Are you bound by privacy legislation?

• A. Yes, both Federal and Provincial.
• B. Yes, only Federal.
• C. No privacy laws.
• D. Yes, only Provincial.

Answer: (B)

In Canada, the protection of personal information in the private sector is provided primarily by federal privacy law, PIPEDA. It sets the baseline rules for how personal data can be collected, used, disclosed, and protected, with individuals having rights of access and correction. Provinces may enact their own private-sector privacy laws, but these provincial laws only apply if the federal government has designated the province’s legislation as substantially similar to PIPEDA. In that case, the provincial law would govern private-sector privacy in that province instead of PIPEDA. Because the question points to federal law as the binding standard in general, the safest answer is that you are bound by federal privacy legislation. Provincial-only applicability occurs only in provinces that have been designated as substantially similar, which isn’t the default scenario. The other options are less accurate because privacy protections do exist at the provincial level in some cases, and there is indeed federal law governing private-sector privacy; saying there are no privacy laws is incorrect, and saying provincial law applies exclusively would be correct only in those specially designated provinces.