Canada — Lawful Bases for Processing

Canada's federal private-sector privacy law—the Personal Information Protection and Electronic Documents Act (PIPEDA)—rests on a consent-first model fundamentally different from the six-lawful-bases hierarchy of the European Union's GDPR. Under PIPEDA, organizations collecting, using, or disclosing personal information in the course of commercial activity must, as a baseline rule, obtain the knowledge and consent of the individual (Clause 4.3, Schedule 1). This principle applies to private-sector organizations across Canada that collect personal information in commercial transactions, as well as to the employee personal information of federally regulated works, undertakings, or businesses (such as banks, airlines, and telecommunications carriers).

PIPEDA was enacted in 2000 and incorporates the ten Fair Information Principles developed by the Canadian Standards Association, codified in Schedule 1 of the Act. Principle 4.3 (Consent) states: "The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate." The consent must be meaningful—section 6.1, added by the Digital Privacy Act 2015, requires that consent is valid only if "it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting."

The form of consent varies with sensitivity and context. Clause 4.3.4 instructs organizations to "take into account the sensitivity of the information" when determining whether express or implied consent is appropriate. Medical records and financial data almost always require express consent; business contact information may permit implied consent where the purpose aligns with reasonable expectations. The Office of the Privacy Commissioner of Canada (OPC)—the independent federal oversight body—has consistently held that consent for sensitive uses such as behavioral advertising or biometric collection must be express, not implied.

## Section 7 statutory exceptions

PIPEDA does not offer organizations a menu of alternative lawful bases in the manner of GDPR Article 6. Instead, consent remains the default, and section 7 enumerates tightly circumscribed exceptions permitting collection, use, or disclosure without knowledge or consent when certain conditions are met.

Key exceptions under section 7 include:

• 7(1)(b): Collection is reasonable for investigating a breach of an agreement or contravention of Canadian or provincial law, and obtaining consent would compromise accuracy or access to the information.
• 7(1)(c): Collection where a reasonable person would consider it appropriate in an emergency threatening life, health, or security.
• 7(1)(d): Collection of publicly available information specified by regulation (telephone directories, professional directories, government registries, and quasi-judicial body records available to the public under the Regulations Specifying Publicly Available Information).
• 7(2)(c): Use for statistical, scholarly study, or research purposes where consent is impracticable, the use will ensure confidentiality, and the OPC is informed before use.
• 7(3)(c): Disclosure required by subpoena, warrant, or court order; or disclosure to a government institution for law enforcement, national security, or national defence.
• 7(3)(d.1) and (d.2): Disclosure to another organization for investigating breach of agreement or contravention of law, or for detecting, suppressing, or preventing fraud, where obtaining consent would compromise the investigation or the ability to prevent fraud (added by the Digital Privacy Act 2015).
• 7(3)(e): Disclosure in an emergency threatening life, health, or security, with written notice to the individual afterward if alive.
• 7(3)(f): Disclosure for statistical, scholarly study, or research purposes where consent is impracticable and the OPC is informed before disclosure.
• 7(3)(h.1): Disclosure of publicly available information specified by regulation, where the disclosure relates directly to the purpose for which it was made publicly available.

Section 7.1 forbids reliance on these exceptions for address harvesting or spyware-based collection. Section 7.2 (also added in 2015) permits use and disclosure without consent in the context of prospective or completed business transactions (mergers, acquisitions) if the parties enter a confidentiality agreement, the information is necessary for the transaction, and individuals are notified within a reasonable time after completion. Section 7.3 permits federally regulated employers to collect, use, and disclose employee personal information without consent to establish, manage, or terminate the employment relationship.

## Contrast with GDPR

Unlike GDPR, PIPEDA does not recognize "legitimate interests" balancing, "performance of a contract," or "legal obligation" as freestanding lawful bases. If an organization wishes to rely on an exception, it bears the burden of demonstrating that the specific conditions in the relevant section 7 paragraph are met. The OPC investigates complaints under PIPEDA and issues findings and recommendations; at the conclusion of an investigation, the complainant (or in some cases the OPC) may seek enforcement in Federal Court. Administrative monetary penalties for PIPEDA violations do not currently exist—remedies are primarily declaratory and injunctive—though legislative proposals to introduce fines have been under discussion for years.

PIPEDA applies to organizations with a real and substantial connection to Canada. Provinces with substantially similar legislation—Alberta (Personal Information Protection Act), British Columbia (Personal Information Protection Act), and Quebec (Act respecting the protection of personal information in the private sector, amended significantly by Law 25 in 2021)—are exempt from PIPEDA for intra-provincial activity, but organizations handling cross-border or inter-provincial personal information remain subject to PIPEDA for that portion of their operations.

The Minister of Innovation, Science and Economic Development is the responsible minister for PIPEDA; the OPC is the designated supervisory authority.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5 Source: Digital Privacy Act, S.C. 2015, c. 32 Source: PIPEDA Fair Information Principles, Office of the Privacy Commissioner of Canada

Under PIPEDA, individuals retain the ongoing right to withdraw consent for the collection, use, or disclosure of their personal information, subject to three statutory limitations codified in Principle 4.3.8 of Schedule 1. This right is foundational to PIPEDA's consent-based model and distinguishes it from models that rely on immutable lawful bases (such as GDPR's legitimate interests or contract grounds, which cannot be withdrawn by unilateral individual action in the same manner).

## The Principle 4.3.8 rule

Principle 4.3.8 states: "An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. The organization shall inform the individual of the implications of such withdrawal."

The right applies to all consent originally given under Principle 4.3—express or implied, for primary or secondary purposes—unless one of the three carve-outs applies. The Office of the Privacy Commissioner (OPC), Canada's independent federal oversight authority for PIPEDA, has consistently held that organizations bear the burden of demonstrating that a valid legal or contractual restriction applies if they refuse to honor a withdrawal request.

## Three statutory limitations

Organizations may refuse withdrawal or delay its effect only when:

1. Legal restrictions apply. A legal obligation to collect, use, or disclose the information—imposed by Canadian federal or provincial statute or by court order—may override an individual's withdrawal. For example, in OPC Case Summary #2003-211, a bank legitimately refused withdrawal of consent for sharing overdraft information with credit bureaus because such disclosure is legally required to maintain the integrity of the Canadian credit-granting system under applicable financial-services regulations. The Commissioner held that the bank satisfied the "legal restriction" test and was not in contravention of Principle 4.3.8.

2. Contractual restrictions are reasonable. Consent may not be withdrawn if the information is necessary to fulfill an existing contractual obligation between the individual and the organization. The most common example: an individual paying for a subscription service in installments cannot withdraw consent for the use of payment information until the contract term expires or is otherwise terminated. The Digital Privacy Act 2015, which added section 7.2, clarified that in business transactions (mergers, acquisitions), the acquiring organization must give effect to any withdrawal of consent made under Principle 4.3.8 except where the personal information is necessary for carrying on the business or activity that was the object of the transaction—reinforcing that contractual necessity is a valid limitation but must be narrowly construed.

