments Act and the Statute Revision
Act
|
|
|
|
[Assented to 13th April, 2000]
|
|
|
|
Her Majesty, by and with the advice and
consent of the Senate and House of Commons
of Canada, enacts as follows:
|
|
|
|
|
|
| Short title
|
1. This Act may be cited as the Personal
Information Protection and Electronic
Documents Act.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| Definitions
|
2. (1) The definitions in this subsection
apply in this Part.
|
|
``alterna-
tive format''
« support de
substitu-
tion »
|
``alternative format'', with respect to personal
information, means a format that allows a
person with a sensory disability to read or
listen to the personal information.
|
|
``commer-
cial activity''
« activité
commerciale »
|
``commercial activity'' means any particular
transaction, act or conduct or any regular
course of conduct that is of a commercial
character, including the selling, bartering or
leasing of donor, membership or other
fundraising lists.
|
|
``Commission
er''
« commissaire
»
|
``Commissioner'' means the Privacy
Commissioner appointed under section 53
of the Privacy Act.
|
|
``Court''
« Cour »
|
``Court'' means the Federal Court-Trial
Division.
|
|
``federal
work,
undertaking
or business''
« entreprises
fédérales »
|
``federal work, undertaking or business''
means any work, undertaking or business
that is within the legislative authority of
Parliament. It includes
|
|
|
|
(a) a work, undertaking or business that
is operated or carried on for or in
connection with navigation and shipping,
whether inland or maritime, including
the operation of ships and transportation
by ship anywhere in Canada;
|
|
|
|
(b) a railway, canal, telegraph or other
work or undertaking that connects a
province with another province, or that
extends beyond the limits of a province;
|
|
|
|
(c) a line of ships that connects a province
with another province, or that extends
beyond the limits of a province;
|
|
|
|
(d) a ferry between a province and
another province or between a province
and a country other than Canada;
|
|
|
|
(e) aerodromes, aircraft or a line of air
transportation;
|
|
|
|
(f) a radio broadcasting station;
|
|
|
|
|
|
|
|
(h) a work that, although wholly situated
within a province, is before or after its
execution declared by Parliament to be
for the general advantage of Canada or
for the advantage of two or more
provinces;
|
|
|
|
(i) a work, undertaking or business
outside the exclusive legislative
authority of the legislatures of the
provinces; and
|
|
|
|
(j) a work, undertaking or business to
which federal laws, within the meaning
of section 2 of the Oceans Act, apply
under section 20 of that Act and any
regulations made under paragraph
26(1)(k) of that Act.
|
|
``organization
''
« organisa-
tion »
|
``organization'' includes an association, a
partnership, a person and a trade union.
|
|
``personal
health
information''
« renseigneme
nt personnel
sur la santé »
|
``personal health information'', with respect
to an individual, whether living or
deceased, means
|
|
|
|
(a) information concerning the physical
or mental health of the individual;
|
|
|
|
(b) information concerning any health
service provided to the individual;
|
|
|
|
(c) information concerning the donation
by the individual of any body part or any
bodily substance of the individual or
information derived from the testing or
examination of a body part or bodily
substance of the individual;
|
|
|
|
(d) information that is collected in the
course of providing health services to the
individual; or
|
|
|
|
(e) information that is collected
incidentally to the provision of health
services to the individual.
|
|
``personal
information''
« renseigneme
nt personnel »
|
``personal information'' means information
about an identifiable individual, but does
not include the name, title or business
address or telephone number of an
employee of an organization.
|
|
``record''
« document »
|
``record'' includes any correspondence,
memorandum, book, plan, map, drawing,
diagram, pictorial or graphic work,
photograph, film, microform, sound
recording, videotape, machine-readable
record and any other documentary material,
regardless of physical form or
characteristics, and any copy of any of those
things.
|
|
| Notes in
Schedule 1
|
(2) In this Part, a reference to clause 4.3 or
4.9 of Schedule 1 does not include a reference
to the note that accompanies that clause.
