PIPEDA’s principle of ‘Limiting Use, Disclosure, and Retention’ states that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. A key exception is if the new purpose is one that a reasonable person would consider appropriate in the circumstances. This hinges on the individual’s reasonable expectations, not a business interest test or mandatory re-consent for all secondary uses. De-identification is a separate mitigation tool, not the primary legal test.

While public health authorities do have powers to collect information, organizations must verify the legitimacy and scope of the request. The first step is to confirm the official’s authority and understand the precise legal basis for the demand. This allows the organization to comply properly and only to the extent required by law. Blanket refusal or immediate compliance without verification are both imprudent. Providing de-identified data may not satisfy a lawful order for specific information.

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) includes mandatory breach reporting requirements. Organizations subject to PIPEDA must report to the OPC and notify affected individuals of any breach of security safeguards involving personal information under its control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual. The obligation is triggered by risk assessment, not all breaches. While provincial laws may also apply, PIPEDA sets a federal baseline for interprovincial and international transactions.

For consent to be valid under PIPEDA, it must be meaningful. This requires that individuals understand what they are consenting to. Using broad, non-specific language like ‘marketing and analytics partners’ and ‘service improvement and offers’ fails to clearly identify the purposes for which consent is being sought. While length can be a factor, the core issue is the vagueness of the descriptions. Consent can be voluntary even if required for a service, and explicit opt-in is not always required for all non-sensitive secondary uses, but the purposes must always be clear.

PIPEDA does not prohibit cross-border data transfers, but it makes organizations accountable for the protection of personal information transferred to third parties, including service providers. Organizations must use contractual or other means to provide a comparable level of protection while the information is being processed. A client’s request for data residency (keeping data within a geographic boundary) is often driven by the sensitivity of the data (e.g., health information) or specific sectoral regulations. The provider must practically evaluate if it can comply and whether the request is a reasonable risk-mitigation step by the client.

The principle of Limiting Retention states that personal information shall be retained only as long as necessary for the fulfillment of the identified purposes. Once that purpose (running the contest) is complete, the information should be destroyed, erased, or anonymized. However, this is subject to any legal requirements to retain records for a period (e.g., for audit purposes) or legitimate business needs that were part of the original identified purposes. Immediate destruction may not account for these exceptions, and indefinite retention for new purposes is not permitted without new consent.

PIPEDA’s Accountability principle requires an organization to be responsible for the personal information under its control and to designate an individual or individuals who are accountable for the organization’s compliance. This does not mandate a specific job title like ‘Privacy Officer,’ especially for small businesses. The key is that the responsibility is clearly assigned within the organization, whether to the owner, a manager, or a designated employee. The focus is on the function of accountability, not a formal position.

Under PIPEDA, individuals have a right to access their personal information. Internal notes about an individual’s behavior, even if subjective, are generally considered the personal information of that individual. However, the right of access is not absolute. An organization may deny access if the information contains personal information about another individual that cannot be severed, or in certain other limited circumstances (e.g., solicitor-client privilege). The notes are not the analyst’s personal information if they are about the requester, and they are not automatically excluded as business information.

A BYOD program creates a convergence of work and personal data on one device. An MDM solution that can wipe the entire device is a powerful control for the organization but poses a significant risk to the employee’s personal data (photos, messages, etc.). A key privacy consideration is transparency and proportionality. The policy must clearly define the scope of the MDM’s access (e.g., can it see personal texts? personal photos?), the specific conditions that would trigger a full wipe (e.g., lost device, termination), and any procedures for employee data backup. Simply providing a phone or relying on weak controls may not be practical, but employee consent must be informed.

PIPEDA’s principle of ‘Limiting Use, Disclosure, and Retention’ states that personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. A key exception is if the new purpose is one that a reasonable person would consider appropriate in the circumstances. This hinges on the individual’s reasonable expectations, not a business interest test or mandatory re-consent for all secondary uses. De-identification is a separate mitigation tool, not the primary legal test.0