Substantially similar provincial privacy law

The idea matters in a deal when customer or employee records change hands and the parties must work out which privacy law governs the exchange. The answer can be the federal Act, a provincial one, or both for different parts of the same business.

How the exemption works

Section 26(2)(b) of PIPEDA lets the Governor in Council, by order, exempt an organization, activity or class from Part 1 for collection, use or disclosure of personal information that occurs within a province, if satisfied that provincial legislation substantially similar to that Part applies. The Office of the Privacy Commissioner says Alberta’s Personal Information Protection Act, British Columbia’s Personal Information Protection Act and Quebec’s Act respecting the protection of personal information in the private sector have been deemed substantially similar, and that organizations subject to them are generally exempt from PIPEDA for information handled within that province.

What to check

• Whether the personal information stays inside one of those provinces. The Office of the Privacy Commissioner says PIPEDA still applies to transactions involving personal information transferred across borders.
• Whether the business is a federal work, undertaking or business, such as a bank or telecommunications company, to which the Office says PIPEDA still applies.
• Whether one part of the business falls under the provincial law and another under PIPEDA. The Office says more than one law can apply, and then you must comply with both.

This entry covers Alberta, British Columbia and Quebec only; check the rules where you are. For the federal rules on sharing records in a sale, see what privacy obligations apply to customer data when a tech company is sold and the PIPEDA entry.