Individuals who have their right to privacy violated are not given any meaningful protection under the common law. In order to control the gathering, use, and disclosure of personal information by organizations (corporations, associations, partnerships, individuals, or trade unions), the federal and provincial governments of Canada have passed privacy legislation. However, information gathered about companies is not covered by privacy laws.
Under Federal Law
The Personal Information Protection and Electronic Documents Act is the federal law that regulates privacy (PIPEDA). Private sector businesses must adhere to PIPEDA guidelines when collecting, using, and disclosing personal information. It mandates the following actions be taken by all businesses gathering personal data: protecting personal information involves several steps, including identifying the reason for collecting it, getting consent from the person before doing so, gathering only the information that is necessary, limiting its use to that reason, and making sure the information is accurate.
Upon request, make sure people can easily access their information and the organization’s privacy policy.
It should be noted that the PIPEDA does not cover the gathering of personal data for domestic, journalistic, creative, or literary purposes. A procedure for filing complaints regarding violations of the law is included in PIPEDA. The PIPEDA privacy commissioner has the power to resolve grievances and levy penalties. Additionally, the commissioner has the authority to audit companies to determine PIPEDA compliance. In addition, the PIPEDA gives an individual the right to sue a company for damages if it violates its PIPEDA duties. However, the PIPEDA also outlines circumstances in which the sharing of personal information may occasionally be allowed. The availability of the material to the general public, national security concerns, personal safety risks, and disclosure requirements under the law are some examples of these circumstances.
Under Provincial Law
The collection, use, and dissemination of personal information are regulated by privacy laws that apply to all provincial and territorial governments in Canada. While provincial laws differ, they all generally address the gathering, access to, and rectification of personal information and name a commissioner or ombudsperson who is qualified to handle complaints. Legislation governing privacy often falls into one of two categories: first, those that make the invasion of privacy a tort (giving a private party the ability to sue for such an offense). These laws frequently have the title Privacy Act and are quite succinct. Second, those that classify privacy violations as almost crimes and, in some situations, permit the imposition of harsh punishments. These laws, which are frequently referred to as the Personal Information Protection Act, are identical to PIPEDA (PIPA).
A PIPA and the Privacy Act have both been passed by several provinces, including British Columbia. In a recent decision in British Columbia, the Office of the Information and Privacy Commissioner held that requesting information from customers when it is not necessary for the business’ operations is a violation of the PIPA statute. This decision highlights the legislation’s potentially broad implications. Likewise, the gathering and storage of that data is.
Courts frequently decide cases on the basis of whether the complainant has a legitimate expectation of privacy when evaluating provincial legislation. For instance, the Court determined that an employee had no reasonable expectation of privacy in a lunchroom shared by other employees in a case involving the use of a hidden camera by an employer.
Anti-Spam Legislation
Recently, federal legislation was passed with the intention of discouraging and preventing the use of spam emails. This law forbids sending commercial electronic messages unless the recipient has given their express or implied consent to receive them. Additionally, it must adhere to any content-related legislation restrictions. It must, for instance, include enough details to allow the receiver to easily get in touch with the sender. But there are some exceptions. The law does not apply to relationships between friends or family members. Electronic messages may also be delivered in connection with other exceptions, such as notifications of product recalls, ongoing employment arrangements, and other issues. The law forbids anyone from making messages appear on another person’s computer. Up to $1 million for individuals and up to $10 million for corporations are the harsh penalties for violating the law. Sending unsolicited electronic messages to persons with whom the sender has no established relationship requires great caution. If there is any doubt regarding a probable violation of the legislation, legal counsel should be sought.
Image Source