6. When, and to what industries will PIPEDA apply?
PIPEDA will eventually apply to every organization that collects, uses or
discloses personal information in the course of commercial activity. "Commercial
activity" is any activity that is of a commercial character and certainly
includes the real estate industry. An "organization" is a company, association,
a partnership or a person.
To encourage harmonization of provincial and federal
privacy protection laws, the Bill adopted a phase-in approach. Effective January
1st 2001, the legislation applied to federally regulated private sector
companies, including telecommunication, broadcasting, banking and
inter-provincial transportation. It also applies to federal crown corporations
operating in these areas such as Atomic Energy of Canada Limited, the Canadian
Broadcasting Corporation and so on.
The provisions of the legislation also applied, at that
time, to trade in personal information that occurs inter-provincially or
internationally.
The provisions were applied more broadly to all personal
information collected, used or disclosed in the course of commercial activities
as of January 1st 2004. If, however, a province passes a law that is
substantially similar to PIPEDA, the organization’s activities covered by the
provincial law will be exempted from the federal law. As of January 1st 2006,
British Columbia, Alberta, Ontario and Quebec have substantially similar
legislation.
7. If provinces are going to pass their own privacy laws, with the result that
PIPEDA will not apply, why are we making all these efforts to comply with PIPEDA?
While federal/provincial jurisdictional questions are going to result in some
interesting times, there are at least four reasons why it is important to
understand and comply with PIPEDA now.
Firstly, all provinces may not pass their own legislation.
PIPEDA will remain the governing legislation in those jurisdictions.
Secondly, the intent of the federal regulators is to ensure
that provinces adopt basic harmonized rules for the protection of personal
information. Only legislation which is "substantially similar" to PIPEDA will
exempt the province. It is apparent that to be "substantially similar"
legislation will have to be based on the same 10 principles as PIPEDA.
Thirdly, CREA’s Privacy Code, which is the national
standard in organized real estate and is based on PIPEDA, is effective now.
Fourthly, with privacy having been identified as a key
factor in consumer decision making, most businesses are encouraged to act sooner
rather than later in establishing privacy policies.
8. What happens to the personal information my firm/Board already has?
The personal information currently held by a REALTOR® organization would not be
exempt. Therefore organizations must ensure that the information already
collected meets the requirements of the Act and has been collected accordingly.
In other words:
existing information can continue to be used without
anything more, as long as the use is consistent with the purpose for which it
was collected in the first place; and
any secondary use for which consent was not obtained would
offend the Act.
As an example, you collected personal information from a
client a number of years ago when you listed their house. You subsequently put
their name on a mailing list and continue to send them promotional and marketing
materials. If you told them at the time you were doing this, and they agreed,
you can continue to do so. If you did not identify this use when you collected
the information, you cannot continue to maintain the mailing list without now
obtaining the consent of the persons on it.
9. So if I maintain a mailing list of former clients and I didn’t get consent at
the time, do I have to contact each person and get them to positively consent to
being left on the list?
No. Both PIPEDA and the Privacy Code recognize the concept of "negative option
consent". You can send everyone on the list a notice that they are on the list
and here’s what you use it for. The notice must provide that if the person
wishes to be removed from the list, he or she can indicate so on the notice (or
by some other means) and return it to you. If no such notification is received
by you, consent is deemed to have been given.
10. What happens to the personal information my firm holds in case of a sale or
acquisition by another organization?
Unless you have indicated otherwise when collecting the information, the
information can be used by the acquiring company as long as it used for the same
purpose for which it was collected.