PIPA (Personal Information Protection Act)

Background

Alberta’s Personal Information Protection Act (PIPA) was introduced on January 1, 2004 to govern the handling of personal information by organizations in Alberta. The Act tries to balance the individual’s right to have his or her personal information protected with the organization’s need to collect, use and disclose this information for legitimate and reasonable purposes.

Currently, the Act only applies on a limited basis to certain non-profit organizations including those established under the Societies Act, the Agricultural Societies Act, or organizations registered under part 9 of the Companies Act (charities). For these organizations, the Act only applies to personal information that is collected, used or disclosed as part of a commercial activity.

October 2009 Update

Bill 54, the Personal Information Protection Amendment Act, was introduced in the legislature on October 27. In the interest of minimizing legislative requirements for nonprofits, amendments to the Act will not be extended to nonprofits that are not already subject to PIPA.

Given public expectations for the secure handling of personal information, it is up to individual organizations in the nonprofit sector to ensure their practices ensure appropriate standards of personal information protection.

July 2008 Update
A report currently before government proposes that the Act be amended to make PIPA apply fully to all not-for-profit organizations, subject to a one year transition period.

It is anticipated that this change will be presented to Government in 2009. Over the coming months, CCVO will be assessing the implications of this proposed change for Calgary’s nonprofits and charities to determine our course of action.

 

December 2008 Update

CCVO Privacy Survey
An Exploration of How Alberta’s Charities and Nonprofit Organizations Protect Personal Information was conducted by the Calgary Chamber of Voluntary Organizations (CCVO) in collaboration with The Edmonton Chamber of Voluntary Organizations, Volunteer Alberta, The Office of the Privacy Commissioner of Alberta and Service Alberta. The results provide a snapshot of how Alberta’s nonprofits and charities are responding to the need to comply with various pieces of privacy legislation and if they are meeting public expectations that organizations protect the personal information they collect.

The Findings
Alberta’s large nonprofits and charities are well positioned to address privacy issues, but small organizations face challenges.
While many larger nonprofits and charities in Alberta employ best practices to protect the personal information they collect from clients, participants, donors, and others; and comply with the applicable privacy legislation, smaller organizations are not as well positioned or prepared to do either, according to a provincial survey.

The results from this survey will help us shape CCVO’s work on privacy issues in the nonprofit/voluntary sector. Service Alberta and the Office of the Privacy Commissioner of Alberta will use the results to help inform the development of education and outreach to the sector on privacy legislation and best practices.The survey results are based on a strong response (over 171 responses were collected) and we thank everyone who shared information about how their organization addresses privacy issues.

The majority of respondents worked in Social Services (33.3%), Health (16.7%), Other (15%), and Education and Research (13.5%). 32.2% of respondents had operating budgets over $1.5 million, followed by 25.6% with operating budgets between $500,001 to $1.5 million and 28.6% operated with less than $250,000.

From past research about the nonprofit/voluntary sector, we know that organizations, particularly small organizations, struggle with a number of capacity issues including meeting the growing needs of their community and finding adequate funding for their operations. An organization’s size is also a factor in assessing an organization’s capacity to address privacy issues. 27% of respondents from small organizations operating with budgets under $100,000 indicated they had formal privacy policies in place, a significant amount considering the constraints they often operate under. 85.7% of organizations operating with budgets over $1.5 million had policies in place.

The survey results also indicated that 57.8% of respondents had to comply with multiple pieces of privacy legislation. Organizations in Alberta may have to understand and comply with a variety of pieces of legislation including the Personal Information and Protection Act (PIPA), Health Information Act (HIA), Freedom of Information and Protection of Privacy Act (FOIP), and when information crosses most provincial boundaries, the Federal Personal Information Protection Electronic Document Act (PIPEDA).

Respondents indicated they wanted to learn more, ideally through face-to-face workshops (86.5%). This would provide the opportunity for organizations to get specific responses about the situations they face within their particular operations.

About the CCVO Privacy Survey
The survey An Exploration of How Alberta’s Charities and Nonprofit Organizations Protect Personal Information was conducted by CCVO using an online survey tool. 171 responses were collected between October 8 to October 31, 2008. Responses were collected from organizations from across Alberta.

For more information about the survey, please contact CCVO's Policy Analyst Laura MacKinnon at lmackinnon@calgarycvo.org or (403)261-6655 ext 228.