BLOG

Here in Canada, our individual data is protected under several privacy laws, including the Personal Information Protection and Electronic Documents Act — also known as PIPEDA.

Instated in 2020, PIPEDA is a federal privacy law that dictates how private-sector businesses handle personal information for the duration of their commercial activity. Commercial activity is defined as “any particular transaction, act, or conduct, or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.”

If you run a business in Canada, keeping on the right side of PIPEDA is crucial; it can help you maintain a positive public perception and save you financially. Failing to comply with PIPEDA could mean a fine of up to $100,000 CAD for each violation.

Understanding PIPEDA and taking security measures — such as destroying company documents when they’re obsolete — can help businesses keep within the parameters of this law, empowering you to stay on the right side of compliance, and in good standing within your community.

This is your guide to understanding PIPEDA and what it means for your company.

PIPEDA in More Detail

Under PIPEDA, a company must handle individuals’ information with utmost care. Here are the stipulations of the law.

• A company must have an individual’s consent before they collect, utilize, or disclose that individual’s personal information.
• Individuals also have the right to access the information a company holds on them and to challenge its accuracy.
• Companies can use the collected information for the purpose it was collected only. If they want to use the information for another purpose, they must get consent from the individual again.
• Organizations under federal regulation who conduct business in Canada must protect employees’ personal information as well as the personal data of those who have applied for jobs.
• And last, all organizations must protect an individual’s data from corruption.

What Is Personal Information?

Personal information under PIPEDA can include a person’s factual data — like their name, blood type or ethnicity. It also refers to data regarding their social profiles, feedback and comments. And it covers information like medical records or loan history.

Who Oversees PIPEDA?

The Office of the Privacy Commissioner of Canada (OPC) oversees PIPEDA. Their primary duty is to investigate reports of non-compliance. Once a report of non-compliance has been made, the OPC decides whether the business operated outside of PIPEDA’s regulations, and if it did, an investigation is launched. Based on the severity of the non-compliance, OPC will aim to seek an early resolution.

The OPC may also investigate companies who they believe are breaking PIPEDA even when no report has been made. Fortunately for business owners in Canada, there are ways to keep on the right side of the OPC and PIPEDA.

Credit: bboellinger Via: Pixabay

Knowing how to protect your company and your customers is critical. It goes without saying that preventing an issue before it arises is much better than dealing with one once it has already become a problem. Here are a few measures you can take.

The Fair Information Principles

To help reinforce the foundations of PIPEDA, there are ten principles to help guide companies.

• Accountability — Identify a team lead to monitor and implement PIPEDA compliance.
• Identify — Clearly identify the purpose of the data collection to the public.
• Consent — Companies must gain permission from the individual before storing and using their data.
• Limiting — The data can be collected only for its original stated purpose.
• Use — Personal information can only be used for the purpose it was collected and can only be stored for as long as it takes to fulfill the original use.
• Accuracy — Data must be accurate and current.
• Safeguards — Companies must implement a strategy to protect data.
• Openness — Companies must be able to disclose how they manage personal data.
• Individual Access – Individuals must be allowed access to their data and to challenge its accuracy if they wish. They must also be informed as to the use of their data.
• Challenging — Individuals should be able to question how a company manages and uses their data.

Working within these ten principles will help keep your company on the right side of PIPEDA compliance.

Know the Signs of a Security Breach

Knowing about data breach warning signs is a pre-emptive measure to empower you and your team to understand when your virtual assets — like customer data — are under threat. Being equipped to mitigate a security breach quickly and efficiently before it’s full-blown can keep sensitive data safe.

Implement Data Protection Practices

As per PIPEDA, companies must keep customer information secure while working with their data and once it is no longer required.

Using robust data privacy protection software to protect virtually stored data during your ownership is fundamental to keeping it safe. Protection software will thwart hackers' attempts to access data with ill intent.

Securely destroying electronic waste that was used to store or access customer information when it’s defunct is of equal importance — and a vital step towards overall corporate security. At Absolute Destruction, we can help you securely destroy laptops, cell phones, hard drives, and other forms of data that might have been used to store customer data.

Further, federally regulated organizations — like banks, airports and telecommunication companies — must securely destroy old employee records once the pertinent hold times have elapsed.

Connect with PIPEDA

Last, if you have concerns about PIPEDA and how to manage personal information safely, connect with the OPC for guidance.

We Can Help You Keep on the Right Side of PIPEDA

Failing to comply with PIPEDA can incur major financial penalties, a tarnished public perception and massive legal troubles.

We can help you with data management processes that can keep you on the right side of this law. Principle 5 of PIPEDA states, “personal information that is no longer required to fulfil the identified purposes should be destroyed, erased, or made anonymous.” Document and data destruction with us is a secure way to keep individuals’ information safe once it’s no longer required. When you use our secure document destruction service and our data destruction services, you’ll receive a Certificate of Destruction that shows your customers, and the OPC, that you’re doing everything you can to keep their sensitive data safe once it’s surplus to requirement.

We have years of experience helping countless customers securely destroy paper and electronic data. Connect with us, and we'll help you find a process that suits your budget and needs.