Does British Columbia’s privacy law let me disclose customer and staff records to a buyer?

Before a buyer commits to a British Columbia business, they may want to see who the customers and employees are. Those individuals may not have consented to that. The province’s private-sector privacy law, the Personal Information Protection Act (PIPA), answers the question in section 20, headed “Transfer of personal information in the sale of an organization or its business assets”. This page covers British Columbia’s Act only. If your business is elsewhere, check the rules where you are.

Which law governs

The Office of the Privacy Commissioner of Canada says British Columbia, Alberta and Quebec have their own private-sector privacy laws, deemed substantially similar to PIPEDA, and that organizations subject to one are generally exempt from PIPEDA for information collected, used or disclosed within that province. It adds that PIPEDA still applies to transactions involving information transferred across borders and to federal works, undertakings or businesses, that more than one law can apply, and that this is determined case by case. British Columbia’s PIPA is overseen by its own Information and Privacy Commissioner.

The two conditions for disclosing to a prospective party

Under section 20(1), a business transaction is the purchase, sale, lease, merger or amalgamation or any other type of acquisition, disposal or financing of an organization, part of it, or any of its business or assets. A party is a person or organization that proceeds with it. Subject to section 20(7) and (8) (below), section 20(2) lets an organization disclose personal information about its employees, customers, directors, officers or shareholders, without their consent, to a prospective party if (a) the information is necessary for the prospective party to determine whether to proceed, and (b) the two have entered into an agreement requiring the prospective party to use or disclose it solely for purposes related to the prospective transaction.

Collection, return and the assets test

Under section 20(4), the prospective party may collect and use the information without consent in those circumstances if it complies with the conditions that apply to it. If the transaction does not proceed or is not completed, section 20(6) requires it to destroy or return to the organization any information it collected under section 20(2). Section 20 also does not authorize disclosure for a transaction that does not involve substantial assets of the organization other than the personal information (s.20(7)), and a party or prospective party is not authorized by this section to collect, use or disclose information disclosed in breach of that limit (s.20(8)).

Staff records

Section 20(2) lists employees among the people whose information it covers. The Act separately defines employee personal information as information about an individual collected, used or disclosed solely for purposes reasonably required to establish, manage or terminate an employment relationship between the organization and that individual, not including information that is not about their employment. Ask your lawyer how that definition applies to the personnel files you plan to share. For the federal rule, see can I share customer data with a buyer.