In most provinces and territories of Canada, the collection, use, and disclosure of personal information by insurance agents and insurers in the course of commercial activity is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5). Alberta, British Columbia, and Quebec have provincial private-sector privacy statutes deemed substantially similar to PIPEDA; in those provinces, provincial law applies to intra-provincial activity and PIPEDA applies to interprovincial or international transfers.
Quebec note: Quebec's Act respecting the protection of personal information in the private sector (Law 25, substantially amended in force 2022-2023) is stricter than PIPEDA in several respects, including explicit opt-in consent requirements and additional breach notification obligations.
PIPEDA is built around 10 fair information principles that govern the full life cycle of personal data:
| Principle | Core requirement |
|---|---|
| 1. Accountability | Designate a person responsible for compliance |
| 2. Identifying purposes | State the purpose before or at collection |
| 3. Consent | Obtain meaningful consent before collection, use, or disclosure |
| 4. Limiting collection | Collect only what is necessary for the stated purpose |
| 5. Limiting use, disclosure, retention | Use data only for the purpose collected; retain only as long as needed |
| 6. Accuracy | Keep data as accurate, complete, and current as required |
| 7. Safeguards | Protect data with security measures appropriate to the sensitivity |
| 8. Openness | Make privacy policies and practices available to clients |
| 9. Individual access | Allow clients to access and correct their personal information |
| 10. Challenging compliance | Provide a mechanism for clients to challenge compliance |
For the exam, the principles most heavily tested are consent, limiting collection, safeguards, and individual access.
Recall: Name five of the 10 PIPEDA fair information principles. Which two principles most directly govern how an agent collects and uses client data?