Privacy Policy for Law Cap
Effective Date: May 4, 2026
Last Updated: May 4, 2026
Website: www.lawcap.ca
1. Introduction and Scope
Law Cap ("we," "us," or "our") is a legal professional corporation based in Ontario, Canada, dedicated to providing high-quality legal services while maintaining the highest standards of privacy and confidentiality. This Privacy Policy is designed to inform you of our practices regarding the collection, use, disclosure, and protection of "Personal Information"—which refers to any information about an identifiable individual.
This policy applies to all visitors of www.lawcap.ca, current and former clients, and any individuals whose information we may process in the course of our legal operations. By interacting with our website or retaining our services, you acknowledge that you have read and understood this policy. Our practices are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) at the federal level, and where we handle health-related data, the Personal Health Information Protection Act (PHIPA) in Ontario.
2. Personal Information We Collect
To provide effective legal representation and maintain our website, we collect various categories of information. These include, but are not limited to:
- Identity and Contact Information: Your full name, home and business addresses, personal and professional email addresses, telephone numbers, and copies of government-issued identification (required for "Know Your Client" (KYC) anti-money laundering compliance).
- Case-Related and Professional Data: Detailed information necessary for your legal matters, such as employment history, salary information, financial statements, tax records, corporate records, and information about family members or third parties involved in your legal disputes.
- Technical and Usage Data: When you visit our website, we automatically collect your IP address, browser type and version, time zone setting, browser plug-in types, operating system, and platform. We also track "clickstream" data, which includes the pages you viewed, the duration of your visit, and the links you clicked.
- Sensitive Information: In specific contexts—such as personal injury litigation, insurance claims, or estate planning—we may collect sensitive "Personal Health Information" (PHI). This includes medical histories, physician reports, and diagnostic results. We handle this data with enhanced security measures in compliance with PHIPA.
3. Detailed Methods of Collection
We employ several methods to ensure we have the necessary data to serve you:
- Direct Interaction: The majority of the information we hold is provided directly by you. This occurs when you fill out an intake form, subscribe to our legal newsletter, send us an inquiry through our "Contact Us" portal, or participate in a consultation (whether in-person or via video conference).
- Automated Technologies: As you navigate www.lawcap.ca, we use cookies, server logs, and web beacons. These tools help us understand website traffic patterns and improve our digital interface. While these tools do not usually identify you by name, they provide a profile of your interaction with our brand.
- Third-Party and Public Sources: In the course of legal representation, we may receive information about you from third parties, such as:
- Government registries (e.g., Teranet for property searches or the Cyberbroadband registry).
- Financial institutions and accountants.
- Adverse parties or their legal counsel during the discovery process.
- Publicly available records, including social media profiles or court dockets.
4. Purposes for Collection and Processing
Law Cap collects and uses your information for specific, justified purposes rooted in our legal and professional duties:
- Provision of Legal Services: To provide legal advice, draft documents, represent you in negotiations or litigation, and manage your legal files effectively.
- Conflict-of-Interest Checks: Before accepting a new mandate, we must use your identity data to ensure that representing you does not create a conflict of interest with our existing or former clients, as required by the Law Society of Ontario (LSO).
- Identity Verification: To comply with federal anti-money laundering and terrorist financing regulations, we must verify the identity of our clients.
- Communication and Marketing: To keep you informed about the progress of your file, share relevant legal updates via our newsletter (with your consent), and respond to your inquiries.
- Billing and Administration: To process retainers, issue invoices for fees and disbursements, and manage our internal accounting and auditing requirements.
5. The Principle of Consent
We process your Personal Information based on your consent, unless otherwise permitted or required by law.
- Express Consent: We will seek your express consent (written or oral) before collecting sensitive information or before using your data for a purpose not previously identified. For example, if we need to obtain your medical records from a hospital, we will require a signed authorization form.
- Implied Consent: In many instances, your consent is implied by your actions. For example, by providing your email address in an inquiry form, you imply consent for us to contact you regarding that specific inquiry.
- Withdrawal of Consent: You have the right to withdraw your consent at any time. However, please be aware that withdrawing consent may limit or terminate our ability to provide legal services to you, especially if the information is central to your legal matter or required for our professional compliance.
6. Disclosure of Personal Information
Law Cap is bound by solicitor-client privilege; however, "Privacy" and "Privilege" are distinct. We may disclose your information under the following limited circumstances:
- Service Providers: We may share data with trusted third-party providers who perform services on our behalf, such as IT support, cloud-based practice management software (e.g., Clio), process servers, or expert witnesses. These parties are contractually bound to maintain confidentiality.