|
|
|
|
|
|
| Purpose
|
3. The purpose of this Part is to establish, in
an era in which technology increasingly
facilitates the circulation and exchange of
information, rules to govern the collection,
use and disclosure of personal information in
a manner that recognizes the right of privacy
of individuals with respect to their personal
information and the need of organizations to
collect, use or disclose personal information
for purposes that a reasonable person would
consider appropriate in the circumstances.
|
|
|
|
|
|
| Application
|
4. (1) This Part applies to every
organization in respect of personal
information that
|
|
|
|
(a) the organization collects, uses or
discloses in the course of commercial
activities; or
|
|
|
|
(b) is about an employee of the organization
and that the organization collects, uses or
discloses in connection with the operation
of a federal work, undertaking or business.
|
|
| Limit
|
(2) This Part does not apply to
|
|
|
|
(a) any government institution to which the
Privacy Act applies;
|
|
|
|
(b) any individual in respect of personal
information that the individual collects,
uses or discloses for personal or domestic
purposes and does not collect, use or
disclose for any other purpose; or
|
|
|
|
(c) any organization in respect of personal
information that the organization collects,
uses or discloses for journalistic, artistic or
literary purposes and does not collect, use
or disclose for any other purpose.
|
|
| Other Acts
|
(3) Every provision of this Part applies
despite any provision, enacted after this
subsection comes into force, of any other Act
of Parliament, unless the other Act expressly
declares that that provision operates despite
the provision of this Part.
|
|
|
|
|
|
|
|
|
|
| Compliance
with
obligations
|
5. (1) Subject to sections 6 to 9, every
organization shall comply with the obligations
set out in Schedule 1.
|
|
| Meaning of
``should''
|
(2) The word ``should'', when used in
Schedule 1, indicates a recommendation and
does not impose an obligation.
|
|
| Appropriate
purposes
|
(3) An organization may collect, use or
disclose personal information only for
purposes that a reasonable person would
consider are appropriate in the circumstances.
|
|
| Effect of
designation of
individual
|
6. The designation of an individual under
clause 4.1 of Schedule 1 does not relieve the
organization of the obligation to comply with
the obligations set out in that Schedule.
|
|
| Collection
without
knowledge or
consent
|
7. (1) For the purpose of clause 4.3 of
Schedule 1, and despite the note that
accompanies that clause, an organization may
collect personal information without the
knowledge or consent of the individual only if
|
|
|
|
(a) the collection is clearly in the interests
of the individual and consent cannot be
obtained in a timely way;
|
|
|
|
(b) it is reasonable to expect that the
collection with the knowledge or consent of
the individual would compromise the
availability or the accuracy of the
information and the collection is reasonable
for purposes related to investigating a
breach of an agreement or a contravention
of the laws of Canada or a province;
|
|
|
|
(c) the collection is solely for journalistic,
artistic or literary purposes; or
|
|
|
|
(d) the information is publicly available and
is specified by the regulations.
|
|
| Use without
knowledge or
consent
|
(2) For the purpose of clause 4.3 of
Schedule 1, and despite the note that
accompanies that clause, an organization may,
without the knowledge or consent of the
individual, use personal information only if
|
|
|
|
(a) in the course of its activities, the
organization becomes aware of information
that it has reasonable grounds to believe
could be useful in the investigation of a
contravention of the laws of Canada, a
province or a foreign jurisdiction that has
been, is being or is about to be committed,
and the information is used for the purpose
of investigating that contravention;
|
|
|
|
(b) it is used for the purpose of acting in
respect of an emergency that threatens the
life, health or security of an individual;
|
|
|
|
(c) it is used for statistical, or scholarly
study or research, purposes that cannot be
achieved without using the information, the
information is used in a manner that will
ensure its confidentiality, it is impracticable
to obtain consent and the organization
informs the Commissioner of the use before
the information is used;
|
|
|
|
(c.1) it is publicly available and is specified
by the regulations; or
|
|
|
|
(d) it was collected under paragraph (1)(a)
or (b).
