Privacy Impact Assessments — Answering Your Top Questions

On September 22, 2023, the CAI introduced a new Privacy Impact Assessment (PIA) guide. We will see that in many instances, this guide goes beyond what is required by law. The opening section states, however, that the purpose of the guide is not to burden organizations with additional obligations, but to assist them in accomplishing effective PIAs. The CAI expressly states that organizations are not obliged to follow or apply their guide to the letter.

A previous guide had been drafted by the CAI in 2021, but it did not reflect the recent changes made by the Act to Modernize the Statutes Respecting the Protection of Personal Information (Law 25) that came into force on September 22, 2023. Likewise, the new guide does not consider bills or legislation that have not yet come into force, notably the Act Respecting Health and Social Services Information ("Law 5", formerly known as Bill 3).