- Legal and Regulatory Requirements: We may disclose information if required to do so by a court order, subpoena, or to comply with the rules of the Law Society of Ontario during an audit or investigation.
- Corporate Transactions: In the event of a merger, sale, or reorganization of the firm, client files may be transferred to the successor legal professional, subject to strict confidentiality and notice to the clients.
- Protection of Rights: We may disclose information to protect our rights, such as in the collection of overdue accounts or to defend against a claim of professional negligence.
7. Enhanced Data Security and Safeguards
The protection of your data is a core priority. We employ a "defense-in-depth" strategy:
- Technological Safeguards: Our digital files are stored on secure servers with AES-256 bit encryption. We utilize Multi-Factor Authentication (MFA) for all staff logins and employ enterprise-grade firewalls and anti-malware software that is updated daily.
- Physical Safeguards: Our physical office is protected by alarm systems and restricted key-card access. All physical client files are kept in locked cabinets when not in use. Shredding of documents is handled by certified secure destruction services.
- Administrative Safeguards: All employees, associates, and contractors must sign rigorous non-disclosure agreements. We conduct regular training on phishing awareness and privacy best practices.
8. Retention and Disposal of Information
We do not keep Personal Information longer than necessary. Our retention periods are determined by:
- Professional Standards: The Law Society of Ontario suggests that lawyers retain closed files for a period that accounts for the statute of limitations for professional negligence (often 15 years in Ontario).
- Legal Obligations: Certain tax or corporate records must be kept for 7 years as per CRA requirements.
- Destruction: Once the retention period expires, digital data is permanently deleted using secure wiping tools, and physical paper is cross-cut shredded and pulped.
9. Your Privacy Rights: Access and Control
Under PIPEDA, you have significant rights regarding your data:
- Right of Access: You may request a summary of the Personal Information we hold about you and a description of how it has been used or disclosed.
- Right to Correction: If you demonstrate that our records are inaccurate or incomplete, we will amend the information as required and notify any third parties to whom the data was disclosed.
- Right to Portability: You may request that we transfer your data to another legal professional in a structured, machine-readable format.
- Challenging Compliance: You have the right to address a challenge concerning our compliance with this policy to our Privacy Officer.
10. Cookies, Analytics, and Third-Party Links
Our website uses "cookies" to improve your experience.
- Essential Cookies: Necessary for the website to function.
- Performance Cookies: Help us understand how visitors use www.lawcap.ca so we can improve the interface.
- Third-Party Links: Our website may contain links to external sites (e.g., legal resources or government portals). We are not responsible for the privacy practices of these third parties and encourage you to read their policies.
11. Anti-Spam Compliance (CASL) and PIPEDA
Law Cap is committed to compliance with Canada’s Anti-Spam Legislation. We do not send "spam."
- We only send commercial electronic messages (CEMs) to those who have provided express consent or where there is an "existing business relationship" (e.g., you are a current client).
- Every marketing email includes an "Unsubscribe" link. Once you unsubscribe, we will remove you from our marketing lists within 10 business days.
IMPORTANT ADDITIONAL NOTES FOR YOU:
We use third-party advertising companies, including Google AdSense, to serve ads when you visit our website.
Google uses cookies, including the DART cookie, to serve ads based on a user's prior visits to your website or other websites on the Internet.
Users may opt out of personalized advertising (e.g., by visiting Google's Ads Settings)
VOLUME #12: COMPREHENSIVE LEGAL APPENDIX: STATUTORY FRAMEWORK, JURISPRUDENTIAL STANDARDS, AND SYSTEMATIC COMPLIANCE OBLIGATIONS UNDER PIPEDA
PART I: REGULATORY MANDATE AND STATUTORY CONTEXT
1.1 Statement of Expertise and Regulatory Commitment
Law Cap Inc. positions itself as an authority in the interpretation, application, and enforcement of the Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 ("PIPEDA"). Consequently, the firm holds itself and its client-facing operations to the highest standards of regulatory compliance. Where statutory duties arise, the firm recognizes that compliance is mandatory, as denoted by the statutory auxiliary verb "shall," representing an absolute legal obligation rather than discretionary authority.
1.2 Interpretive Methodology
All capitalized terms and bolded definitions utilized herein are derived directly from Schedule 1 of PIPEDA, or have been formulated internally in strict harmony with:
- The statutory text of PIPEDA;
- Investigation Reports and guidance documents published by the Office of the Privacy Commissioner of Canada ("OPCC");
- Relevant jurisprudence from the Federal Court of Canada ("FC"), the Federal Court of Appeal ("FCA"), and the Supreme Court of Canada ("SCC").