3. Reasonable notice has not yet been provided. The organization may request reasonable time to process the withdrawal and implement it across systems. "Reasonable notice" has no fixed statutory timeline; the OPC assesses it contextually. In multiple early complaints involving banks (OPC Case Summaries #2003-248, #2003-249, #2003-116), the Commissioner found that individuals had provided reasonable notice—in some cases more than six months—and that the banks' failure to honor withdrawal (due to systems errors, inadequate call-center staffing, or failure to communicate the opt-out across affiliates) violated Principle 4.3.8. The OPC has made clear that organizations must design convenient withdrawal mechanisms—toll-free numbers, online forms, or simple email requests—and must ensure that the withdrawal is operationalized promptly once reasonable notice is given.

## Organizational obligations upon withdrawal

When an individual exercises withdrawal, the organization must inform the individual of the implications (Principle 4.3.8). Implications may include:

• Termination or degradation of service (e.g., a recommendation engine will stop functioning if consent for behavioral tracking is withdrawn).
• Inability to complete a transaction (e.g., withdrawal of consent for payment processing will prevent order fulfillment).
• Retention of information for legal or regulatory reasons (e.g., transaction records retained for tax or anti-money-laundering compliance under section 7 exceptions).

The duty to inform must occur before or at the time of withdrawal—not retroactively—so the individual can make an informed choice.

After honoring the withdrawal, the organization must cease collection, use, and disclosure of the personal information for the purposes to which the withdrawal applies. If consent was originally given for multiple distinct purposes, withdrawal may be granular: for example, an individual may withdraw consent for marketing use of an email address while retaining consent for transaction confirmations tied to the same service. The OPC has held that where secondary purposes (marketing, sharing with affiliates) exist alongside primary purposes (service delivery), organizations must provide an ongoing mechanism for withdrawing consent to the secondary purpose, and should ensure that the withdrawal takes effect with minimal delay (OPC Interpretation Bulletin on Form of Consent).

## Withdrawal vs. erasure

Withdrawal of consent under PIPEDA is not equivalent to a right to erasure (GDPR Art. 17). After an individual withdraws consent, PIPEDA does not mandate deletion of previously collected information if:

• A section 7 exception permits retention without consent (e.g., retention for compliance with a legal obligation, for detection of fraud under section 7(3)(d.1), or for statistical/research purposes under section 7(2)(c) if conditions are met).
• Retention is necessary to allow the individual to exhaust recourse under PIPEDA (section 8(8): an organization must retain information subject to an access request long enough for the individual to pursue complaint or Federal Court proceedings).

The OPC does not interpret Principle 4.3.8 as triggering automatic deletion; instead, the organization transitions from a consent basis to a section 7 exception basis (if available) or must delete if no exception applies.

## Cross-border note: PIPEDA withdrawal applies to data exported under business-transaction exceptions

Section 7.2(2)(a)(iii), added in 2015, requires that when personal information is transferred in a completed business transaction (merger, acquisition) without consent under the business-transaction exception, the acquiring organization must enter into an agreement to give effect to any withdrawal of consent made under Principle 4.3.8. This ensures that individuals' withdrawal rights travel with their data even when the data is disclosed to a new controller without their knowledge or consent under a statutory exception.

## Enforcement

PIPEDA does not currently provide for administrative monetary penalties. The OPC investigates complaints, issues findings, and may recommend corrective measures. If the organization does not comply voluntarily, the complainant (or, in limited circumstances, the OPC) may apply to Federal Court for a declaration, injunction, or damages. In practice, OPC findings of non-compliance with Principle 4.3.8—particularly where organizations erected unreasonable barriers to withdrawal or ignored repeated withdrawal requests—have resulted in enforceable Federal Court orders and significant reputational harm.

Organizations operating under provincial substantially similar legislation (Alberta PIPA, British Columbia PIPA, Quebec Law 25) should consult those statutes for parallel withdrawal-of-consent provisions; the right exists in all three provincial regimes but may be worded and enforced differently.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, Principle 4.3.8 Source: Digital Privacy Act, S.C. 2015, c. 32 Source: PIPEDA Fair Information Principle 3 – Consent, Office of the Privacy Commissioner of Canada Source: PIPEDA Interpretation Bulletin: Form of Consent, Office of the Privacy Commissioner of Canada Source: PIPEDA Case Summary #2003-211, Office of the Privacy Commissioner of Canada Source: PIPEDA Case Summary #2003-248, Office of the Privacy Commissioner of Canada

Under PIPEDA, consent is valid only if it meets the meaningfulness standard codified in section 6.1 and the sensitivity-based form requirement set out in Principles 4.3.4–4.3.6 of Schedule 1. These provisions—the former added by the Digital Privacy Act in 2015, the latter part of PIPEDA's original 2000 framework—impose a two-tier obligation: organizations must ensure individuals understand what they are consenting to (section 6.1), and they must obtain the appropriate form of consent (express or implied) based on the sensitivity of the information and the reasonable expectations of the individual (Principles 4.3.4–4.3.6).

## Section 6.1: The reasonableness standard for meaningful consent

Section 6.1 states: "For the purposes of clause 4.3 of Schedule 1, the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting."

This is an objective reasonableness test from the perspective of the target audience—not what the organization believes it has disclosed, but what a reasonable member of the intended user base would actually comprehend. The Office of the Privacy Commissioner (OPC) issued comprehensive Guidelines for obtaining meaningful consent in May 2018 (effective January 1, 2019) that interpret section 6.1 as requiring organizations to explain:

• Nature: what personal information is being collected (email address, browsing history, geolocation, health data).
• Purpose: why the organization needs it (service delivery, fraud prevention, behavioral advertising, analytics).
• Consequences: risks of harm—particularly meaningful residual risks of significant harm that remain after mitigation measures. The OPC defines "significant harm" to include bodily harm, humiliation, damage to reputation, loss of employment, identity theft, and financial loss. Organizations must disclose these risks when they are more than minimal or theoretical but need not reach the balance-of-probabilities threshold.

The OPC has consistently held that lengthy, legalistic privacy policies buried in terms of service do not satisfy section 6.1. In multiple enforcement actions—including the 2020 Federal Court application against Facebook (T-190-20) for failures related to the "This is Your Digital Life" app data-sharing—the OPC found that organizations failed to obtain meaningful consent under section 6.1 when users could not reasonably understand that third-party apps would access and retain their friends' data. The Federal Court in Englander v. Telus Communications Inc. (2004 FCA 387) held that "a consent is not informed if the person allegedly giving it is not aware at the time of giving it that he or she had the possibility to opt out."

## Principles 4.3.4–4.3.6: Express consent vs. implied consent

Principle 4.3.4 provides: "The form of the consent sought by the organization may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, organizations shall take into account the sensitivity of the information."

