Network - Winter 2010 - (Page 38)
pipa Personal Information Protection Act Personal Information Protection Act A summary for organizations Gaining consent to collect personal information Your organization needs consent to collect personal information from an individual or another source, and to use and disclose it. The exception is when PIPA says it’s not needed. The three forms of consent are express (written or verbal), implied or opt-out. When deciding on the type of consent, consider what is reasonable for the individual, the circumstances and the sensitivity of the information, and whether you will need to prove that you gained consent. PIPA regards personal information collected before Jan. 1, 2004 to have been collected with consent but only for the original, limited purpose for collecting it. An individual can change or withdraw consent in some situations, but not if it interferes with a legal obligation. Rules for collecting personal information Collect personal information only for reasonable purposes, and only the amount and type reasonably needed to carry out the purposes for collecting it. You need to give notice about why you are collecting before, or at the time, you collect the information. Collect directly from the individual, unless he or she agrees to someone else giving the information to you. In some instances, PIPA allows collection without consent. Alberta’s Personal Information Protection Act (PIPA) describes how your organization should handle its customers’ and employees’ personal information. The Act came into effect in Alberta on January 1, 2004. This document summarizes key obligations from the Act. The organizations regulated by the Act include corporations, unincorporated associations, trade unions, partnerships and individuals running their own businesses. Special rules apply to non-profit organizations and selfgoverning professional associations. PIPA doesn’t apply when you collect, use or disclose personal information for domestic, artistic, literary or journalistic purposes. Rules for using and disclosing personal information Use and disclose information only for reasonable purposes. As well, only use or disclose the amount and type of information needed to carry out those purposes. The Act permits using and disclosing without consent in limited and specific circumstances. Your organization’s PIPA responsibilities You are responsible for all personal information in your custody or under your control — in other words, even information with your contractor. To coordinate the new requirements of PIPA, an organization must choose an individual to be responsible for compliance with the Act. You should release the individual’s name if requested. The Act uses the “reasonable person test” for deciding whether an organization has carried out its PIPA responsibilities. The test refers to what a reasonable person would think appropriate in the circumstances. Personal employee information In the Act, the term employee includes apprentices, volunteers, participants, work-experience or co-op students and individuals working under contract. You may collect, use and disclose personal employee information without consent if the individual is an employee, or if you are recruiting an employee. The collecting, using and disclosing of personal information must be reasonable for the purpose and limited to the work or volunteer relationship. Notice must be given to employees about the purpose for collecting their personal information. NETWORK Winter 2009
Table of Contents for the Digital Edition of Network - Winter 2010
Network - Winter 2010
HRIA President’s Message
HRIA’s 2010 Board of Directors
Celebrating Excellence Awards
Recognizing Excellence in HR
Misconduct in the Blogosphere
Social Networking: What is Private and What is Professional?
Monitoring Online Behaviour of Employees
Privacy Legislation Impacts Talent-Management Programs, Too!
Breaching Privacy More Than a Legal Concern
Drug and Alcohol Testing: A Divided Nation?
Personal Information Protection Act
Index of Advertisers
Network - Winter 2010