The content of this article is intended to be informational only. We caution you against using or relying upon any information contained in this article without first seeking legal advice regarding your particular matter. All matters arising from the use of our website, including this article, shall be governed by Alberta law and shall be within the exclusive jurisdiction of the courts of Alberta.

The information age has not been misnamed. In the dawn of the 21^st century, our ability to collect and use information has become a commodity in itself. This phenomena has long raised concerns about personal privacy and a number of initiatives from both business and government will have a significant impact in the way e-commerce and other enterprises conduct business. New federal legislation entitled the Personal Information Protection And Electronic Documents Act (PIPEDA) and provincially, the Freedom of Information and Protection of Privacy Act (FOIP) and the Health Information Act are the significant laws in force in Alberta relating to privacy. The Fair Trading Act governs personal information for credit bureaus.

Laws with respect to information have two primary applications:

The way in which organizations collect, use, disclose and protect personal information; and

The right of individuals to have access to their own information and to ensure that the information collected about them is accurate.

PIPEDA became law in April 2000 but comes into force over the next few years. With respect to the federally regulated private sector and interprovincial transactions, the law comes into force on January 1, 2001. With respect to health information it comes into force on January 1, 2002 and with respect to all other commercial activities, whether federal or provincial, it comes into effect on January 1, 2004. It is expected that the provinces will also be enacting similar legislation in the near future.

FOIP deals with records held by public bodies and with the protection of privacy concerning the use, collection and disclosure of personal information by public bodies. FOIP only applies to public institutions including government departments, agencies, municipalities, educational, and healthcare bodies.

If you are an entity created by provincial legislation and there is no applicable exclusion then the legislation applies to any records which are in your custody or control. If you are involved with the management of any public body or office you must consider whether any particular piece of information is a record. The definition is very broad and includes information in any form including books, documents, drawings, photographs, letters, vouchers and papers and any other information that is written, photographed, recorded, or stored in any other manner. Unless it is specifically excluded by Section 4 of the legislation, your organization will have an obligation with respect to the collection and dissemination of that information.

Part 2 of FOIP deals with the collection, use and disclosure of personal information by public bodies whereas part 1 deals with the access to records held by public bodies. We are talking about personal information that is recorded information about an identifiable individual. In Alberta, that specifically includes:

An individual’s name, home or business address, or home or business telephone number;

The individual’s race, national or ethnic origin, color or religious or political beliefs or associations;

The individual’s age, sex, marital status or family status;

Any identifiable number, symbol or other particular assigned to the individual;

Fingerprints, blood type or heritable characteristics;

Information with respect to an individual’s health care history or disability; and

Information about education, financial, employment or criminal history.

It is this kind of regulation that will be extended through PIPEDA and comparable provincial legislation to create obligations for the private sector.

Eventually, any business or public service that maintains personal information about its clientele (or staff for that matter) will need to have policies and procedures relating to the collection, use and dissemination of information. In addition, where an organization keeps information about a person, that organization will be required to disclose the information to the person upon the person’s request. If the person has concerns about the accuracy of the information, the organization will be required to deal with those concerns.

In anticipation of these changes, all organizations should consider policies in order to comply with the law. If you are a federally regulated business or conduct inter provincial transactions you must do this now. If you operate a solely non-health related business within the province of Alberta, you will not be governed by PIPEDA until 2004. However, stay tuned for comparable provincial legislation.

This Paper Was Prepared By D. Jean Munn, B.A., LL.B