Express consent (opt-in) is required when:

• The personal information is sensitive (medical records, financial data, biometric identifiers, precise geolocation, sexual orientation, political opinions, ethnic or racial origin, genetic data, information about children).
• The collection, use, or disclosure is outside the reasonable expectations of the individual (sharing subscriber data with affiliates for marketing; third-party behavioral tracking; employee monitoring beyond what is necessary for the employment relationship).
• The processing creates a meaningful residual risk of significant harm (as defined in the OPC's May 2018 Guidelines).

Implied consent (opt-out) is acceptable only in strictly defined circumstances when:

• The personal information is demonstrably non-sensitive in nature and context (the OPC Interpretation Bulletin on Form of Consent gives examples: name and address for magazine subscription renewal; business contact information for directory listings where the individual posted it publicly for that purpose).
• The purpose is limited and well-defined and stated in a reasonably clear manner brought to the individual's attention.
• The use or disclosure aligns with the individual's reasonable expectations under Principle 4.3.5.
• The organization is otherwise in full compliance with all PIPEDA principles (accountability, safeguards, openness).

The Commissioner has stated plainly: "Express consent is the most appropriate and respectful form of consent to use in any circumstances; implied consent can be acceptable in strictly defined circumstances" (OPC Interpretation Bulletin on Form of Consent; PIPEDA Case Summary #2003-207).

## Context-dependent sensitivity: the Federal Court and OPC rulings

Principle 4.3.4 itself acknowledges: "Although some information (for example, medical records and income records) is almost always considered to be sensitive, any information can be sensitive, depending on the context."

The Federal Court of Canada and the OPC have repeatedly held that sensitivity is contextual:

• In Randall v. Nubody's Fitness Centres (2010 FC 681), the Court found that information about how often an individual attends a gym is low-sensitivity and may support implied consent, but information about what they do at the gym, their training regimen, and fitness level is more sensitive and requires express consent.
• In PIPEDA Report of Findings #2012-002 (Facebook non-members' email addresses used to suggest friends), the OPC held: "Although an email address may not at first blush be considered to be a sensitive piece of personal information, the existing or presumed social connections between people derived from the use of the e-mail address … could be considered sensitive in certain unique contexts."
• In PIPEDA Report of Findings #2014-001 (Google health-search targeting), the OPC found that the use of sensitive health search queries for ad targeting requires meaningful and express consent, even when the organization does not store the underlying queries in identifiable form.
• In Townsend v. Sun Life Financial (2012 FC 550), the Federal Court held that medical information is "of the utmost sensitivity and should receive the highest degree of protection."

## Reasonable expectations under Principle 4.3.5

Principle 4.3.5 states: "In obtaining consent, the reasonable expectations of the individual are also relevant."

The OPC and courts assess reasonableness by examining:

• The pre-existing relationship between the individual and the organization (subscription, employment, financial services).
• Industry norms and statutory disclosure obligations (credit reporting by banks under financial-services regulations).
• Whether the individual actively initiated the disclosure or passively had information collected (compare a user posting business contact information on a professional website for networking purposes vs. a company scraping publicly available social-media profiles for a commercial mailing list).

In PIPEDA Case Summary #2003-244 (telecommunications company using customer data for secondary marketing), the Assistant Commissioner found that the company's opt-out consent mechanism violated Principle 4.3.5 because "the company's privacy practices do not meet the reasonable expectations of its customers"—the organization failed to draw new subscribers' attention to its privacy practices at the point of sale, burying the disclosures in an unindexed user manual.

In PIPEDA Case Summary #2019-006 (Grey House directory scraping), the OPC held that while the complainant had freely chosen to post his information publicly, he "could not have reasonably expected that his personal information would be collected by a third party publishing company and then inserted into a national print directory … Nor could the complainant have expected that his information would then be included in a distribution list sold to a federal government department." The OPC found that Grey House could not rely on implied consent and was in contravention of Principle 4.3.

## Children's consent: the OPC's under-13 bright-line rule

In the May 2018 Guidelines, the OPC takes the position that, in all but exceptional circumstances, anyone under the age of 13 is unable to provide meaningful consent themselves. Organizations must obtain consent from a parent or guardian. For youth aged 13 and older who can provide consent, the consent process must "reasonably consider their level of maturity"—simplified language, age-appropriate explanations, and just-in-time contextual notices. (The Alberta, British Columbia, and Quebec provincial regulators did not endorse a specific numerical age threshold and assess capacity contextually.)

## The OPC's May 2018 Guidelines: seven guiding principles (effective January 1, 2019)

The OPC's Guidelines for obtaining meaningful consent (jointly issued with the Alberta and British Columbia privacy commissioners on May 24, 2018, and applied by the OPC beginning January 1, 2019) set out seven guiding principles, including binding "must" requirements derived from section 6.1:

1. Emphasize key elements: Organizations must highlight (1) the types of personal information collected, (2) the purposes, (3) third parties with whom information will be shared (described in sufficient detail for the individual to understand), and (4) meaningful residual risks of significant harm.
2. Allow control of detail: Provide layered privacy notices—short-form key facts up front, with links to comprehensive policies for those who want them.
3. Provide just-in-time notices: Seek consent at the moment a feature that collects new data is activated, not buried in a lengthy initial sign-up flow.
4. Innovative, context-suitable mechanisms: Interactive walkthroughs, infographics, videos; mobile-optimized consent flows that respect the constraints of screen size and user attention.
5. Audit regularly: Periodically verify that privacy communications accurately reflect current data practices.
6. Stand ready to demonstrate compliance: When challenged, organizations must be able to show that their consent processes permit the target audience to provide valid, meaningful consent.
7. Provide ongoing withdrawal mechanisms: Consent to secondary purposes (marketing, analytics) must be granular and revocable with minimal delay (as discussed in the existing section on withdrawal of consent).

The Guidelines also note that consent does not waive an organization's other PIPEDA obligations, including the subsection 5(3) "appropriate purposes" test, accountability (Principle 4.1), and safeguards (Principle 4.7).

## Relationship to subsection 5(3): consent alone is not sufficient

Even when an organization obtains valid, meaningful consent under section 6.1 and Principles 4.3.4–4.3.6, the collection, use, or disclosure must still satisfy the independent "appropriate purposes" requirement in subsection 5(3) of PIPEDA, which states: "An organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances."

The OPC's Guidance on inappropriate data practices (May 2018, effective July 1, 2018) identifies five "no-go zones" that are offside subsection 5(3) even with consent: (1) collection, use, or disclosure that is otherwise unlawful; (2) profiling or categorization that leads to unfair, unethical, or discriminatory treatment contrary to human rights law; (3) collection, use, or disclosure for purposes that are known or likely to cause significant harm to the individual; (4) publishing personal information with the intended purpose of charging individuals for its removal (held to amount to blackmail in T (A) v. Globe24h.com, 2017 FC 114); (5) requiring social-media passwords from job applicants or employees for employment screening; and (6) surveillance through audio or video functionality of an individual's own device without full, ongoing control by the individual and no recording, use, disclosure, or retention except as expressly authorized.