Upon formal request by an individual (the "Requestor," herein referred to as "Mr. YOUR"), the responding organization (the "Respondent," herein referred to as "Pembridge") must execute the following statutory obligations:
- Existence, Use, and Disclosure ("EUD"): Disclose the existence, systemic use, and downstream disclosure of the Requestor’s Personal Information;
- Right of Access: Provide the Requestor with direct access to all such Personal Information;
- Verification of Retention ("Holding PI"): Confirm or deny whether the Respondent holds or exerts control over any Personal Information relating to the Requestor;
- Source Attribution: Identify and disclose the original source of the collected Personal Information, in accordance with regulatory best practices;
- Purpose Limitation: Restrict the use of any supplementary information provided by the Requestor strictly to the administrative processing of the access request; and
- Accounting of Third-Party Disclosures: Provide a highly specific, particularized account of any and all third-party organizations to which the Personal Information has been disclosed.
- Presumption of Potential Disclosure: Where the Respondent cannot definitively produce an exhaustive historical list of actual third-party recipients, it shall provide an exhaustive list of organizations to which it may have disclosed the information.
- Accessibility of Format: Provide all responsive information in a format that is generally understandable and accompanied by explanations of any internal codes, acronyms, or shorthand.
- Transmission of Unresolved Challenges: Where an accuracy or completeness challenge by the Requestor remains unresolved, the Respondent shall record the substance of the dispute and transmit the notice of this unresolved challenge to all third parties holding access to the information in question.
PART II: THE JURISPRUDENTIAL BOUNDARIES OF "PERSONAL INFORMATION"
Under Section 2(1) of PIPEDA, "personal information" is defined broadly as "information about an identifiable individual." Canadian courts and the OPCC have consistently expanded and defined this definition across multiple contexts.
┌─────────────────────────────────────┐
│ PERSONAL INFORMATION │
│ (Identifiable Individual) │
└──────────────────┬──────────────────┘
│
┌───────────────────────────┼───────────────────────────┐
▼ ▼ ▼
[Broad Interpretation] ["About" Test] [Serious Possibility]
• Dagg v. Canada • Relates to/concerns • Gordon v. Canada
• Royal Canadian Mounted Police • Accident Board • Direct/indirect link
2.1 The Principle of Broad and Expansive Interpretation
Consistent with administrative law principles governing quasi-constitutional privacy rights, the definition of Personal Information must be given a broad, generous, and expansive interpretation.
- Jurisprudential Authority: Dagg v. Canada (Minister of Finance), [1997] 2 S.C.R. 403 (dissenting opinion of La Forest J. at para 68, subsequently adopted as authoritative); Canada (Information Commissioner) v. Canada (Transportation Accident Investigation and Safety Board), 2006 FCA 157; Canada (Information Commissioner) v. Canada (Commissioner of the Royal Canadian Mounted Police), 2003 SCC 8 at para 23.
2.2 The "About" Threshold: Relationship and Concern
To constitute Personal Information, the data must be "about" an identifiable individual. The term "about" signifies that the information is not merely the nominal subject of a record, but substantively relates to, concerns, or can be linked to the individual.
- Jurisprudential Authority: Canada (Information Commissioner) v. Canada (Transportation Accident Investigation and Safety Board), 2006 FCA 157.
2.3 The "Serious Possibility" Test for Identifiability
Information concerns an "identifiable individual" where there is a "serious possibility" that an individual could be identified through the utilization of that information, either in isolation or when combined with other external, reasonably accessible data.
- Jurisprudential Authority: Gordon v. Canada (Health), 2008 FC 258.
2.4 Absence of Tangible Recording
The definition of Personal Information does not require that the data be preserved in a physical, electronic, or recorded medium.
- Biological and Real-Time Surveillance: Real-time oral conversations, biological samples, transient biometric transmissions, and live-feed video surveillance constitute Personal Information notwithstanding the lack of a permanent recording.
- Evidentiary Impact: While the absence of a physical recording may impact the evidentiary assessment of "collection," it does not alter the fundamental legal characterization of the data as Personal Information.
- Jurisprudential Authority: Morgan v. Alta Flights Inc., 2006 FCA 121, affirming 2005 FC 421.
2.5 Irrelevance of Public Availability
Information does not lose its character as Personal Information simply because it resides in the public domain. Public availability may trigger statutory exemptions regarding the necessity of consent for collection or use, but the data remains protected under the broader statutory access framework.
- Jurisprudential Authority: Englander v. TELUS Communications Inc., 2004 FCA 387.
2.6 Subjective and Inaccurate Data
Subjective assessments, evaluations, opinions, or erroneous assertions regarding an individual do not escape the definition of Personal Information merely by virtue of their subjectivity or inaccuracy.
