Which privacy law applies to employee information shared during due diligence?

Staff files in a data room hold information about identifiable people, and the statute that governs them depends on the employer. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) is the starting point, though not always the end of the answer.

When PIPEDA covers employee information

PIPEDA’s Part 1 applies to personal information an organization collects, uses or discloses in the course of commercial activities. It also covers information about an employee of, or applicant for employment with, the organization that it handles in connection with a federal work, undertaking or business (section 4(1)). That is the only limb that mentions employees, so a seller outside that category should not assume PIPEDA covers its staff files.

When a provincial law can take over

The Governor in Council may, by order, exempt an organization, class of organizations, activity or class of activities from Part 1 if satisfied that substantially similar provincial legislation applies, for information collected, used or disclosed within that province (section 26(2)(b)). So ask whether your province has legislation that reaches staff records. The Privacy Commissioner’s site offers a “Which privacy law applies?” tool.

What a seller may share before closing

Section 7.2 lets parties to a prospective business transaction, which includes the purchase or sale of an organization, part of one or any of its assets, use and disclose personal information without the knowledge or consent of the individual. Their agreement must require the recipient to use and disclose it solely for purposes related to the transaction, protect it with safeguards suited to its sensitivity, and return or destroy it within a reasonable time if the deal does not proceed. The information must also be necessary to decide whether to proceed and, if the deal proceeds, to complete it. Ask whether roles, tenure and pay bands would meet that test before named files are shared. The exception does not apply where the transaction’s primary purpose or result is buying or selling the personal information itself (section 7.2(4)).

After closing, and if something goes wrong

After closing, section 7.2(2) lets the parties keep using and disclosing information disclosed under section 7.2(1) without the individual’s knowledge or consent if their agreement holds each of them to the purposes for which it was collected, permitted to be used or disclosed before closing, requires safeguards and gives effect to withdrawals of consent, the information is necessary to carry on the business or activity that was the object of the transaction, and one party notifies the individuals within a reasonable time that the deal has closed and their information was disclosed. The Commissioner’s guidance also says that under PIPEDA, breaches of security safeguards that pose a real risk of significant harm must be reported to the Commissioner, and a record kept of every breach, so a leaked data room may be a reportable breach. Cybersecurity and privacy checks covers the buyer’s side.