Does Alberta’s privacy law let me disclose customer and staff records to a buyer?

A buyer weighing an Alberta business may ask to see customer lists and staff records before any deal is signed. Those people may not have agreed to that. Alberta’s private-sector privacy law, the Personal Information Protection Act (PIPA), deals with it in section 22. This page covers Alberta’s Act only. If your business is in another province, check the rules where you are.

Which law governs

The Office of the Privacy Commissioner of Canada says Alberta, British Columbia and Quebec have their own private-sector privacy laws, deemed substantially similar to the federal PIPEDA. Organizations subject to such a law are generally exempt from PIPEDA for information collected, used or disclosed within that province. The Commissioner adds that PIPEDA still applies to transactions involving personal information transferred across borders and to federal works, undertakings or businesses, that more than one law can apply, and that the question is settled case by case. In Alberta, PIPA is overseen by the province’s own Information and Privacy Commissioner.

What counts as a business transaction

Section 22(1) defines a business transaction as the purchase, sale, lease, merger or amalgamation or any other type of acquisition or disposal of an organization, part of it, or any business, activity or business asset, or the taking of a security interest in one. It includes a prospective transaction of that kind, and a party includes a prospective party. Under section 22(2), an organization may, for the purposes of such a transaction between itself and one or more other organizations, collect, use and disclose personal information in accordance with the section.

The two conditions before the deal closes

Subject to section 22(6) (below), section 22(3)(a) allows organizations that are parties to collect, use and disclose personal information about individuals without their consent, from the lead-up through completion, if two things are true. First, they have entered into an agreement restricting the collection, use and disclosure to purposes that relate to the transaction. Second, the information is necessary for them to decide whether to proceed and, if they do, to carry out and complete the transaction. Section 22(3) speaks of personal information about individuals and does not separately mention employees. Ask your lawyer how Alberta’s separate definition of personal employee information in section 1(1)(j) applies to staff records.

Limits and what happens if the deal stops

Section 22 does not apply where the primary purpose, objective or result of the transaction is the purchase, sale, lease, transfer, disposal or disclosure of personal information (s.22(6)). Nothing in it stops a party from obtaining an individual’s consent for purposes beyond those for which it obtained the information under the section (s.22(5)). If the transaction does not proceed or is not completed, the party that received the information must, if it is still in its custody or control, either destroy it or turn it over to the party that disclosed it (s.22(4)). Put those terms in the confidentiality agreement before anything is released. For the federal rule, see can I share customer data with a buyer.