PIPEDA is based on balancing an individual's right to the privacy of personal information with the need of organizations to collect, use or disclose personal information for legitimate business purposes. The Act also established the Privacy Commissioner of Canada as the ombudsman for privacy complaints.

Remember: PIPEDA, unlike the Privacy Act, applies to the Canadian private sector! PIPEDA applies to organizations who collect, use or disclose personal information in the course of commercial activities.

This Act is divided into five parts. Part One outlines the ground rules for managing personal information in the private sector. Parts Two through Five concern the use of electronic documents and signatures as legal alternatives to original documents and signatures.

PIPEDA is a consent-based Act, meaning that you must have consent to collect, use or disclose information. The Privacy Act is authority-based, meaning that you must ensure that you have the legal authority to collect, use or disclose information.

The Act is being released in a series of stages, each corresponding with what the Act will cover in terms of personal information. Stage One began in January, 2001. Stage Two began January 1, 2002 and the final stage occurs on January 1, 2004.

Stage One—January 1, 2001:

• Personal information (except personal health information) collected, used or disclosed in the course of commercial activities by federal works, undertakings and businesses (includes, but is not limited to, federally-regulated organizations such as banks, telecommunications and transportation companies).
• The collection, use or disclosure of personal information by these same organizations about their employees.
• Disclosures of information for consideration across provincial or national borders, by organizations such as credit reporting agencies or organizations that lease, sell or exchange mailing lists or other personal information.
• Covers all business and organizations engaged in commercial activity in the Yukon, Northwest Territories and Nunavut.

Stage Two—January 1, 2002:

• Personal health information. This includes information on: an individual's mental or physical health; a person's health services; and, tests and examinations.

Stage Three—January 1, 2004:

• Will extend to the collection, use or disclosure of personal information in the course of any commercial activity within a province. Organizations operating in provinces that have adopted substantially similar (definition listed below) privacy legislation may be exempt from this.
• Quebec is the only province to date that has substantially similar privacy legislation.
• Will also apply to all personal information in all interprovincial and international transactions subject to the Act in the course of their commercial activities.

For more information on what is being covered in each of these stages with respect to personal information click here.

Industry Canada has issued a statement on how the Governor in Council will decide whether a provincial law is substantially similar to provincial law - Canada Gazette Part I, Sept. 22, 2001, p. 3618

Privacy Act

Personal Information Protection and Electronic Documents Act (PIPEDA) - Part 2

Part 2 of PIPEDA deals with Electronic Documents. It provides a framework by which federal statutes and regulations may be adjusted to accommodate electronic alternatives to paper-based means of communication. For some types of documents, such as those that must be signed under oath, witnessed or sealed, only a Secure Electronic Signature is appropriate.

TBS policy on PIAs