- Jurisprudential Authority: Lawson v. Accusearch Inc., 2007 FC 125.
2.7 The Business and Professional Context
Privacy rights extend into commercial and professional spheres.
- Telecommunications Records: Cell phone records, metadata, and transmission logs generated from corporate-issued mobile devices constitute the Personal Information of the employee utilizing the device.
- Inextricable Corporate Linkage: Where an individual’s personal identity is inextricably linked to their corporate entity (e.g., a sole proprietorship, owner-operator, or closely held corporation), commercial data concerning that corporate entity constitutes the Personal Information of the individual.
- Non-Exhaustive Categories of Business Personal Information:
- Notices of Assessment (NOA) and Social Insurance Numbers (SIN);
- Professional email addresses, IP logs, and facsimile numbers;
- Correspondence, electronic messages, and communication threads;
- Purchase histories, transactional data, and service agreements;
- Membership records and account profiles; and
- Historical complaints, dispute records, and customer service logs.
2.8 De-Identification and Re-Identification Risks
De-identified, pseudonymized, or masked data does not qualify as anonymous information if there remains a legally cognizable "serious possibility" of linking the de-identified data back to an identifiable individual through reverse-engineering or data-matching methodologies.
2.9 Financial Contextual Data
Personal Information in the financial sector includes, but is not limited to:
- Bank account numbers, routing numbers, and Swift codes;
- Financial summaries, account balances, and credit limits;
- Transactional histories and ledger entries;
- Debt-related records, default notices, and payment schedules; and
- Mortgage portfolios, credit reports, and proprietary credit scores.
2.10 Technological and Network Identifiers
- Biometrics and Photography: Fingerprints, voiceprints, facial geometry, physical photographs of an individual's private residence, and video surveillance footprints constitute highly sensitive Personal Information.
- Internet Protocol (IP) Addresses: An IP address constitutes Personal Information when it can be associated, directly or indirectly, with an identifiable individual. Where an Internet Service Provider (ISP) or commercial platform retains the capacity to cross-reference IP logs with subscriber identifiers or account credentials, those IP addresses are legally classified as Personal Information.
- Regulatory Reference: OPCC Technology Analysis Branch Report: "What an IP Address Can Reveal About You".
PART III: STATUTORY ACCESS AND ACCOUNTING RIGHTS
┌─────────────────────────────────┐
│ INDIVIDUAL ACCESS RIGHTS │
│ (Principle 4.9) │
└────────────────┬────────────────┘
│
┌─────────────────────────────┼─────────────────────────────┐
▼ ▼ ▼
[EUD Accounting] [30-Day Response] [Right of Correction]
• Confirm possession • Section 8(3) • Principle 4.9.5
• Disclose actual use • Mandatory & strict • Amend inaccurate data
• Identify third parties • Cost-free/minimal • Notify third parties
3.1 Core Principles of the Individual Access Right
- Principle 4.9 (Access Mandate): Upon formal request, an individual shall be informed of the existence, use, and disclosure of their Personal Information and be granted direct access to it. Possession or control of the record is merely a functional factor; it is not determinative of the right of access.
- Principle 4.9.1 (Confirmation of Holding): An organization shall explicitly confirm or deny whether it holds Personal Information concerning the requesting individual.
- Source Attribution: Organizations are encouraged and expected to identify the original source of the collected Personal Information.
- Principle 4.9.2 (Minimization of Informational Requirements): The Requestor may only be required to provide sufficient information to enable the Respondent to locate and account for the responsive Personal Information. Any information provided by the Requestor to facilitate this search shall be used exclusively for this administrative purpose.
- Principle 4.9.3 (Specifics of Third-Party Disclosures): In providing an accounting of third-party disclosures, the Respondent must achieve the highest possible degree of specificity. Where an actual list of recipient organizations cannot be compiled, the Respondent shall provide a comprehensive list of organizations to which it may have disclosed the information.
3.2 Procedural Safeguards and Statutory Timeframes
- Section 8(1) (Writing Requirement): A formal access request pursuant to Principle 4.9 of Schedule 1 must be executed in writing.
- Section 8(2) (Duty to Assist): An organization shall provide proactive assistance to any individual who indicates a need for help in drafting or structuring their access request.
- Section 8(3) (30-Day Mandatory Limit): An organization shall respond to a formal access request with utmost due diligence, and in any event, no later than thirty (30) calendar days following receipt of the request.
- Section 8(7) (Form of Refusal): If an organization refuses to grant access within the statutory period, it shall notify the individual in writing of the refusal, setting out the detailed statutory reasons and the avenues of recourse available to the individual under Part 1 of PIPEDA.
