Appropriate purposes (privacy)

A buyer deciding how it may use inherited customer data meets this limit. It sits in the main body of the federal Act, next to the business transaction rules in section 7.2, which let parties to a prospective business transaction use and disclose personal information without the individual’s knowledge or consent if the section’s conditions are met, except where the primary purpose or result of the transaction is the purchase, sale or other acquisition or disposition, or lease, of personal information (s. 7.2(4)).

How the limit works

Section 5(3) is a test of what a reasonable person would consider appropriate in the circumstances. The Privacy Commissioner’s consent guidelines treat it as a separate step from consent: even with consent, organizations limit collection, use and disclosure to purposes a reasonable person would consider appropriate. The Commissioner’s office also says that in many circumstances a substantially similar provincial law applies instead of the federal law.

What to ask

• What purposes customers were told about when their data was collected
• Whether the buyer’s planned use is the same purpose or a new one
• Whether the planned use would pass a reasonable person test in the circumstances, which a privacy lawyer can assess

See privacy obligations when a tech company is sold and meaningful consent. This entry covers the federal Act; check which law applies where you are.