PIPEDA came into full effect on January 1st, 2004. It sets out the ground rules for the collection, use, and disclosure of personal information in the course of commercial activities by all private sector organizations.
It also applies to federal works, undertakings, and businesses that exchange information across provincial boundaries (for example, airlines and banks), and to personal information that flows across provincial or national borders in the course of commercial transactions.
PIPEDA does not apply to private sector organizations in provinces that already had “substantially similar” legislation (ie. Alberta, B.C., and Quebec). Although it does still apply to public works in those provinces.
PIPEDA does not apply to health information custodians in provinces that have specific health privacy information statutes deemed “substantially similar.” (eg., doctors and nurses etc.).
For instance, Ontario has a Personal Health Information Protection Act, New Brunswick has a Personal Health Information Privacy and Access Act, and Newfoundland and Labrador have a Personal Health Information Act.
On March 25, 2020 significant amendments came into force in Ontario for Healthcare Providers and Technology Companies that process Health Information. These amendments include penalties for corporations and officers, individual rights of access, and future requirements for technology (not year enforced).
