On January 1, 2004, a three year phase-in of Canada’s sweeping privacy legislation will end, and application of the legislation will be extended beyond the federally regulated private sector to most organizations in Canada1. The federal Personal Information Protection and Electronic Documents Act (PIPEDA)2 dramatically modernizes Canada’s privacy laws and may require changes in how organizations collect, use and disclose personal information about individuals in the course of commercial activities, whether in their day-to-day operations or in a significant transaction (such as some business acquisitions).
Essentially, PIPEDA enacts into law the ten general principles (reproduced in the appendix) and commentaries contained in the Canadian Standards Association’s Model Code for the Protection of Personal Information, with some modifications. Among these principles is the core requirement that an individual’s knowledge and consent are required for the collection, use or disclosure of
