Business transaction exception (privacy)

A buyer who is weighing a purchase needs to see customer and employee information, yet privacy law normally requires consent for disclosure. The business transaction exception is the statutory answer. It comes into play when a seller opens the data room, so the conditions matter before anything is uploaded.

The federal conditions

Section 7.2 of PIPEDA applies in addition to subsections 7(2) and (3). Organizations that are parties to a prospective business transaction may use and disclose personal information without the knowledge or consent of the individual if two things are met. First, the organizations have entered into an agreement requiring the recipient to use the information solely for purposes related to the transaction, to protect it with appropriate safeguards and, if the deal does not proceed, to return or destroy it within a reasonable time. Second, the information is necessary to decide whether to proceed and to complete the deal. Subsection 7.2(4) carves out a deal whose primary purpose or result is the purchase or sale of personal information. Subsection 7.2(2) sets further conditions after completion, including that one of the parties notifies the individual within a reasonable time.

Provincial rules differ

Quebec’s private-sector Act, in section 18.4, has its own text for a commercial transaction, including an agreement first and destruction if the deal is not concluded. Alberta’s Personal Information Protection Act, in section 22, and British Columbia’s Personal Information Protection Act, in section 20, each have their own business-transaction provisions. Check which applies. See also employee information in diligence and PIPEDA.