Use (Personal Information)

Personal Information Protection and Electronic Documents Act (S.C. 2000, c. 5)

Protection of Personal Information in the Private Sector

2 (1) The definitions in this subsection apply in this Part.

business transaction includes

(a) the purchase, sale or other acquisition or disposition of an organization or a part of an organization, or any of its assets;

(b) the merger or amalgamation of two or more organizations;

(c) the making of a loan or provision of other financing to an organization or a part of an organization;

(d) the creating of a charge on, or the taking of a security interest in or a security on, any assets or securities of an organization;

(e) the lease or licensing of any of an organization’s assets; and

(f) any other prescribed arrangement between two or more organizations to conduct a business activity. (transaction commerciale)

personal information means information about an identifiable individual.

record includes any correspondence, memorandum, book, plan, map, drawing, diagram, pictorial or graphic work, photograph, film, microform, sound recording, videotape, machine-readable record and any other documentary material, regardless of physical form or characteristics, and any copy of any of those things. (document)

4 (1) This Part applies to every organization in respect of personal information that

(a) the organization collects, uses or discloses in the course of commercial activities; or

(b) is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business.

(3) Every provision of this Part applies despite any provision, enacted after this subsection comes into force, of any other Act of Parliament, unless the other Act expressly declares that that provision operates despite the provision of this Part.

5 (1) Subject to sections 6 to 9, every organization shall comply with the obligations set out in Schedule 1.

(2) The word should, when used in Schedule 1, indicates a recommendation and does not impose an obligation.

(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

7 (1) For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual only if

(d) the information is publicly available and is specified by the regulations; or

(3) An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.

SCHEDULE 1 (Section 5)

• Principles Set Out in the National Standard of Canada Entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96

Principle 9 — Individual Access

• 4.9

Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

• 4.9.5

When an individual successfully demonstrates the inaccuracy or incompleteness of personal information, the organization shall amend the information as required. Depending upon the nature of the information challenged, amendment involves the correction, deletion, or addition of information. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question.