Privacy

How BC law treats it

Three regimes divide the field. The Personal Information Protection Act, SBC 2003, c 63 (PIPA) governs private sector organizations in British Columbia, including companies, partnerships, sole proprietors and non-profits. The Freedom of Information and Protection of Privacy Act, RSBC 1996, c 165 governs public bodies such as ministries, municipalities, health authorities and universities. The federal Personal Information Protection and Electronic Documents Act, SC 2000, c 5 (PIPEDA) governs federally regulated businesses (banks, airlines, telecoms) and personal information that crosses provincial or national borders in the course of commercial activity. Under PIPA, an organization must obtain consent (express, implied or deemed) unless an exception applies, and may collect, use and disclose personal information only for purposes a reasonable person would consider appropriate. It must designate someone responsible for compliance, adopt policies, make reasonable security arrangements (s. 34) and answer an individual's request for access to their own personal information, generally within 30 days. The Office of the Information and Privacy Commissioner for BC investigates complaints and can issue binding orders. As of October 2026, PIPA has no mandatory breach notification duty for private organizations. Notifying affected individuals and the Commissioner is voluntary but recommended. Organizations covered by PIPEDA must report breaches that create a real risk of significant harm (PIPEDA s. 10.1). Federal Bill C-36, introduced in June 2026, would replace the private sector part of PIPEDA with a new Act, but it was not law as of October 2026. Data protection is separate from the privacy tort. The Privacy Act, RSBC 1996, c 373, s. 1 makes it a tort, actionable without proof of damage, to wilfully and without a claim of right violate another person's privacy. The Charter of Rights and Freedoms restrains government, not private businesses.

What it means for your business

Almost every BC business handles personal information about customers, employees or suppliers. A business that cannot explain why it collects data, how it secures it and who sees it risks Commissioner investigations, binding orders, damaged customer trust and lawsuits after a breach. Buyers in share and asset deals now ask for privacy compliance as part of due diligence, and weak practices can reduce price or require indemnities. A short privacy policy, a named privacy officer and clear vendor contracts address most of the risk. Example: A Vancouver fitness studio collects members' health questionnaires and stores them in a cloud app hosted in the United States. It must have a reasonable purpose for each question, protect the data with appropriate safeguards and tell members how to request access, and its cross border handling may also engage PIPEDA.

Risks and common mistakes

Assuming PIPA applies to government bodies, when public bodies are governed by FOIPPA instead. Copying a US privacy policy that refers to state laws and ignores PIPA's consent and access rules. Collecting more personal information than the stated purpose requires, such as driver's licence numbers for routine sales. Failing to name a person responsible for privacy compliance and to respond to access requests on time. Believing the Charter gives customers a privacy claim against a private business.