Manitoba Joins The Ranks Of Other Provinces In Enacting Its Own Private Sector Privacy Legislation

The Government of Manitoba recently enacted the Personal Information Protection and Identity Theft Prevention Act (PIPITPA) to regulate the collection, use and disclosure of personal information by the private sector in Manitoba.1The statute has not come into force, but this enactment is momentous, as it will enable Manitoba to join the ranks of Alberta, British Columbia and Quebec, which all have their own private sector privacy legislation that is "substantially similar" to the federal Personal Information Protection and Electronic Documents Act (PIPEDA).2 Manitoba is also the first province to move in this direction with an all-encompassing private sector law since 2004.

Overview

This significant moment in privacy law in Canada cannot escape a historic parallel. Despite its title, the PIPITPA is almost identical to the 2009 version of Alberta's Personal Information Protection Act (2009 Alberta PIPA), with word-for-word similarities in many places.3 Similar to the 2009 Alberta PIPA, the PIPITPA is organized by divisions of purpose, protection, access and care, regulation, as well as general provisions. The key differences are that the Alberta legislation takes a different approach on breach notification and on the role of the Privacy Commissioner. Accordingly, many of the experiences under the Alberta Personal Information Protection Act (Alberta PIPA)4 will help guide organizations in Manitoba as to their risks and obligations. Likewise, the case law in Alberta should guide Manitoba courts whenever privacy litigation arises.5

This article will focus on how these two statutes compare and provide commentary on what organizations can do to prepare for the coming into force of the PIPITPA.

Collection, Use and Disclosure of Personal Data

Similar to the federal and provincial privacy legislations, the PIPITPA defines "personal information" very broadly as information about an identifiable individual. As a general rule, but with limited exceptions, consent must be obtained from an individual prior to the collection, use or disclosure of personal information relating to that individual. Alberta courts have taken a common-sense approach to this key definition, but their holdings are under challenge in an appeal on reserve at the Supreme Court of Canada.6

1. Consent

   Consent must be "informed consent," which means that the individual must have knowledge of what he or she is consenting to, and it must be provided at the time of collection.7 To ensure informed consent is obtained, organizations will need to clearly state the purposes for the collection, use and disclosure.

   Once consent is given, the organization may only collect, use or disclose the information to the extent that it is reasonable for meeting the purposes for which it stated.8 Further, the collection, use and disclosure of the personal...