## Provincial regimes: substantially similar requirements

The **Alberta Personal Information Protection Act (PIPA), British Columbia PIPA, and Quebec Act respecting the protection of personal information in the private sector** (as amended by Law 25, which came into force in stages between September 2022 and September 2024) each contain parallel meaningful-consent and sensitivity-based form requirements. Organizations operating under those substantially similar provincial statutes should consult the relevant provincial commissioner's guidance; the May 2018 OPC Guidelines were issued jointly with Alberta and BC (Quebec CAI was not a signatory but Law 25 codifies similar express-consent triggers for sensitive information).

Organizations handling cross-border or inter-provincial personal information remain subject to PIPEDA for that portion of their operations, even when they are otherwise subject to provincial law for intra-provincial activity.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, section 6.1 Source: Personal Information Protection and Electronic Documents Act, Schedule 1, Principles 4.3.4–4.3.6 Source: Guidelines for obtaining meaningful consent, Office of the Privacy Commissioner of Canada (May 2018) Source: PIPEDA Interpretation Bulletin: Form of Consent, Office of the Privacy Commissioner of Canada Source: PIPEDA Fair Information Principle 3 – Consent, Office of the Privacy Commissioner of Canada

Section 4.01 of PIPEDA, added by the Digital Privacy Act in 2015, carves business contact information entirely out of the scope of Part 1 of the Act when an organization collects, uses, or discloses such information "solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession." When section 4.01 applies, the organization does not need consent and is not bound by the ten Fair Information Principles in Schedule 1 for that information. This carve-out enables routine B2B networking, cold outreach, and professional correspondence without triggering PIPEDA's consent framework—but the Office of the Privacy Commissioner (OPC) has made clear that the "solely for the purpose" requirement is narrow and strictly enforced.

## Statutory definition of business contact information

Section 2(1) of PIPEDA defines "business contact information" as "any information that is used for the purpose of communicating or facilitating communication with an individual in relation to their employment, business or profession such as the individual's name, position name or title, work address, work telephone number, work fax number or work electronic address."

The definition is illustrative, not exhaustive—the lead-in phrase "such as" signals that other types of information may qualify if they meet the functional test: used for professional communication. However, business contact information remains personal information under section 2(1) (information about an identifiable individual); section 4.01 simply exempts it from the application of PIPEDA when the conditions are met. If the organization uses business contact information for any purpose beyond professional communication—marketing consumer products to the individual, profiling the individual's interests, or reselling the information—section 4.01 does not apply and the organization must comply with PIPEDA, including the consent requirement under Principle 4.3.

## The "solely for the purpose" gateway: OPC enforcement positions

The OPC's Interpretation Bulletin on Personal Information states plainly: "PIPEDA does not apply to an organization in respect of the business contact information of an individual that the organization collects, uses or discloses solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession." The Commissioner has interpreted "solely" to mean exclusively and narrowly: if the organization's purpose includes any secondary use that is unrelated to the individual's professional role, section 4.01 fails and PIPEDA applies in full.

*PIPEDA Report of Findings #2016-003* (*Compu-Finder*): address-harvested B2B email lists

In Compu-Finder (3510395 Canada Inc.), the OPC investigated a B2B marketing company that used address-harvesting software to scrape approximately 170,000 work email addresses from publicly accessible websites between 2012 and 2014. Compu-Finder sold access to this database to third-party marketers and used it to send unsolicited commercial email. The organization argued that section 4.01 exempted its activity because it was sending "entirely business-to-business" messages and the email addresses were business contact information.

The Commissioner rejected that defence. The OPC found:

• Many of the commercial emails Compu-Finder sent "are not relevant to the employment, business or profession of the e-mail recipients"—for example, marketing consumer electronics or unrelated services to individuals whose job titles did not suggest a business need for those products.
• Compu-Finder's database did not record an individual's position or title, making it impossible for the organization to determine whether a given message would be "relevant" to the recipient's professional role—a red flag that the use was not "solely" for professional communication but rather for indiscriminate mass marketing.
• The OPC held that section 4.01's carve-out applies only when the organization can demonstrate that each use or disclosure is limited to professional communication tied to the individual's employment, business, or profession. Bulk email marketing to harvested lists failed that test.

The finding establishes that relevance matters: even if the information collected is business contact information, the organization must ensure that every use aligns with the purpose of facilitating professional communication. An organization that repurposes business email addresses for consumer marketing, affiliate sales, or secondary advertising loses the section 4.01 exemption and must obtain consent under Principle 4.3.

*PIPEDA Findings #2020-002* (*RateMDs*): health-practitioner rating website

In RateMDs, a physician rating website published the names and practice contact details of health practitioners (sourced from publicly available professional directories maintained by provincial colleges) alongside patient-submitted reviews and ratings. The complainant, a physician, argued that the website was using her business contact information without consent. RateMDs invoked section 4.01, asserting that it displayed business contact information solely to facilitate communication with the physician in her professional capacity.

The OPC found that section 4.01 did not apply. The Commissioner held: "RateMDs collection, use and disclosure of the Complainant's business contact information is therefore not exempt from PIPEDA pursuant to section 4.01 in the circumstances" because the information was not being used solely for the purpose of facilitating communication with the physician in relation to her profession. Instead, the website's primary purpose was to publish reviews and ratings—a reputational and informational function distinct from enabling direct professional communication. The OPC noted that while the website displayed the contact details alongside the reviews, the dominant purpose was public rating and review, not professional correspondence.

The Commissioner went on to hold that the business contact information was publicly available within the meaning of the Regulations Specifying Publicly Available Information (professional directories maintained by regulatory bodies under statutory authority), permitting collection, use, and disclosure without consent under sections 7(1)(d), 7(2)(c.1), and 7(3)(h.1)—an entirely different consent exception outside section 4.01. This illustrates that section 4.01 is narrower than the publicly-available-information exception: even when an organization may lawfully use business contact information under a section 7 exception, it does not necessarily satisfy the "solely for the purpose of professional communication" test in section 4.01.

## What qualifies: permitted uses under section 4.01

When section 4.01 does apply, organizations are free to collect, use, and disclose business contact information without consent. Typical permitted activities include:

• B2B cold outreach (an IT vendor emailing a CTO to offer enterprise software; a law firm sending a capabilities brochure to an in-house legal director).
• Professional networking (collecting business cards at a conference and adding contacts to a professional CRM).
• Vendor communications (a supplier emailing a purchasing manager about product updates, invoices, or delivery schedules tied to the business relationship).
• Recruiting (a headhunter contacting a marketing manager at her work email to discuss a senior marketing role at another company).
• Professional directory listings (a business association publishing a member directory with names, titles, and work contact details to facilitate member-to-member networking).

In each scenario, the collection, use, or disclosure is tightly tied to the individual's professional role and the purpose is solely to communicate about matters related to employment, business, or profession.

