hacking, cyber, blackandwhite, crime, security, internet, computer, hacker, virus, data, network, technology, password, digital, online, attack, protection, hack, laptop, secure, safety, web, information, code, criminal, phishing, business, man, binary, access, malware, firewall, lock, thief, fraud, privacy, system, encryption, black business, black computer, black virus, black laptop, black data, black online, black network, black internet, black digital, black security, black company, black information, black web, black businessman, black code, black safety, black coding, hacking, cyber, hacker, hacker, hacker, hacker, hacker, code, fraud. PIPEDA and Quebec Law 25: Which Privacy Rules Apply to Online Communities
Photo by iAmMrRob on Pixabay

Rules

PIPEDA and Quebec Law 25: Which Privacy Rules Apply to Online Communities

How federal PIPEDA and Quebec's Law 25 differ for people who run online communities or audiences in Canada, and what each asks of a community operator.

Method Desk · · 6 min read

Which law applies to your community

Canada has no single privacy statute for online communities. The rules depend on what the operator does, not on how the group looks to its members.

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) governs how private-sector organizations collect, use and disclose personal information in commercial activity. The Office of the Privacy Commissioner of Canada (OPC) describes commercial activity as any transaction, act or regular course of conduct of a commercial character, including selling, bartering or leasing donor, membership or fundraising lists. A forum that sells ads, a paid newsletter community or a creator who monetizes an audience is easier to place inside that definition than a hobby group that charges nobody anything.

The OPC says most non-profits and community groups do not engage in commercial activity, so PIPEDA generally does not reach them. It lists collecting membership fees, organizing club activities, compiling member lists, mailing newsletters and fundraising as activities it treats as non-commercial. It also warns that non-profit status alone is not a shield, and selling, trading or renting a member list is a clear example of commercial activity. Where PIPEDA does not apply, the OPC still recommends following its fair information principles.

Provinces change the picture. Alberta, British Columbia and Quebec have private-sector privacy laws that the OPC considers substantially similar to PIPEDA. Organizations covered by those laws are generally exempt from PIPEDA for personal information handled inside the province. PIPEDA still applies to information that crosses provincial or national borders.

For a community with members in several provinces, that means more than one regime can be in play. For members in Quebec, the Quebec statute is the one to learn.

What PIPEDA asks of an operator

PIPEDA is built on ten fair information principles: accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. They translate into ordinary community tasks.

  • Say why you collect.Tell members what you gather at signup and why, in the signup flow, not only in a footer link.
  • Collect less.A display name, an email address and a password are enough for most forums. Every extra field needs a stated purpose.
  • Keep the promise on retention.Decide how long account data survives after a member leaves, and delete on that schedule.
  • Protect what you hold.Safeguards are one of the ten principles, so access to admin accounts and data exports should match the sensitivity of what members have shared.
  • Answer access requests.Members can ask what you hold about them and challenge how you handle it.

Breaches have their own rule. An organization under PIPEDA must report to the OPC any breach of security safeguards involving personal information under its control when it is reasonable to believe the breach creates a real risk of significant harm. The assessment weighs the sensitivity of the information and the probability of misuse. Affected people must be notified as soon as feasible after the risk is determined, and the notice must explain what happened, what information was involved, what the organization has done and what individuals can do. Every breach goes into a record kept for 24 months, whether or not it is reportable, and a record for an unreported breach should briefly say why no real risk was found.

The same habits help with US-style rules. The California privacy duties for online communities cover the parallel notice and request process for California members.

What Quebec Law 25 adds

Quebec's Act respecting the protection of personal information in the private sector was amended by Law 25 (the Quebec government's own announcement describes the changes as being phased in over three years, to 2024). The regulator is the Commission d'accès à l'information (CAI), and the statute covers enterprises that handle personal information, with duties that are in several places more detailed than PIPEDA's.

The CAI's summary of the principal changes lists what an enterprise now has to do.

  • Name a person responsible.By default the person with the highest authority in the enterprise holds the role, and may delegate it in writing. The title and contact details must be published on the website.
  • Publish governance policies.These cover retention and destruction, staff roles and a complaints process.
  • Publish a privacy policy in plain languagewhen you collect personal information by technological means, and notify people of changes.
  • Get valid consent.Consent has to be manifest, free, informed and given for specific purposes, requested separately for each purpose in plain terms. Using sensitive information for a new purpose needs express consent.
  • Tell people at collection.Disclose the purposes, the means used, access and correction rights, the right to withdraw consent and whether the information may be sent outside Quebec.
  • Keep an incident register.Incidents that present a risk of serious harm are reported to the CAI and to the individuals involved, and the register is given to the CAI on request.
  • Assess before sending data out of Quebec.An enterprise must complete a privacy impact assessment and, if it is favourable, sign a written agreement meeting set requirements. A privacy impact assessment is also required for projects to acquire, develop or overhaul information systems or electronic service delivery involving personal information.
  • Set privacy settings to the highest level by defaultfor a technology product offered to the public. Browser cookie settings are excluded.
  • Warn people about profiling and location tools.Identification, location or profiling technology must not be switched on by default, and people are told beforehand.
  • Support portability.Since 22 September 2024, an enterprise must on request give a person their computerized information in a structured, commonly used format.

The CAI can impose administrative monetary penalties of up to 2% of worldwide turnover or CAD 10 million, according to its page, and can bring penal prosecutions.

For a community platform, the default-settings rule and the profiling and location rules are the ones to read first. A forum that switches on a location or profiling feature for every member by default runs into them directly.

Putting the two together

A practical approach for an operator with members in more than one province is to build to the stricter standard once.

  1. Map where members live.If the list includes Quebec, Alberta or British Columbia residents, note that a provincial statute may govern their data.
  2. Name a privacy ownerand publish a contact. Quebec requires it, and it also gives PIPEDA access requests a place to land.
  3. Write one notice at collectionthat lists purposes, outside-province transfers and withdrawal rights.
  4. Separate consentsfor newsletters, analytics and ads, instead of one bundled tick box.
  5. Keep one breach logthat records date, circumstances, information involved and whether anyone was notified. It satisfies PIPEDA's 24-month record and gives the Quebec register a starting point.
  6. Check data transfers.Look at where your hosting, email and analytics tools store member data. Quebec requires an assessment before sending information out of the province.

Platform choices matter here too. If you run your community on a hosted service, you still decide what members are asked and what you do with the exports. The comparison in digital community models shows how governance differs between self-run and hosted groups, and the moderation checklist covers who sees member records.

Email is its own regime. Canada's anti-spam law governs commercial messages, and CASL's unsubscribe rules sit alongside privacy law rather than replacing it.

Common questions

Does my small free forum fall under PIPEDA?
Possibly not, if it engages in no commercial activity. The OPC treats collecting dues, mailing newsletters and keeping member lists as non-commercial in themselves. Selling or renting the list, or running the group inside a for-profit business model, can change the answer.
Can I rely on PIPEDA compliance for Quebec members?
Not safely. Quebec's statute is treated as substantially similar to PIPEDA, and the provincial law generally governs inside Quebec, so check its specific duties.

Official sources

Filed underpipedaquebec law 25online communitiescanadian privacy

More in Rules

Latest from Method Desk

Guides

Removing Your Data From US Data Brokers: The Order to Work In

Removal works best as a sequence: clean up identity data, clear the people-search sites, then the marketing lists. California residents can use DROP, and about twenty other states grant deletion rights under comprehensive privacy laws. Budget four to eight weeks for a first pass, then recheck every 90 days.

Method Desk · · 9 min read