Know the Rules

The Personal Information Protection and Electronic Documents Act (PIPEDA) sets the ground rules for how private-sector organizations collect, use, and disclose personal information in the course of for-profit, commercial activities across Canada. PIPEDA also applies to the personal information of employees of federally-regluated businesses.

The 10 Principles

PIPEDA's 10 fair information principles for the ground rules for collection, use and disclosure of personal information, as well as providing access to personal information. In addition to these principles, PIPEDA states that any collection, use or disclosure of personal information must only be for purposes that a reasonable person would considere appropriate in the circumstances. The following would be considered inappropriate:

1. Accountability
2. Identifying purpose
3. Consent
4. Limiting collection
5. Limiting use, disclosure, and retention
6. Accuracy
7. Safeguards
8. Openness
9. Individual access
10. Challenging compliance

Details can be found on the PIPEDA website.

Design with Privacy in Mind: 5 Best Practices to Avoid Deceptive Design

Deceptive design patterns make it difficult for people to protect their privacy online. Integrating a privacy policy and privicay by default approach helps to promote the best interests of individuals and builds trust in organizations Keep these things in mind:

1. Avoid long and complex privacy policies
2. Do not use confusing or leading design, which can interfere with the users' ability to make privacy choices.
3. Do not nag users to encourage them to provide their personal information.
4. Make it easy to find your website or app's privacy settings or information about how to delete an account.
5. Do not force users to disclose personal information that is not necessary.

Details can be found on the PIPEDA website.

Preventing Privacy Breaches

A Cyber Safe Guide for Small Businesses is available by the Canadian Centre for Cyber Security. In addition, here are a few tips to reduce the risk and be equipped to deal with one if it occurs:

1. Create an incident response plan.
2. Be smart about collecting personal Information
3. Provide Training
4. Communicate with third parties
5. Keep your systems secure
6. Get in touch! Contact the Office of the Privacy Commissioner Advisory Team if you have experienced a breach or would like help preventing breaches. Our team of highly trained data security experts can also assist. 

Details can be found on the PIPEDA website.