## What fails: impermissible secondary purposes

Section 4.01 does not exempt:

• Consumer marketing to work email addresses (targeting employees for personal purchases—car insurance, vacation packages, home renovation services—using harvested work emails).
• Profiling or analytics beyond the narrow professional communication (building behavioral profiles, cross-referencing business contact information with consumer data sets for ad targeting).
• Reselling or licensing business contact lists to third parties for broad marketing purposes unrelated to the individuals' professional roles (the Compu-Finder scenario).
• Reputational or informational publication (rating websites, employer-review platforms, public complaint boards—where the primary purpose is to publish about the individual, not to communicate with the individual in a professional capacity, per RateMDs).

In all these scenarios, the use is not solely for professional communication, and PIPEDA applies in full—requiring consent under Principle 4.3, compliance with the subsection 5(3) appropriate-purposes test, and adherence to the safeguards and accountability obligations in Schedule 1.

## Section 4.01 is a complete carve-out, not a consent exception

Unlike the section 7 exceptions (which permit collection, use, or disclosure without consent but still bind the organization to all other PIPEDA principles), section 4.01 removes business contact information entirely from the scope of Part 1 when its conditions are met. The organization is not required to:

• Obtain consent (Principle 4.3).
• Limit collection to identified purposes (Principle 4.4).
• Provide access on request (Principle 4.9).
• Maintain records of use or disclosure (Principle 4.8).
• Implement safeguards proportionate to sensitivity (Principle 4.7).
• Comply with the breach-notification regime under sections 10.1–10.3 (because the information is outside Part 1 entirely).

This makes section 4.01 far more permissive than a section 7 exception—but only if the organization stays within the narrow "solely for the purpose" lane. Organizations that attempt to stretch section 4.01 to cover secondary marketing, profiling, or resale activities lose the carve-out entirely and face potential OPC findings of non-compliance with Principle 4.3 and subsection 5(3).

## Interaction with the publicly-available-information exception and CASL

Business contact information is frequently also publicly available (published in professional directories, corporate websites, LinkedIn profiles). When business contact information is both (a) carved out under section 4.01 and (b) publicly available within the meaning of the Regulations Specifying Publicly Available Information, organizations have two independent bases to collect, use, or disclose without consent:

1. Section 4.01 (if the use is solely for professional communication).
2. Sections 7(1)(d), 7(2)(c.1), 7(3)(h.1) (if the information is specified by regulation and the collection, use, or disclosure relates directly to the purpose for which it was made publicly available).

In RateMDs, the OPC held that the physician's business contact information—though not exempt under section 4.01—was publicly available under the regulations, permitting the website to publish it without consent under the publicly-available-information exception. Organizations may fall back on the section 7 publicly-available exception even when section 4.01 does not apply, but they remain bound by all other PIPEDA principles (safeguards, accountability, appropriate purposes under subsection 5(3)) and must ensure that the use "relates directly to the purpose for which the information appears" in the public source (paragraph 1(b) of the regulations).

Separately, Canada's Anti-Spam Legislation (CASL) regulates the sending of commercial electronic messages (CEMs). PIPEDA governs collection, use, and disclosure of personal information; CASL governs the transmission of CEMs. The two regimes overlap but are not coextensive. Even if an organization's use of a work email address is exempt from PIPEDA under section 4.01, the organization must still comply with CASL's consent, identification, and unsubscribe requirements when sending a CEM, unless a CASL exception applies (such as the business-to-business exception in section 10(9) of CASL for messages sent to a business email address when the message concerns the recipient's business activities). Organizations must analyze PIPEDA and CASL independently; section 4.01 does not create a blanket CASL exemption.

## Provincial regimes: Alberta, BC, and Quebec

**Alberta PIPA and British Columbia PIPA do not contain a section 4.01 equivalent. Instead, both statutes define "personal information" to exclude "business contact information" altogether—business contact information is simply not personal information under those Acts. Quebec's Law 25** (amending the Act respecting the protection of personal information in the private sector) does not exclude business contact information from the definition of personal information, and Quebec organizations must comply with Law 25's consent and transparency requirements even when handling business contact information. Organizations operating under provincial substantially similar legislation should not rely on section 4.01; they must consult the applicable provincial statute and guidance from the provincial commissioner.

Organizations handling cross-border or inter-provincial personal information remain subject to PIPEDA for that portion of their operations (section 4(1)(a)), even when they are otherwise subject to provincial law for intra-provincial activity. For such organizations, section 4.01 applies to the federal-PIPEDA-covered portion of their business contact information processing.

## Practical compliance takeaways

• Document the purpose. When relying on section 4.01, maintain records showing that each use is solely for professional communication—tie email campaigns to job titles, business functions, or stated professional interests; avoid consumer marketing to work addresses.
• Segregate business and consumer contact. Do not commingle business contact information collected under section 4.01 with consumer marketing lists or cross-reference with personal social-media profiles.
• Test the "solely" requirement. Ask: is every message or disclosure relevant to the recipient's professional role? If a message is consumer-oriented (vacation deals, retail promotions, personal finance products), section 4.01 fails and you need consent.
• Fall back on section 7 exceptions when needed. If the business contact information is publicly available under the regulations, you may still collect, use, or disclose without consent under sections 7(1)(d)/(2)(c.1)/(3)(h.1)—but remain bound by all other PIPEDA principles.
• Do not conflate PIPEDA and CASL. Section 4.01 does not exempt you from CASL. Analyze both regimes independently.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, section 4.01 Source: Personal Information Protection and Electronic Documents Act, section 2(1), definition of "business contact information" Source: PIPEDA Interpretation Bulletin: Personal Information, Office of the Privacy Commissioner of Canada Source: PIPEDA Report of Findings #2016-003 (Compu-Finder), Office of the Privacy Commissioner of Canada Source: PIPEDA Findings #2020-002 (RateMDs), Office of the Privacy Commissioner of Canada

Update as of June 2026:

The Office of the Privacy Commissioner of Canada (OPC) has expanded the categories of personal information that are generally considered inherently sensitive. In its Interpretation Bulletin (published in 2024), the OPC has explicitly added “neural data”—information derived from neurotechnology or brain activity (such as EEG, fMRI, or brain–computer interfaces)—to its list of data types that require the highest degree of protection. This update affects the application of PIPEDA’s Principle 4.3.4: any personal information can become sensitive depending on context, but certain categories (now including neural data, as well as medical, financial, and biometric information) are presumed sensitive and typically require express consent.

Contextual sensitivity under Principle 4.3.4 (Schedule 1): Organizations must assess sensitivity based not only on the inherent type of data, but also on the specific risk environment, purpose, and the reasonable expectations of the data subject. Names and addresses that are benign in one context may become sensitive in another (e.g., a subscriber list for a politically sensitive publication). The regulatory expansion to include neural data means that organizations must treat such data with the same heightened protections as health, financial, or biometric data, and typically may not rely on implied consent.

Safeguards (Principle 4.7): Principle 4.7 requires that safeguards be “appropriate to the sensitivity of the information.” For neural data and other presumptively sensitive categories, this means more stringent technical, physical, and organizational protections, such as encryption, granular access controls, and strict internal protocols. Organizations must be prepared to justify their consent model and safeguards in light of the latest OPC guidance.