- Section 8(8) (Mandatory Preservation of Records): Notwithstanding general data retention schedules or standard deletion cycles (Principle 4.5), where Personal Information is the subject of an active or disputed access request, the organization shall preserve and retain all responsive records until the individual has fully exhausted all administrative and judicial avenues of recourse under PIPEDA.
3.3 Limitations and Exceptions to the Right of Access
The right of access under PIPEDA is paramount; exceptions are narrow and construed strictly.
┌─────────────────────────────────────┐
│ EXEMPTIONS TO ACCESS (s. 9) │
└──────────────────┬──────────────────┘
│
┌─────────────────────────────┼─────────────────────────────┐
▼ ▼ ▼
[Third-Party Privacy] [Legal Privilege] [Confidential Comm.]
• Section 9(1) • Section 9(3)(a) • Section 9(3)(b)
• Must sever if possible • Solicitor-client • Very high standard
• Avoid joint disclosure • Litigation privilege • Raw data excluded
- Section 9(1) (Third-Party Information): An organization shall not disclose Personal Information if doing so would reveal Personal Information about a third party. However, where third-party information is severable from the record, the organization shall sever the third-party data and release the remainder to the Requestor.
- Section 9(3)(a) (Legal Privilege): An organization is exempt from the obligation to grant access only if the requested information is protected by solicitor-client privilege, the professional secrecy of advocates and notaries, or litigation privilege.
- Section 9(3)(b) (Confidential Commercial Information): Access may be refused if disclosure would reveal confidential commercial information. The standard for establishing this exemption is exceptionally high; raw data regarding an individual does not qualify as confidential commercial information.
- Section 9(3)(d) (Formal Dispute Resolution): Access may be withheld if the information was generated in the course of a formal dispute resolution process. To qualify, the process must be governed by a structured, independent framework or statutory mechanism. Internal administrative reviews, customer relations offices, or internal ombudsman processes do not meet this definition.
PART IV: JURISPRUDENTIAL APPLICATION AND OPERATIONAL COMPLIANCE
4.1 Systemic Policies, Training, and Institutional Deficiencies
Organizations must establish straightforward, standardized internal protocols to process access requests in a compliant, timely manner.
- Substandard Organizational Practices: Deficient administrative workflows, unstructured record-keeping systems, or organizational disorganization do not excuse compliance failures or the loss of responsive data.
- Jurisprudential Authority: PIPEDA Case Summary #2007-377 (law firm's negligent record keeping resulting in loss of personal data and denial of access); PIPEDA Case Summary #2007-367; PIPEDA Case Summary #2014-016 (reprimanding Sobeys for failing to process access requests and refusing to cooperate with the OPCC).
- Adequate Employee Training: Organizations must implement mandatory training programs to ensure staff understand their legal obligations under PIPEDA.
- Jurisprudential Authority: PIPEDA Report of Findings #2011-002 (airlines must align internal policies with Canadian statutory law); PIPEDA Case Summary #2009-014.
4.2 Scope of the Search: The "Reasonable Search" Standard
While PIPEDA does not grant a generalized right to receive entire documents in their raw, native format, it guarantees access to all Personal Information contained within those documents.
- Statutory Entitlement: Requesters are entitled to all personal data and historical contextual records concerning the conduct of the organization's business, including handwritten medical or evaluation notes.
- Jurisprudential Authority: Fahmy v. Bank of Montreal, 2016 FC 479; Johnson v. Bell Canada, 2008 FC 1086; Wyndowe v. Rousseau, 2008 FCA 39.
- Reasonableness and Burden of Proof: An organization must execute a thorough, reasonable search across all administrative files and data repositories. Once a reasonable search is executed, the burden shifts to the Requestor to establish a prima facie case that the search was inadequate or executed in bad faith.
- Jurisprudential Authority: Johnson v. Bell Canada, 2008 FC 1086; PIPEDA Report of Findings #2009-023.
4.3 Disclosure of Search Methodology and Integrity of Communication
- Disclosure of Locations Searched: When responding to an access request, the organization should transparently indicate the databases, paper archives, and digital repositories searched, as well as the classifications of information it holds.
- Meaningful Responses: Organizations must provide a meaningful, forthcoming response to access requests, even if the search yields zero responsive records.
- Jurisprudential Authority: PIPEDA Case Summary #2005-291; PIPEDA Case Summary #2007-370; PIPEDA Report of Findings #2010-005; PIPEDA Report of Findings #2013-005.
- Impropriety of Alternate Channels: An organization cannot refuse to process an access request on the basis that the requested information can be obtained through another channel, such as active court proceedings or litigation discovery.
- Jurisprudential Authority: PIPEDA Report of Findings #2014-017.
