Privacy — psychology, psychotherapy, counselling therapy and social work (Federal)
PIPEDA applies to every organization in respect of personal information it collects, uses or discloses IN THE COURSE OF COMMERCIAL ACTIVITY (s. 4(1)(a)) — ‘commercial activity’ meaning any transaction, act or conduct, or regular course of conduct, of a commercial character (s. 2). A fee-charging private practice is such an organization. It does not apply to government institutions covered by the Privacy Act, to purely personal or domestic collection, or to journalistic, artistic or literary purposes (s. 4(2)). WHERE A PROVINCIAL LAW HAS BEEN DECLARED SUBSTANTIALLY SIMILAR, the Governor in Council may exempt organizations or activities from PIPEDA — BUT ONLY ‘in respect of the collection, use or disclosure of personal information that occurs within that province’ (s. 26(2)(b)). Four provincial HEALTH information laws are recognised for personal health information (Ontario PHIPA, Nova Scotia PHIA, New Brunswick PHIPAA, Newfoundland and Labrador PHIA), and Alberta, British Columbia and Quebec have general private-sector laws recognised. Nova Scotia’s order is concrete: any PHIA custodian is exempt from PIPEDA Part 1 for personal health information ’that occurs in Nova Scotia’ (SOR/2016-62). PIPEDA CONTINUES TO APPLY, even to organizations in those provinces, to personal information transferred ACROSS BORDERS (interprovincial or international), to federal works, undertakings and businesses, and to organizations in the NORTHWEST TERRITORIES, YUKON AND NUNAVUT, which are treated as federally regulated. BREACH OBLIGATIONS. Report to the Privacy Commissioner any breach of security safeguards involving personal information under the organization’s control where it is reasonable in the circumstances to believe the breach creates a REAL RISK OF SIGNIFICANT HARM to an individual, as soon as feasible after determining the breach occurred (s. 10.1(1)-(2)); notify the affected individual on the same threshold unless otherwise prohibited by law (s. 10.1(3)); and notify any other organization or government institution that may be able to reduce or mitigate the risk of harm (s. 10.2(1)). Separately and regardless of threshold, KEEP AND MAINTAIN A RECORD OF EVERY BREACH of security safeguards (s. 10.3(1)), for 24 months after the day the organization determines the breach occurred, containing information sufficient to let the Commissioner verify compliance with the reporting and notification duties (SOR/2018-64, s. 6). The Commissioner may demand access to or a copy of that record at any time (s. 10.3(2)).
“4 (1) This Part applies to every organization in respect of personal information that (a) the organization collects, uses or discloses in the course of commercial activities” … “26 (2) The Governor in Council may, by order, … (b) if satisfied that legislation of a province that is substantially similar to this Part applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Part in respect of the collection, use or disclosure of personal information that occurs within that province” … “10.3 (1) An organization shall, in accordance with any prescribed requirements, keep and maintain a record of every breach of security safeguards involving personal information under its control.” — Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5. And: “6 (1) For the purposes of subsection 10.3(1) of the Act, an organization must maintain a record of every breach of security safeguards for 24 months after the day on which the organization determines that the breach has occurred.” — Breach of Security Safeguards Regulations, SOR/2018-64, s. 6(1). And: “1 Any personal health information custodian to which the Personal Health Information Act, SNS 2010, c. 41, of Nova Scotia applies is exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act in respect of the collection, use and disclosure of personal health information that occurs in Nova Scotia.” — Personal Health Information Custodians in Nova Scotia Exemption Order, SOR/2016-62