Personal information (PIPEDA definition)

A seller may meet this term when preparing the data room: customer lists, employee files and complaint records can all be personal information. Which privacy law applies is a separate question; see privacy law for employee information shared in due diligence.

What it covers

The Office of the Privacy Commissioner gives examples that include age, name, ID numbers, income, ethnic origin, opinions, evaluations, disciplinary actions, employee files and credit records. Section 4.01 of PIPEDA says this Part of the Act does not apply to business contact information an organization collects, uses or discloses solely to communicate with the individual about their employment, business or profession. The OPC also says PIPEDA applies to the personal information of employees of federally regulated businesses. Section 7.2 sets conditions for using and disclosing it in a prospective business transaction without knowledge or consent, and section 7.2(4) excludes deals whose primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information.

What to ask

• Which documents in the data room name or identify a customer, employee or supplier contact
• Whether the information is needed to decide on the deal, or can be redacted
• Whether a confidentiality agreement covers its use and its return or destruction