Privacy Issues (PIPEDA)

A brief overview of PIPEDA (Personal Information Protection and Electronic Documents Act)

The new legislation regarding privacy, PIPEDA (Personal Information Protection and Electronic Documents Act), was passed on January 1, 2004. The legislation deals with the protection of personal information submitted, mostly online, to organizations both public and private. Here are the main points of the act and how it relates to the things that we do at EDge Interactive.

The act is federal legislation
PIPEDA is a piece of federal legislation. This means that this is the bare minimum that organizations across Canada must adhere to in terms of privacy and personal information protection. However, if a piece of provincial legislation is passed that is more comprehensive, then organizations in that province would be subject to that legislation.

What is personal information?
Data such as a person's date of birth, address, e-mail address and phone number is considered to be personal information.

Informing users what their personal information is being used for
A big part of the act is making sure that users are informed as to why they are submitting their personal information and what it will be used for. We do this in our privacy policy (here is SchoolFinder.com's Privacy Policy as an example). If users have not given either implied or express consent, for their data to be used a certain way, then an organization cannot use that data for that purpose.

Security of personal information
Users are entitled to a certain level of security regarding the storage of their personal information. The act doesn't get too much into specifics as to what kind of hardware/software is required (probably because it would change far too quickly for an act to keep up), it just asks that organizations take precautions.

Access to personal information
Once a user (or a customer) has submitted personal information, they must be allowed to see and update this information whenever they request such access. On our Web sites, users can do this through MyStuff.

Users can also request to have their personal records deleted from a database at any time.

PIPEDA and e-mail campaigns
The act affects e-mail campaigns in a very peripheral way. If a user has indicated that they wish to receive e-mail messages from an organization and then changes her mind, then that user's record must be updated in a timely manner to reflect that change in preference.

The appointment of a privacy officer and establishment of a complaint process
If you collect and keep electronic personal information, you must designate an individual at your company to be the privacy officer. If you are a company of one, then it's your job to be the privacy officer.

A complaint process must be put in place to help arbitrate any complaints or disputes that arise from your privacy policy or your handling of personal information.

For further information
The points above give a very basic outline of some of the more prominent points of the act. These resources are good for giving you a better understanding of the entire act and privacy issues in general.

http://www.privcom.gc.ca
http://www.privcom.gc.ca/information/guide_e.asp
http://www.cica.ca/index.cfm/ci_id/258/la_id/1.htm
http://www.pkfhill.com/localweb.nsf/art/F8ED17C8CFDDD3AF85256E1C006A70C4/$FILE/PKF_Hill_Communique_PIPEDA.pdf

To contact the EDge privacy officer, please e-mail webmaster@schoolfinder.com.