• About
  • Offices
  • Careers
  • Students
  • Alumni
Background Image
Logo Bennett Jones
  • People
  • Expertise
  • Resources
  • Search
  • Menu
  • Search Mobile
A B C D E F G H I J K L M N O P Q R S T U V W X Y Z All

FEATURED AREAS

Energy
Funds & Finance
Mining
Capital Projects
All Industries
Crisis & Risk Management
Environmental, Social & Governance
Governmental Affairs & Public Policy
All Practices
Insights
Media
Events
Subscribe
COVID-19 Resource Centre
Business Law Talks Podcast
Kickstart
New Energy Economy Series
People
Featured Areas
All Practices
All Industries
About
Offices
Careers
Insights
Events
Search
Search
 
Blog

New Privacy Guidance for Businesses Operating in British Columbia

March 11, 2020

Written by Ruth Promislow, Katherine Rusk and Jing Xu

The OIPC has issued recent guidance for private sector organizations operating in British Columbia, which include provincially or federally incorporated companies that conduct business in the province and are subject to the Personal Information Protection Act (BC) (PIPA).

The OIPC recommends that private sector organizations prepare a privacy impact assessment (PIA) in order to be proactive when it comes to "ensuring that the initiatives they have planned comply with PIPA". In short, a PIA can help an organization identify and manage the risk associated with the collection, storage, use and disclosure of personal information. In connection with this recommendation, the OIPC has published: (1) a template for the PIA that contains sample language and instructions for how to conduct a PIA; and (2) a guidance document that "adds depth to the sample language and instruction offered in the template".

PIAs are not a legal requirement for private sector organizations under PIPA. However, the OIPC views the completion of PIAs as a best practice for all organizations that collect, use, disclose and dispose of personal information, and an exercise that can "demonstrate due diligence and accountability in meeting a commitment to protect privacy".

The guidance document includes the following categories of issues for an organization to consider and address in the PIA:

  • What personal information they collect and whether the information is necessary to provide the product or service;
  • The type of consent obtained and the scope of consent with respect to the use and disclosure of the information;
  • Whether the actual use and disclosure of the personal information exceeds the limits of the consent;
  • Where and how is the information stored; who can access the information and whether they need to access the information;
  • Whether the organization destroys information once it is no longer needed; and
  • What safeguards (physical, operational and technological) are in place to protect the information and whether they are sufficient.

The guidance document further provides a framework for a risk mitigation analysis, which involves documenting risks to the organization, the probability of them occurring, the potential impact on the organization and affected individuals and what the organization intends to do to reduce the risk.

For more information on preparing PIAs and related issues, please contact the Bennett Jones Privacy and Data Protection team.

Authors

  • Ruth E. Promislow Ruth E. Promislow, Partner
  • Jing  Xu Jing Xu, Associate

Read the New Energy Economy Series

Related Links

  • Insights
  • Media
  • Subscribe

Recent Posts

Blog

Evidence of Harm Required To Advance Class Action Following Data Breach

February 24, 2021
       

Blog

Site Rehabilitation Program Periods 5 and 6 Further Expand Program Scope

February 22, 2021
       

Blog

Supreme Court of Canada Declines to Hear the Cameco [...]

February 18, 2021
       

Blog

Competition Act and Investment Canada Act Review Thresholds [...]

February 16, 2021
       

Blog

Land Leases for Renewable Energy Projects in Alberta

February 16, 2021
       

The firm that businesses trust with their most complex legal matters.

  • Privacy Policy
  • Disclaimer
  • Terms of Use

© Bennett Jones LLP 2021. All rights reserved. Bennett Jones refers collectively to the Canadian legal practice of Bennett Jones LLP and the international legal practices and consulting activities of various entities which are associated with Bennett Jones LLP

Logo Bennett Jones