Compliance impact:

• Express consent is generally required for neural data collection, use, or disclosure, mirroring requirements for health, biometric, and financial information.
• Heightened safeguards are mandatory; security failures involving neural data are likely to be treated as serious breaches under PIPEDA.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, Principle 4.3.4 Source: Personal Information Protection and Electronic Documents Act, Schedule 1, Principle 4.7 Source: PIPEDA Interpretation Bulletin: Sensitive Information (OPC, 2024 update)

Human confirmed as of 2026-06-23. Section is current as of this review.

Sections 7(1)(b), 7(3)(d.1), and 7(3)(d.2) of PIPEDA permit organizations to collect, use, and disclose personal information without the knowledge or consent of the individual when investigating breaches of agreements, contraventions of law, or fraud—but only when obtaining consent "would compromise" the investigation or the ability to detect, suppress, or prevent fraud. These exceptions, added or substantially amended by the Digital Privacy Act in 2015, are critical for financial institutions, e-commerce platforms, insurers, and employers responding to fraud, theft, account takeovers, and cybersecurity incidents. The Office of the Privacy Commissioner (OPC) has made clear that the "would compromise" threshold is narrowly construed and that section 7.1 prohibits reliance on these exceptions for address-harvested or spyware-collected information, even when the underlying purpose (fraud detection) would otherwise qualify.

## Section 7(1)(b): Collection for breach or contravention investigations

Section 7(1)(b) states that an organization may collect personal information without the knowledge or consent of the individual when "it is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province."

This exception permits collection (the initial gathering of personal information) without consent when two conditions are met:

1. The collection is reasonable for investigating a breach of an agreement or a contravention of law. The investigation must relate to a specific suspected breach or contravention—not generalized compliance monitoring or speculative data mining. A "breach of an agreement" includes employee misconduct violating an employment contract, vendor fraud breaching a supply agreement, or a customer dispute involving alleged contract violations. A "contravention of the laws of Canada or a province" includes suspected violations of the Criminal Code (fraud, theft, identity theft), provincial consumer-protection statutes, or federal financial-services regulations.

2. Obtaining consent would compromise the availability or accuracy of the information. The OPC interprets "compromise the availability or the accuracy" to mean that notifying the individual would cause them to destroy, conceal, or alter evidence or would otherwise obstruct the investigation. For example, an employer investigating suspected employee theft may collect email logs, access logs, and transaction records without notifying the employee because advance notice would give the employee an opportunity to delete incriminating files or fabricate exculpatory records. The burden is on the organization to demonstrate that the "would compromise" condition is met on the specific facts of the case—blanket policies asserting that all investigations require secrecy do not satisfy the standard.

Section 7(1)(b) applies only to collection, not to use or disclosure. Once the organization has collected the information without consent under section 7(1)(b), it may use the information for the investigation under section 7(2)(b) (discussed in the existing guide section) and may disclose it under section 7(3)(d.1) (discussed below) or to law enforcement under section 7(3)(c) or section 7(3)(d) (court orders and voluntary disclosures to government institutions with reasonable grounds to believe the information relates to a contravention of law).

## Section 7(3)(d.1): Disclosure to another organization for breach or contravention investigations

Section 7(3)(d.1), added by the Digital Privacy Act in 2015, permits disclosure of personal information without consent when it is "made to another organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province that has been, is being or is about to be committed and it is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation."

This exception replaced PIPEDA's previous "designated investigative body" regime (which maintained a public list of investigative bodies to whom disclosures could be made). Under section 7(3)(d.1), an organization may now disclose to any other organization—not only to government investigative bodies—when the conditions are met. The OPC's March 2017 guidance document Applying paragraphs 7(3)(d.1) and 7(3)(d.2) of PIPEDA emphasizes that this change increases accountability obligations because there is no longer a publicly verifiable list of permissible recipients.

The four statutory conditions

1. The disclosure is made to another organization. "Organization" is defined in section 2(1) of PIPEDA to include associations, partnerships, persons (including sole proprietorships), and trade unions. The recipient may be a private-sector fraud analytics firm, an industry consortium investigating coordinated fraud schemes, a financial institution coordinating with other banks to trace money-laundering networks, or an insurance company investigating suspected collusion with a claimant. The exception does not permit disclosures to government institutions—those are governed by separate exceptions under section 7(3)(c), (c.1), (c.2), or (d).

2. The disclosure is reasonable for investigating a breach of an agreement or a contravention of law. The same "specific suspected breach or contravention" requirement that applies under section 7(1)(b) applies here. The disclosure must be reasonably related and proportionate to the investigation. The OPC's March 2017 guidance states: "Organizations should be able to demonstrate, if/when called upon to do so, how each disclosure is reasonable for the stated purposes." Over-disclosure of unrelated information (for example, disclosing an entire customer account history when the investigation concerns only a single disputed transaction) violates the exception and triggers liability under Principle 4.5 (limiting use and disclosure to identified purposes).

3. The breach or contravention has been, is being, or is about to be committed. Section 7(3)(d.1) covers past, ongoing, and imminent contraventions. The organization must have formed a reasonable belief that the breach or contravention falls into one of these three temporal categories. Purely speculative disclosures based on theoretical future fraud scenarios do not qualify.

4. It is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the investigation. This is the "would compromise" gateway, and the OPC interprets it narrowly. In its March 2017 guidance, the OPC states: "Before disclosing personal information under paragraph 7(3)(d.1), an organization must turn its mind to and have formed a reasonable expectation that disclosure with the knowledge or consent of the individual would compromise the investigation." The compromise must be specific to the individual and the investigation at hand—not a generalized assertion that fraud investigations always require secrecy. Typical scenarios that satisfy the test: notifying the individual would allow them to move funds offshore, destroy evidence, intimidate witnesses, or coordinate a cover-up with co-conspirators.

## Section 7(3)(d.2): Disclosure to another organization for fraud detection, suppression, or prevention

Section 7(3)(d.2), also added in 2015, permits disclosure without consent when it is "made to another organization and is reasonable for the purposes of detecting or suppressing fraud or of preventing fraud that is likely to be committed and it is reasonable to expect that the disclosure with the knowledge or consent of the individual would compromise the ability to prevent, detect or suppress the fraud."

Section 7(3)(d.2) is broader in scope than section 7(3)(d.1) because it permits disclosures for detecting, suppressing, and preventing fraud—not only for investigating an already-suspected fraud. This exception is commonly invoked by financial institutions participating in fraud-detection consortia, insurers pooling claims data to identify patterns of insurance fraud, and e-commerce platforms sharing account-takeover indicators with payment processors.

The four statutory conditions

1. The disclosure is made to another organization. Same definition and scope as section 7(3)(d.1).

2. The disclosure is reasonable for detecting, suppressing, or preventing fraud. "Fraud" is not defined in PIPEDA. The OPC and courts interpret it in accordance with its ordinary legal meaning: dishonest conduct intended to deprive another of property or a legal right, typically encompassing fraud under section 380 of the Criminal Code, insurance fraud, identity theft, payment-card fraud, account takeover, and phishing schemes. The disclosure must be reasonably tailored to the fraud-detection purpose. The OPC's March 2017 guidance states: "Organizations must ensure that disclosures of personal information for the purposes of detecting or suppressing fraud or of preventing fraud are reasonably related and proportionate to a specified purpose and should not over-reach in their scope."

