Meaningful consent (privacy)

A buyer may meet this term when it plans to use a customer list for something the seller never told customers about, such as a new product line or sharing with a new third party. PIPEDA also sets conditions for using and disclosing information in a business transaction without knowledge or consent; see the business transaction exception. Consent for anything outside it is a separate question. See privacy duties when a tech company is sold.

What the OPC expects

The Office of the Privacy Commissioner’s guidelines say that, to obtain meaningful consent, organizations must obtain consent when making significant changes to privacy practices, including use of data for new purposes or disclosures to new third parties, other than for processing integral to delivering a service. They also say information about collection, use and disclosure must be readily available in complete form, with certain elements given greater emphasis. This entry covers PIPEDA; the OPC says organizations subject to a substantially similar provincial law are generally exempt from PIPEDA for activity within that province.

What to ask

• What purposes the seller’s privacy notice and consent wording covered
• Whether the buyer’s planned use is a new purpose or a new disclosure
• Whether a privacy law other than PIPEDA applies to the customers in question