Do I have to tell customers their personal information went to the buyer when I sell my business?

A customer list is personal information, and a sale hands it to the buyer. The Personal Information Protection and Electronic Documents Act (PIPEDA) deals with this in section 7.2. If the business transaction is completed, subsection 7.2(2) says the parties may use and disclose information that was disclosed under subsection 7.2(1) without the individual’s knowledge or consent, if conditions (a), (b) and (c) are met. This route is in addition to what subsections 7(2) and (3) allow.

The notice is condition (c)

Condition (c) says one of the parties notifies the individual, within a reasonable time after the transaction is completed, that the transaction has been completed and that their personal information has been disclosed under subsection 7.2(1). The Act says “one of the parties”. It does not say which party, and it does not set the wording. Settle in the purchase agreement who sends it and what it says. The other two conditions are the matter of the next section.

Conditions (a) and (b)

Condition (a) is an agreement that requires each party to use and disclose the information only for the purposes for which it was collected, permitted to be used or disclosed before completion, to protect it by security safeguards appropriate to its sensitivity, and to give effect to any withdrawal of consent made under clause 4.3.8 of Schedule 1. Condition (b) is that the information is necessary for carrying on the business or activity that was the object of the transaction. Read the statute’s full wording of both with your lawyer rather than relying on this summary. Two further points follow. Subsection 7.2(4) says subsections 7.2(1) and (2) do not apply to a transaction whose primary purpose or result is the purchase, sale or other acquisition, disposition or lease of personal information. The Privacy Commissioner’s page on Principle 5 says that, unless someone consents otherwise or doing so is required by law, an organization may use or disclose personal information only for the identified purposes for which it was collected. Despite clause 4.5 of Schedule 1, section 7.4 lets an organization use or disclose personal information for purposes other than those for which it was collected in the circumstances in subsection 7.2(1) or (2).

Where PIPEDA does not apply

The Office of the Privacy Commissioner says that Alberta, British Columbia and Quebec have their own private-sector privacy laws that have been deemed substantially similar to PIPEDA, and that organizations subject to them are generally exempt from PIPEDA for collection, use or disclosure that occurs within that province. It adds that another part of an organization’s activities, such as disclosure across provincial borders, may still be subject to PIPEDA. This page covers PIPEDA only. If your business is in one of those provinces, check that province’s law. For timing of the announcement itself, see when to tell staff, customers, suppliers and your landlord.