4.4 Form, Clarity, and Interpretive Aids
- No Formal Recitation of PIPEDA Required: Requesters are not legally required to cite PIPEDA or reference specific statutory provisions to trigger their access rights.
- Jurisprudential Authority: PIPEDA Case Summary #2003-222.
- Generally Understandable Form: Information must be delivered in an accessible format. If internal abbreviations, codes, or technical jargon are used, the organization shall provide an explanatory key. This obligation rests solely on the responding organization.
- Jurisprudential Authority: PIPEDA Report of Findings #2009-023; PIPEDA Case Summary #2002-049.
4.5 Strict Time Limits and Invalid Extensions
- Partial Responses Insufficient: Providing a partial or rolling response within thirty days does not satisfy the statutory deadline under Section 8(3).
- Jurisprudential Authority: PIPEDA Case Summary #2003-229.
- Invalidity of Consultation Claims: Time extensions claimed under Section 8(4)(a)(ii) for consultations are invalid if no substantive, documented consultations are initiated by the organization.
- Jurisprudential Authority: PIPEDA Case Summary #2004-266.
- Staffing Scarcity and Medical Leave: Institutional staffing constraints, such as the medical leave of key privacy personnel, do not excuse non-compliance with statutory time limits. The organization is strictly liable for maintaining continuous compliance mechanisms.
- Jurisprudential Authority: PIPEDA Report of Findings #2017-008.
4.6 Strict Evaluation of Claims of Legal Privilege
Claims of legal privilege are subject to independent judicial and regulatory scrutiny. The Privacy Commissioner may refer disputed privilege claims directly to the Federal Court for determination.
- Solicitor-Client Privilege: This privilege does not apply to non-legal organizations or operational materials merely because they touch upon legal matters. Routine incident reports or internal investigations do not meet this standard.
- Jurisprudential Authority: Canada (Privacy Commissioner) v. Blood Tribe Department of Health, 2008 SCC 44; Privacy Commissioner of Canada v. Air Canada, 2010 FC 429; PIPEDA Case Summary #2003-147.
- Litigation Privilege: This privilege is restricted to records created for the dominant purpose of preparing for active or reasonably anticipated litigation.
- Anticipation Threshold: The prospect of litigation must be real, concrete, and imminent when the document is created. A mere speculative concern or the existence of a statutory access request does not satisfy this test.
- Invalidity of Blanket Policies: Blanket institutional policies classifying all incident reports as privileged are unlawful and overbroad.
- Jurisprudential Authority: Hamalainen v. Sippola (1991), 62 B.C.L.R. (2d) 254 (C.A.); PIPEDA Report of Findings #2017-008; PIPEDA Case Summary #2011-003; PIPEDA Case Summary #2009-018.
PART V: ANALYSIS OF THE STATUTORY "SHALL" OBLIGATIONS
The word "shall" appears 127 times within the text of PIPEDA. Within the ten foundational principles of Schedule 1, there are 53 distinct, independent mandatory obligations imposed on organizations. Non-compliance with any of these "shall" clauses constitutes a statutory breach, establishing a valid cause of action for a formal complaint to the OPCC.
┌─────────────────────────────────────┐
│ SCHEDULE 1: THE 53 "SHALL"S │
└──────────────────┬──────────────────┘
│
┌─────────────────────────────┼─────────────────────────────┐
▼ ▼ ▼
[Accountability] [Consent & Collection] [Accuracy & Security]
• 4 "shall" obligations • 12 "shall" obligations • 9 "shall" obligations
• Appoint Privacy Officer • Limit purpose and scope • Maintain integrity
• Ensure third-party care • Obtain informed consent • Secure data appropriately
5.1 Principle 1: Accountability (Obligations 1–4)
- Obligation 1 (Principle 4.1): The organization shall designate a specific individual or individuals (such as a Privacy Compliance Officer) who are personally accountable for compliance with all Schedule 1 principles.
- Obligation 2 (Principle 4.1.2): The identity of the designated individuals shall be made known to any individual upon request.
- Obligation 3 (Principle 4.1.3): The organization shall use contractual or other highly effective means to provide a comparable level of protection while personal data is processed by third-party service providers.
- Obligation 4 (Principles 4.1.4(a)–(d)): The organization shall implement comprehensive policies and practices to give effect to the statutory principles, specifically:
- Implementing rigorous procedures to protect Personal Information;
- Establishing clear workflows to receive and respond to inquiries and complaints;
- Training and educating organizational personnel regarding privacy policies; and
- Developing accessible explanatory materials for the public.
5.2 Principle 2: Identifying Purposes (Obligations 5–7)
- Obligation 5 (Principle 4.2): The specific purposes for which Personal Information is collected shall be identified by the organization at or before the time the information is collected.
