On May 1, 2010, Alberta's Personal Information Protection Amendment Act, 2009 came into force, amending the Personal Information Protection Act (PIPA). While a number of changes have been made to PIPA, of particular significance for organizations are amendments regarding mandatory breach notifications, transferring of personal information to foreign service providers (including affiliates), changes to the definition of "employee personal information" and requirements around data retention.
How It Affects Your Business
As a result of the changes to PIPA, organizations with a national presence in Canada should undertake a detailed review of their privacy policies and practices to ensure compliance with the amended legislation. Organizations must consider:
- implementing a notification protocol for data breaches that may cause significant harm;
- amending privacy policies and practices to meet the new disclosure and notice requirements under PIPA relating to the use of foreign-based service providers, including related entities, engaged to collect, use and store personal information;
- ensuring proper record retention and destruction policies and procedures are in place; and
- reviewing and revising policies on the collection, use and disclosure of personal information of former employees.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