3. The fraud is being detected or suppressed, or is likely to be committed and the disclosure is for prevention. Unlike section 7(3)(d.1), which requires that the contravention "has been, is being, or is about to be committed," section 7(3)(d.2) permits disclosures to prevent fraud that is likely to be committed—a somewhat lower threshold that permits preventive fraud analytics. The organization must demonstrate that the fraud scenario is likely (more than speculative) based on indicators such as transaction patterns, device fingerprints, IP geolocation anomalies, or behavioral analytics.

4. It is reasonable to expect that disclosure with the knowledge or consent of the individual would compromise the ability to prevent, detect, or suppress fraud. The "would compromise" gateway applies with equal force to section 7(3)(d.2). The OPC's March 2017 guidance emphasizes: "Organizations must ensure that the precise requirements set out in the relevant paragraph have been met and should document their rationale before initiating a disclosure." The compromise test is met when notifying the individual would alert fraudsters to the detection mechanism, allowing them to adapt their tactics, switch accounts, or cease the fraud temporarily to evade detection. For example, a bank disclosing transaction data to a fraud-analytics consortium to identify synthetic-identity fraud satisfies the test because notifying each account holder of the disclosure would reveal the detection methodology to any fraudsters in the data set, compromising the fraud-prevention system.

## The OPC's March 2017 guidance: accountability, documentation, and transparency safeguards

In response to concerns that sections 7(3)(d.1) and 7(3)(d.2) permit "invisible" disclosures without transparency or oversight, the OPC issued comprehensive guidance in March 2017 (Applying paragraphs 7(3)(d.1) and 7(3)(d.2) of PIPEDA) setting out mandatory accountability measures:

1. Document the rationale before disclosure. "Organizations must ensure that the precise requirements set out in the relevant paragraph have been met and should document their rationale before initiating a disclosure." The documentation must show how the disclosure is reasonable, how the "would compromise" test is satisfied, and what information is being disclosed.

2. Do not take requests at "face value." When an organization receives a request for disclosure from another organization invoking section 7(3)(d.1) or (d.2), the recipient must independently verify that the conditions are met. The OPC states: "Claims from requesting organizations should not be taken at 'face value.' The organization receiving such requests should take certain measures, such as asking for and documenting the rationale and bona fide nature of a claim from the requesting organization."

3. Develop and publish policies. "An organization should develop policies and procedures setting out how it requests and/or responds to these disclosures. Organizations should be open about their policies and practices and make them available to individuals." Principle 4.8 (Openness) requires organizations to make information about their policies and practices available to individuals without unreasonable effort.

4. Train employees on an ongoing basis. "Any related policies and procedures should be accompanied with up-to-date training for employees on an on-going basis."

5. Consider transparency reporting. "Organizations could further consider reporting publicly on the number and types of disclosures made on an annual or semi-annual basis, using aggregate and anonymized data." This is a recommended (not mandatory) practice intended to provide public accountability without compromising ongoing investigations.

6. Honor data-subject access rights unless an exception applies. "Individuals generally have the right to access their personal information, including obtaining an account of the third parties to whom their personal information has been disclosed. Organizations must provide access to personal information on request, unless an exception under PIPEDA applies." Section 9(2)(b) permits an organization to refuse access if providing access would reveal confidential commercial information, and section 9(2.2) permits refusal if providing access could reasonably be expected to threaten the safety or physical or mental health of the individual or another individual. Organizations relying on sections 7(3)(d.1) or (d.2) must analyze whether an access-request exception applies on a case-by-case basis—the mere fact that a disclosure was made under section 7(3)(d.1) or (d.2) does not automatically exempt the organization from the duty to provide an account of disclosures under Principle 4.9.

## Section 7.1: Prohibition on reliance for address-harvested and spyware-collected information

Section 7.1, added in 2014 when Canada's Anti-Spam Legislation (CASL) came into force, strips sections 7(1)(b), 7(2), and 7(3)(d.1) and (d.2) of effect when the personal information was collected by address harvesting or spyware. Section 7.1(2) states:

> Paragraphs 7(1)(a), (c) and (d) and (2)(a) to (c.1) and the exception set out in clause 4.3 of Schedule 1 do not apply in respect of: > (a) the collection of an individual's electronic address, if the address is collected by the use of a computer program that is designed or marketed primarily for use in generating or searching for, and collecting, electronic addresses; or > (b) the use of an individual's electronic address, if the address is collected by the use of a computer program described in paragraph (a).

Section 7.1(1) extends the same prohibition to the collection or use of personal information "by means of accessing a computer system in contravention of an Act of Parliament" (spyware and unauthorized computer access).

Practical impact: no fraud-detection exception for harvested email lists

Even if an organization's purpose is legitimate fraud detection under section 7(3)(d.2), the organization cannot rely on that exception if the email addresses or other personal information were collected via address-harvesting software (web scrapers, dictionary-attack generators, email-address harvesters). The OPC's PIPEDA Report of Findings #2016-003 (Compu-Finder) illustrates the application. Compu-Finder used address-harvesting software to compile approximately 170,000 email addresses between 2012 and 2014, then sold access to this database to third-party marketers. Compu-Finder argued that some of its email campaigns were "entirely business-to-business" and that it was exempt under section 4.01 (the business-contact-information carve-out). The OPC held that section 7.1(2) barred reliance on any PIPEDA exception—including the section 7 fraud-detection exceptions—for addresses collected via harvesting software. The Commissioner stated: "Even if the e-mail addresses could be considered 'publicly available', we note that Compu-Finder would not be entitled to rely on this exemption for the e-mail addresses it obtained through the use of address harvesting software pursuant to paragraphs 7.1(2) of the Act."

Organizations that purchase email lists from third-party vendors bear the risk that the list was compiled through address harvesting. The OPC's Helpful tips for businesses doing e-marketing states plainly: "When buying a list of addresses from a vendor or employing a firm to conduct e-marketing on your behalf, be sure to ask: Where do they get e-mail addresses and how were they gathered? … Even when your organization relies on a third-party to collect e-mail address lists for marketing purposes, you are responsible for ensuring that appropriate consent is obtained." If the vendor harvested the addresses, the purchasing organization cannot rely on section 7(3)(d.2) to disclose those addresses to a fraud-detection consortium, even if the disclosure would otherwise satisfy the "would compromise" test.

## Interaction with subsection 5(3): the "appropriate purposes" independent gate

Even when an organization satisfies all four conditions of section 7(3)(d.1) or (d.2), the disclosure must still pass the independent "appropriate purposes" test in subsection 5(3), which states: "An organization may collect, use, or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances." The OPC's March 2017 guidance reminds organizations: "Even though information-sharing may occur in specified circumstances without consent, an organization is still required to fulfill its other PIPEDA obligations, including but not limited to, limiting the disclosure of personal information, safeguarding it, and ensuring that any disclosure of personal information is only for purposes that a reasonable person would consider are appropriate in the circumstances."

