PIPEDA | Mortgage Data Protection in Canada

RefinancePro.club

The Personal Information Protection and Electronic Documents Act (PIPEDA), known in French as the LPRPDE, is the Canadian fédéral personal information protection law in the private sector. It applies to federally regulated organizations and interprovincial data transfers. In Quebec, the LPRPSP (provincial law, strengthened by Law 25) is recognized as substantially similar to PIPEDA, meaning Quebec businesses are primarily subject to provincial law for activities within Quebec. However, PIPEDA applies to interprovincial data transfers and fédéral enterprises (chartered banks). For Quebec mortgage brokers, compliance with both laws is necessary when transmitting files to fédéral lenders. PIPEDA is based on 10 protection principles: accountability, identifying purposes, consent, limiting collection, limiting use, accuracy, safeguards, openness, individual access and challenging compliance.

PIPEDA: The Fédéral Data Protection Framework

The Personal Information Protection and Electronic Documents Act (PIPEDA) is the Canadian fédéral law governing the collection, use and disclosure of personal information in the course of commercial activities. For Quebec mortgage brokers, this law is relevant primarily in the context of transactions with fédéral lenders and interprovincial data transfers.

Application in Quebec

Quebec has its own personal information protection law (LPRPSP, modernized by Law 25), recognized by the fédéral government as substantially similar to PIPEDA. This means that for commercial activities occurring entirely within Quebec, provincial law applies. PIPEDA intervenes when data crosses provincial borders or involves fédéral enterprises.

PIPEDA's 10 Principles

Accountability: the organization is responsible for information in its custody
Identifying purposes: the purposes of collection must be identified before or at the time of collection
Consent: the individual must consent to collection, use and disclosure
Limiting collection: only necessary information should be collected
Limiting use: information may only be used for the stated purposes
Accuracy: information must be accurate, complete and up to date
Safeguards: measures proportional to sensitivity must protect the data
Openness: policies must be readily available
Individual access: the individual can access their information and challenge it
Challenging compliance: ability to challenge compliance with the responsible person

Dual Compliance for Brokers

In practice, Quebec mortgage brokers who comply with Law 25 generally meet PIPEDA requirements, as the Quebec law is stricter on several aspects. However, it is important to ensure that privacy policies and consent forms explicitly cover transfers to fédéral institutions and cross-border situations.

Frequently Asked Questions

Does PIPEDA apply to Quebec mortgage brokers?

PIPEDA primarily applies to fédéral organizations and interprovincial data transfers. In Quebec, the provincial law (LPRPSP, strengthened by Law 25) is the primary law. However, when a Quebec broker transmits data to a fédéral lender or out of province, PIPEDA may apply to the transfer.

What is the difference between PIPEDA and Law 25?

PIPEDA is a fédéral law applying across Canada, while Law 25 is a Quebec provincial law. Law 25 is generally stricter than PIPEDA, particularly regarding penalties (up to $25M or 4% of turnover), the right to be forgotten and notification obligations. Quebec being recognized as having a substantially similar law, the provincial law prevails for local activities.

What are PIPEDA's 10 principles?

The 10 principles are: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access to information and challenging compliance. These principles form the foundation of data protection in Canada.

Can the Privacy Commissioner intervene?

Yes, the Office of the Privacy Commissioner of Canada (OPC) is the fédéral body responsible for enforcing PIPEDA. It can receive complaints, conduct investigations and make recommendations. For activities in Quebec, the Commission d'acces a l'information is competent under Law 25.