Openness principle (privacy policy)

Under section 4(1), PIPEDA applies to personal information an organization collects, uses or discloses in the course of commercial activities, and to some employee information of a federal work, undertaking or business, subject to the limits in section 4(2). The openness principle is the part of PIPEDA that asks such an organization to describe how it manages that information. In a sale, ask whether the buyer plans to handle the data differently or under a new name, and whether the privacy policy will need review. See privacy obligations when customer data changes hands.

What the principle asks for

Clause 4.8.1 says individuals shall be able to acquire information about an organization’s policies and practices without unreasonable effort, and in a form that is generally understandable. Clause 4.8.2 says the information made available shall include the name or title and the address of the person accountable for those policies and practices, and the means of gaining access to personal information the organization holds. The Office of the Privacy Commissioner adds that the information can be made available in person, in writing, by telephone, in publications and on a website.

What to check or ask

• Whether the current privacy policy matches what the business actually does with personal information
• Who is named as accountable, and whether that person stays after closing
• What the policy should say once the buyer’s practices apply