- Obligation 6 (Principle 4.2.1): The organization shall formally document the identified purposes to satisfy the Openness and Individual Access principles.
- Obligation 7 (Principle 4.2.3): If the collected Personal Information is to be used or disclosed for a new, previously unidentified purpose, that new purpose shall be identified prior to use, and consent shall be obtained unless otherwise exempt by law.
5.3 Principle 3: Consent (Obligations 8–11)
- Obligation 8 (Principle 4.3): The knowledge and consent of the individual are mandatory for the collection, use, or disclosure of Personal Information. The organization shall make reasonable efforts to ensure the individual is advised of the purposes for which the information will be used.
- Obligation 9 (Principle 4.3.2): Consent is valid only if it is reasonable to expect that the individual understands the nature, purpose, and consequences of the collection, use, or disclosure. The purposes shall be stated in a clear, understandable manner.
- Obligation 10 (Principle 4.3.3): The organization shall not, as a condition of supplying a product or service, require an individual to consent to collection, use, or disclosure beyond what is strictly necessary to fulfill legitimate, specified purposes.
- Obligation 11 (Principle 4.3.5): In determining the form of consent, the organization shall evaluate the sensitivity of the information. Consent shall not be obtained through deception or misleading practices.
5.4 Principle 4: Limiting Collection (Obligations 12–16)
- Obligation 12 (Principle 4.4): The collection of Personal Information shall be limited to that which is strictly necessary for the identified purposes.
- Obligation 13 (Principle 4.4): Personal Information shall be collected exclusively by fair and lawful means.
- Obligation 14 (Principle 4.4.1): The organization shall not collect Personal Information indiscriminately.
- Obligation 15 (Principle 4.4.2): Both the amount and the type of information collected shall be strictly limited to what is necessary to fulfill the identified purposes.
- Obligation 16 (Principle 4.4.3): The organization shall specify the types of information collected as part of its documented information-handling policies.
5.5 Principle 5: Limiting Use, Disclosure, and Retention (Obligations 17–21)
- Obligation 17 (Principle 4.5): Personal Information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law.
- Obligation 18 (Principle 4.5): Personal Information shall be retained only as long as necessary to fulfill the identified purposes.
- Obligation 19 (Principle 4.5.1): When utilizing Personal Information for a new purpose, the organization shall document this purpose.
- Obligation 20 (Principle 4.5.2): Personal Information used to make a decision about an individual shall be retained long enough to allow the individual a reasonable opportunity to access the information after the decision has been made.
- Obligation 21 (Principle 4.5.3): The organization shall implement procedures to govern the secure destruction, erasure, or anonymization of Personal Information that is no longer required.
5.6 Principle 6: Accuracy (Obligations 22–25)
- Obligation 22 (Principle 4.6): Personal Information shall be as accurate, complete, and up-to-date as necessary for the purposes for which it is to be used.
- Obligation 23 (Principle 4.6.1): The extent to which Personal Information is kept accurate, complete, and up-to-date shall depend on its use and the interests of the individual.
- Obligation 24 (Principle 4.6.2): Personal Information shall be sufficiently accurate, complete, and up-to-date to minimize the possibility that inappropriate or outdated information is used to make a decision about the individual.
- Obligation 25 (Principle 4.6.3): The organization shall not routinely update Personal Information unless such updates are necessary to fulfill the purposes for which the information was collected.
5.7 Principle 7: Safeguards (Obligations 26–30)
- Obligation 26 (Principle 4.7): Personal Information shall be protected by security safeguards appropriate to the sensitivity of the information.
- Obligation 27 (Principle 4.7.1): Security safeguards shall protect Personal Information against loss, theft, unauthorized access, disclosure, copying, use, or modification.
- Obligation 28 (Principle 4.7.2): The organization shall protect Personal Information regardless of the format in which it is held.
- Obligation 29 (Principle 4.7.4): The organization shall actively train employees and make them aware of the critical importance of maintaining the confidentiality of Personal Information.
- Obligation 30 (Principle 4.7.5): Care shall be exercised in the disposal or destruction of Personal Information to prevent unauthorized access.
5.8 Principle 8: Openness (Obligations 31–35)
- Obligation 31 (Principle 4.8): The organization shall make specific information about its policies and practices relating to the management of Personal Information readily available to individuals.
- Obligation 32 (Principle 4.8): The organization shall be open and transparent about its policies and practices with respect to personal data management.
- Obligation 33 (Principle 4.8.1): Individuals shall be able to acquire info about the organization's policies and practices without unreasonable effort.
- Obligation 34 (Principle 4.8.1): This informational disclosure shall be provided in a format that is generally understandable.
