After an Alberta business sale closes, how can the buyer use customer and staff information?

Alberta’s Personal Information Protection Act (PIPA) has a separate rule for what happens once a business transaction is completed. This page covers Alberta’s Act only. If your business is in another province, check the rules where you are. For the stage before closing, see does Alberta’s privacy law let me disclose records to a buyer.

The completed-transaction rule

Subject to section 22(6) (below), section 22(3)(b) says that where the business transaction is completed, the parties may collect, use and disclose personal information about individuals without their consent if two conditions are met. First, they have entered into an agreement under which they undertake to use and disclose the information only for the purposes for which it was initially collected from or in respect of those individuals. Second, the information relates solely to the carrying on of the business or activity, or the carrying out of the objects, for which the transaction took place.

New purposes need the person’s consent

Section 22(5) says nothing in the section is to be read as stopping a party from obtaining an individual’s consent to collection, use or disclosure for purposes beyond those for which it obtained the information under the section. So if the buyer wants to use a customer list for a purpose beyond those, section 22(5) leaves it free to ask the individuals for their consent. Check the purchase agreement for the agreement and undertaking that section 22(3)(b)(i) calls for.

Where the section stops

Section 22 does not apply to a transaction whose primary purpose, objective or result is the purchase, sale, lease, transfer, disposal or disclosure of personal information (s.22(6)). If what is really changing hands is the list itself, ask a lawyer before relying on it. The text of section 22 contains no subsection that requires the parties to notify individuals of the sale, so ask your lawyer whether any other duty applies.

Staff records

Alberta defines personal employee information, for a potential, current or former employee, as personal information reasonably required by the organization to establish, manage or terminate an employment or volunteer-work relationship, or to manage a post-employment or post-volunteer-work relationship, but not information unrelated to that relationship (s.1(1)(j)). Section 22(3) speaks of personal information about individuals and does not separately mention employees. Ask your lawyer how the two fit together for payroll and personnel files. Where PIPEDA applies instead or as well, for example on a cross-border transfer, the OPC says that is determined case by case, and section 7.2 of PIPEDA is the federal rule to review.