|
|
| Disclosure
without
knowledge or
consent
|
(3) For the purpose of clause 4.3 of
Schedule 1, and despite the note that
accompanies that clause, an organization may
disclose personal information without the
knowledge or consent of the individual only if
the disclosure is
|
|
|
|
(a) made to, in the Province of Quebec, an
advocate or notary or, in any other province,
a barrister or solicitor who is representing
the organization;
|
|
|
|
(b) for the purpose of collecting a debt owed
by the individual to the organization;
|
|
|
|
(c) required to comply with a subpoena or
warrant issued or an order made by a court,
person or body with jurisdiction to compel
the production of information, or to comply
with rules of court relating to the production
of records;
|
|
|
|
(c.1) made to a government institution or
part of a government institution that has
made a request for the information,
identified its lawful authority to obtain the
information and indicated that
|
|
|
|
(i) it suspects that the information relates
to national security, the defence of
Canada or the conduct of international
affairs,
|
|
|
|
(ii) the disclosure is requested for the
purpose of enforcing any law of Canada,
a province or a foreign jurisdiction,
carrying out an investigation relating to
the enforcement of any such law or
gathering intelligence for the purpose of
enforcing any such law, or
|
|
|
|
(iii) the disclosure is requested for the
purpose of administering any law of
Canada or a province;
|
|
|
|
(d) made on the initiative of the
organization to an investigative body, a
government institution or a part of a
government institution and the organization
|
|
|
|
(i) has reasonable grounds to believe that
the information relates to a breach of an
agreement or a contravention of the laws
of Canada, a province or a foreign
jurisdiction that has been, is being or is
about to be committed, or
|
|
|
|
(ii) suspects that the information relates
to national security, the defence of
Canada or the conduct of international
affairs;
|
|
|
|
(e) made to a person who needs the
information because of an emergency that
threatens the life, health or security of an
individual and, if the individual whom the
information is about is alive, the
organization informs that individual in
writing without delay of the disclosure;
|
|
|
|
(f) for statistical, or scholarly study or
research, purposes that cannot be achieved
without disclosing the information, it is
impracticable to obtain consent and the
organization informs the Commissioner of
the disclosure before the information is
disclosed;
|
|
|
|
(g) made to an institution whose functions
include the conservation of records of
historic or archival importance, and the
disclosure is made for the purpose of such
conservation;
|
|
|
|
(h) made after the earlier of
|
|
|
|
(i) one hundred years after the record
containing the information was created,
and
|
|
|
|
(ii) twenty years after the death of the
individual whom the information is
about;
|
|
|
|
(h.1) of information that is publicly
available and is specified by the
regulations;
|
|
|
|
(h.2) made by an investigative body and the
disclosure is reasonable for purposes
related to investigating a breach of an
agreement or a contravention of the laws of
Canada or a province; or
|
|
|
|
|
|
| Use without
consent
|
(4) Despite clause 4.5 of Schedule 1, an
organization may use personal information for
purposes other than those for which it was
collected in any of the circumstances set out in
subsection (2).
|
|
| Disclosure
without
consent
|
(5) Despite clause 4.5 of Schedule 1, an
organization may disclose personal
information for purposes other than those for
which it was collected in any of the
circumstances set out in paragraphs (3)(a) to
(h.2).
|
|
| Written
request
|
8. (1) A request under clause 4.9 of
Schedule 1 must be made in writing.
|
|
| Assistance
|
(2) An organization shall assist any
individual who informs the organization that
they need assistance in preparing a request to
the organization.
|
|
| Time limit
|
(3) An organization shall respond to a
request with due diligence and in any case not
later than thirty days after receipt of the
request.
|
|
| Extension of
time limit
|
(4) An organization may extend the time
limit
|
|
|
|
(a) for a maximum of thirty days if
|
|
|
|
(i) meeting the time limit would
unreasonably interfere with the activities
of the organization, or
|
|
|
|
(ii) the time required to undertake any
consultations necessary to respond to the
request would make the time limit
impracticable to meet; or
|
|