PIPEDA’s Scope Expanded

With the federal Economic Action Plan 2015 Act, No. 1 (the Act)¹ having received Royal Assent, the reach of the Personal Information Protection and Electronic Documents Act (PIPEDA) has been expanded to specified activities of enumerated non-commercial organizations set out in a new schedule to PIPEDA. The Act was originally tabled in May 2015 as Bill C-59, consisting of omnibus legislation to implement certain provisions of the federal budget, among other things. The provisions related to PIPEDA are in force as of June 23, 2015.

What You Need To Know

• PIPEDA can apply to non-commercial activities. In addition to applying in respect of personal information that organizations collect, use or disclose in the course of commercial activities (or personal information about an employee that an organization that collects, uses or discloses in connection with the operation of a federal work, undertaking or business), PIPEDA now also applies to specific organizations and types of personal information set out in the new Schedule 4. Organizations that collect, use or disclose personal information in the conduct of interprovincial or international activities, even if those activities are non-commercial, may be brought under PIPEDA in the future.
• Specific organizations and specific types of information are now listed. Currently, only one organization is listed on the new schedule—the World Anti-Doping Agency (WADA), a non-profit organization with offices in Montréal and Lausanne, Switzerland. Only personal information that WADA collects, uses or discloses in the course of its interprovincial or international activities is subject to PIPEDA. Significantly, WADA had specifically requested that its activities be brought within the jurisdiction of PIPEDA. In the future, Schedule 4 may be amended by order of the Governor in Council.
• This targeted amendment may have broad constitutional consequences. The federal government proposed the amendment after a European Union advisory body concluded that WADA likely fell under the jurisdiction of Québec privacy laws rather than PIPEDA. Since Québec privacy laws had not been deemed compliant with the EU Data Protection Directive (Directive 95/46/EC), the advisory body held that personal information should not be transferred from WADA’s offices in Lausanne to Montreal. The advisory body’s conclusion was partly the result of confirmation from the Office of the Privacy Commissioner of Canada that WADA did not fall within PIPEDA because its activities were not of a commercial nature. In response, WADA approached the federal government to request that the organization and its use of information be added to the list of activities covered by PIPEDA. As a result, the federal government passed Bill C-59, amending PIPEDA to specifically include WADA.
  • Notably, Québec’s privacy legislation—which has been deemed domestically to be substantially similar to PIPEDA—was not subject to any public criticism on the merits of its requirements or protections. Rather, the EU’s concern appeared to rest on the more technical fact that the legislation has not been declared to be compliant with the EU Data Protection Directive.
  • Despite the targeted nature of this amendment and the current Schedule 4, the decision to include any non-commercial activities under PIPEDA raises constitutional considerations about the division of powers between federal and provincial governments. While Québec has not explicitly objected to the extension of PIPEDA over WADA, there was considerable debate between the province and the federal government when PIPEDA was first proposed in the late 1990s. PIPEDA was originally enacted pursuant to the federal power over trade and commerce, and commentators have raised the constitutional question of whether the reach of PIPEDA can lawfully extend to organizations not engaged in commercial activities.
• The amendment provides increased (albeit still limited) certainty in the application of PIPEDA. Apart from the constitutional issue, these changes may provide more certainty for non-profit, non-commercial and comparable organizations that collect, use or disclose personal information. Organizations that do not conduct commercial activities and are not listed in Schedule 4 can have more confidence that they will not be retroactively deemed by the Privacy Commissioner or the courts to be subject to PIPEDA—if the government intended for their activities to be governed by PIPEDA it could have expressly added the organizations and activities to Schedule 4. That WADA specifically sought to be governed by PIPEDA may also provide comparable organizations with a route to obtaining additional certainty.

_________________________

¹ S.C. 2015, c. 36.