- Obligation 35 (Principles 4.8.2(a)–(e)): Disclosed policies shall include:
- The name, title, and address of the individual accountable for organizational compliance;
- The methods for gaining access to Personal Information;
- A description of the type of Personal Information held, including a general account of its use;
- Accessible copies of any brochures, standards, or codes; and
- Details regarding what Personal Information is shared with related parent or subsidiary organizations.
5.9 Principle 9: Individual Access (Obligations 36–48)
- Obligation 36 (Principle 4.9): Upon request, an individual shall be informed of the existence, use, and disclosure of their Personal Information.
- Obligation 37 (Principle 4.9): The individual shall be granted direct access to that information.
- Obligation 38 (Principle 4.9): The individual shall be entitled to challenge the accuracy and completeness of the information and have it amended as appropriate.
- Obligation 39 (Principle 4.9.1): Upon request, the organization shall formally inform an individual whether it holds Personal Information about them.
- Obligation 40 (Principle 4.9.1): The organization shall allow the individual access to this held information.
- Obligation 41 (Principle 4.9.1): The organization shall provide an account of how the information has been used, how it is currently being used, and an account of the third parties to which it has been disclosed.
- Obligation 42 (Principle 4.9.2): Any supplementary identifying information provided by the individual to facilitate an access request shall be used exclusively for that purpose.
- Obligation 43 (Principle 4.9.3): Where an organization cannot compile a list of actual third-party disclosures, it shall provide a list of third-party organizations to which it may have disclosed the information.
- Obligation 44 (Principle 4.9.4): The organization shall respond to an access request within a reasonable time and at minimal or no cost to the individual.
- Obligation 45 (Principle 4.9.4): Requested information shall be provided in a generally understandable format.
- Obligation 46 (Principle 4.9.4): The organization shall provide explanations for any abbreviations or codes utilized in the records.
- Obligation 47 (Principle 4.9.5): When an individual successfully demonstrates that their Personal Information is inaccurate or incomplete, the organization shall amend the information immediately.
- Obligation 48 (Principle 4.9.5): Where appropriate, the amended information shall be transmitted to all third parties having access to the information in question.
5.10 Principle 10: Challenging Compliance (Obligations 49–53)
- Obligation 49 (Principle 4.10): An individual shall be able to address a compliance challenge directly to the designated accountable individuals overseeing organizational compliance.
- Obligation 50 (Principle 4.10.1): The organization shall establish clear, structured procedures to receive and respond to complaints or inquiries.
- Obligation 51 (Principle 4.10.2): The organization shall inform individuals who make inquiries or lodge complaints of the existence of relevant complaint procedures.
- Obligation 52 (Principle 4.10.3): The organization shall thoroughly investigate all complaints received.
- Obligation 53 (Principle 4.10.3): If a complaint is found to be justified, the organization shall take appropriate corrective measures, including amending its policies, practices, or records as necessary.
PART VI: STATUTORY COMPLIANCE SUMMARY
Schedule 1 PrincipleCount of Mandatory "Shall" ObligationsPrimary Action Required by Organization
1. Accountability
4
Appoint a Privacy Compliance Officer, enforce third-party contracts, and implement privacy policies.
2. Identifying Purposes
3
Document and state the purposes of data collection at or before the time of collection.
3. Consent
4
Obtain informed, un-coerced, and non-deceptive consent matching the sensitivity of the data.
4. Limiting Collection
5
Limit data collection strictly to what is necessary, via fair and lawful means.
5. Limiting Use, Disclosure, & Retention
5
Retain data only as long as necessary; securely destroy or anonymize outdated records.
6. Accuracy
4
Maintain accurate, complete, and current data to prevent prejudicial decisions.
7. Safeguards
5
Implement physical, electronic, and organizational security measures to prevent breaches.
8. Openness
5
Provide public, easily accessible, and clear information regarding personal data policies.
9. Individual Access
13
Confirm data possession, provide access, supply third-party accounts, and execute corrections.
10. Challenging Compliance
5
Provide recourse channels, investigate complaints, and implement corrective measures.
TOTAL OBLIGATIONS
53
Strict, non-discretionary compliance under threat of regulatory or judicial action.
Prepared by Law Cap Inc. in compliance with federal privacy standards.
Contacting Our Privacy Officer
If you have questions about this policy, wish to exercise your rights, or have a complaint about how your data was handled, please contact our Privacy Officer. We respond to all inquiries within 30 days.
Attn: Privacy Officer Law Cap
Email: editorial@lawcap.ca; privacy@lawcap.ca
If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at 30 Victoria Street, Gatineau, Quebec, K1A 1H3, or visit www.priv.gc.ca.
