Manitoba has recently enacted private sector privacy legislation
titled ThePersonal Information Protection and
Identity Theft Prevention Act (PIPITPA), and is now the fourth
province to pass a private sector law of this scope, following
Alberta, Québec, and British Columbia.
While PIPITPA is similar to its federal and provincial
counterparts, in particular, Alberta's Personal Information
Protection Act (PIPA), the Act contains several key
A breach notification provision that
requires organizations to assess the reasonable possibility that
personal information would be used "unlawfully";
A private right of action against
organizations who fail to protect personal information under their
custody and/or control;
No clear complaint and enforcement
mechanism, aside from the private right of action.
PIPITPA has not received royal proclamation and as such is not
currently in force. The Federal Personal Information Protection
and Electronic Documents Act (PIPEDA) will continue to apply
to the private sector in Manitoba until: i) PIPITPA receives royal
proclamation; and ii) the Act is declared "substantially
similar" to PIPEDA by the Governor in Council (should this
ever occur). If not declared "substantially similar,"
both PIPITPA and PIPEDA may apply to Manitoba private actors.
Although PIPITPA is not currently in force, organizations
carrying on business in Manitoba should commence a review of their
internal and external privacy policies and practices in
anticipation of the Act's enforcement.
Notable aspects of the new legislation are as follows:
Application and Consent : PIPITPA
applies to the collection, use, and disclosure of personal
information by private sector organizations, including
corporations, unincorporated associations, unions, partnerships and
individuals acting in a commercial capacity. The Act does not apply
to public bodies or personal information under the control of a
Breach Notification : Under PIPITPA,
organizations must, as soon as reasonably practicable and in a
prescribed manner, notify an individual if personal information in
its custody or control is stolen, lost or accessed in an
unauthorized manner. Organizations are not required to inform
individuals of breaches in circumstances including:
if a law enforcement agency instructs
an organization to withhold notification;
if the organization is satisfied that
it is not reasonably possible for the personal information to be
Right of Action: PIPITPA creates a
right of action against organizations for damages related to the
failure to protect personal information in their custody, care or
control. In addition, a right of action exists if an organization
did not act reasonably in concluding that personal information
stolen, lost or accessed in an unauthorized manner would not be
Personal Employee Information:
Similar to the provincial privacy legislation in British Columbia
and Alberta, PIPITPA contains an exception for the collection of
personal employee information without consent. However, the
definition of personal employee information pursuant to PIPITPA
does not include former employees. In addition, employee consent
may be required under PIPITPA for activities unrelated to
establishing, managing, or terminating an employment or volunteer
Penalties: Individuals guilty of an
offence under PIPITPA will be subject to summary conviction and
fines up to $10,000 for an individual and $ 100,000 for a person
other than an individual. Organizations and individuals will not be
found guilty of an offence under the Act, if it is established, to
the satisfaction of the court, that the organization or individual
"acted reasonably in the circumstances that give rise to an
The content of this article is intended to provide a general
guide to the subject matter. Specialist advice should be sought
about your specific circumstances.
To print this article, all you need is to be registered on Mondaq.com.
Click to Login as an existing user or Register so you can print this article.
The prospect of an internal investigation raises many thorny issues. This presentation will canvass some of the potential triggering events, and discuss how to structure an investigation, retain forensic assistance and manage the inevitable ethical issues that will arise.
From the boardroom to the shop floor, effective organizations recognize the value of having a diverse workplace. This presentation will explore effective strategies to promote diversity, defeat bias and encourage a broader community outlook.
Staying local but going global presents its challenges. Gowling WLG lawyers offer an international roundtable on doing business in the U.K., France, Germany, China and Russia. This three-hour session will videoconference in lawyers from around the world to discuss business and intellectual property hurdles.
Register for Access and our Free Biweekly Alert for
This service is completely free. Access 250,000 archived articles from 100+ countries and get a personalised email twice a week covering developments (and yes, our lawyers like to think you’ve read our Disclaimer).