PIPEDA

A business sale moves personal information: customer lists, employee files, supplier contacts. PIPEDA is the baseline federal law that governs how that information may be collected, used and disclosed in commercial activity. A buyer and a seller each hold a role in handling it, and the rules shape what goes in the data room and what happens after closing.

Scope and the provincial layer

The Office of the Privacy Commissioner says PIPEDA applies to private-sector organizations across Canada that collect, use or disclose personal information in the course of a commercial activity. It also says Alberta, British Columbia and Quebec have their own private-sector privacy laws that have been deemed substantially similar, and that organizations subject to such a law are generally exempt from PIPEDA for information collected, used or disclosed within that province. Under section 26 of the Act, the Governor in Council may, if satisfied that substantially similar provincial legislation applies, exempt the organization, activity or class from PIPEDA for collection, use or disclosure within that province. The Office adds that businesses handling personal information that crosses provincial or national borders in the course of commercial activities are subject to PIPEDA, including in provinces with substantially similar legislation.

What to check or ask

• Which privacy law governs where each party operates
• What personal information the business holds, and why it was collected
• How the deal documents limit use of the information

The tech company sale answer applies this to customer data, and the business transaction exception covers sharing during a deal.