The OPC's May 2018 Guidance on inappropriate data practices identifies a five-factor balancing test for subsection 5(3): (1) the sensitivity of the information; (2) whether the purpose represents a legitimate need / bona fide business interest; (3) whether the disclosure would be effective in meeting the need; (4) whether there are less invasive means of achieving the same ends at comparable cost and with comparable benefits; and (5) whether the loss of privacy is proportional to the benefits. Disclosure of highly sensitive information (medical records, biometric templates, financial transaction histories) for fraud detection requires a correspondingly high showing of necessity and proportionality.

## Practical compliance takeaways

• Document the "would compromise" analysis before every disclosure. The OPC expects organizations to maintain contemporaneous records showing why notifying the individual would compromise the investigation or fraud-detection activity on the specific facts of the case. Generic boilerplate assertions do not satisfy the standard.

• Tailor disclosures to the minimum necessary. Sections 7(3)(d.1) and (d.2) do not authorize bulk data-sharing. Disclose only the personal information that is reasonably related and proportionate to the specific breach investigation or fraud-detection purpose.

• Verify requests received from other organizations. Do not take the requesting organization's assertion of section 7(3)(d.1) or (d.2) applicability at face value. Ask for and document the rationale, the specific breach or fraud being investigated, and the basis for the "would compromise" claim.

• Publish a transparency policy. Draft and make publicly available a policy describing the organization's approach to sections 7(3)(d.1) and (d.2) disclosures—including the types of investigations or fraud-detection activities that may trigger disclosures, the categories of recipient organizations, and the safeguards applied. The OPC encourages aggregate annual reporting (number of disclosures by category) to enhance public accountability.

• Screen third-party data sources for address harvesting. If your organization acquires email lists, device identifiers, or other personal information from vendors, conduct due diligence to verify that the information was not collected via address-harvesting software or spyware. Section 7.1 bars reliance on section 7 exceptions (including fraud-detection exceptions) for harvested information, and the purchasing organization bears vicarious liability under Principle 4.1.3 (accountability for third parties).

• Remember that sections 7(3)(d.1) and (d.2) do not exempt you from other PIPEDA principles. You must still implement safeguards proportionate to sensitivity (Principle 4.7), limit retention to the minimum necessary (Principle 4.5), and honor data-subject access rights unless a specific access-request exception in section 9 applies.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, sections 7(1)(b), 7(3)(d.1), 7(3)(d.2), 7.1 Source: Applying paragraphs 7(3)(d.1) and 7(3)(d.2) of PIPEDA, Office of the Privacy Commissioner of Canada (March 2017) Source: PIPEDA Report of Findings #2016-003 (Compu-Finder), Office of the Privacy Commissioner of Canada

Subsection 5(3) of PIPEDA imposes a foundational gatekeeper on all personal information processing by private-sector organizations in Canada: “An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances.” (S.C. 2000, c. 5, s. 5(3)). This “appropriate purposes” test applies in addition to any consent requirement or statutory exception, and overrides even express, meaningful consent.

Key takeaway:

• Obtaining valid consent (express or implied, under s.6.1) does not render any and all purposes lawful. If a purpose is not “appropriate” under subsection 5(3), it is prohibited—regardless of what the individual agreed to.

The OPC Guidance (May 2018): “Inappropriate Data Practices” and ‘No-Go Zones’

• In 2018, the Office of the Privacy Commissioner (OPC) issued binding interpretative guidance that clarified how s.5(3) is applied. Organizations must assess proposed processing against a five-factor balancing test:

1. The degree of sensitivity of personal information involved.
2. Whether the purpose represents a legitimate need / bona fide business interest.
3. Whether the collection, use and disclosure would be effective.
4. Whether there are less invasive means of achieving the same ends at comparable cost and benefits.
5. Whether the loss of privacy is proportional to the benefits to the organization/individual/public.

• The OPC identifies specific “no-go zones”—practices which are offside s.5(3) even with consent:
• Collection/use/disclosure that is otherwise unlawful.
• Profiling or categorization that results in unfair, unethical or discriminatory treatment under human rights law.
• Collection for purposes that are known or likely to cause significant harm.
• Publishing personal information (e.g. mugshot websites) and charging for its removal.
• Demanding social media passwords from job applicants/employees.

OPC Enforcement: Federal Court recognition

• The Federal Court has affirmed that subsection 5(3) is a substantive, independent requirement: consent cannot override the “appropriate purposes” gate. In T (A) v. Globe24h.com (2017 FC 114), the Court held that republishing tribunal decisions (including sensitive personal information) for profit, and charging for removal, was not an appropriate purpose—even with notional “consent.”

• The OPC’s Report of Findings #2018-005 (Google “This is Your Digital Life” app) and #2003-192 (bank using opt-out for sensitive financial data) further show practices found non-compliant because the end purpose failed the 5(3) standard.

Compliance Steps:

• Review all information processing for reasonableness and necessity, not just consent.
• Document the balancing of the five OPC factors for any novel, high-impact, or high-risk data uses.
• Be aware of “no-go zones” even in consent flows; consent screens cannot justify inherently inappropriate purposes.

Subsection 5(3) applies to all organizations subject to PIPEDA, including those processing personal information about non-Canadians if the processing is in connection with the commercial activities of a Canadian organization.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 5(3) Source: Guidance on inappropriate data practices, Office of the Privacy Commissioner of Canada, May 2018

PIPEDA permits organizations to collect, use, and disclose personal information without knowledge or consent if the information is "publicly available" as prescribed by regulation, and the collection, use, or disclosure relates directly to the purpose for which the information appears in the public record. The core statutory authorities are sections 7(1)(d) (collection), 7(2)(c.1) (use), and 7(3)(h.1) (disclosure).

Regulatory definition: what counts as "publicly available information"

The Regulations Specifying Publicly Available Information (SOR/2001-7) enumerate specific categories, including:

• Personal information in a telephone, professional, or business directory available to the public (if the individual provided the information for inclusion).
• Personal information in public registries or records required by law to be accessible by the public (e.g., land title registries, statutes, court documents where public access is provided by law).
• Personal information appearing in records of quasi-judicial bodies or professional regulators (where disclosure is required by law).
• Personal information published in a magazine, book, or newspaper, written by the individual.
• Personal information intended by the individual to appear in a public online space (if inclusion was voluntary and for public presentation).

This regulatory list is closed. If information does not fall within one of the enumerated categories, the exception does not apply, and standard consent requirements remain.

Limits and compliance risks

Critically, the collection, use, or disclosure must "relate directly to the purpose for which the information appears"—a significant restriction that the Office of the Privacy Commissioner (OPC) has enforced strictly. For example, scraping professional directories for commercial marketing, when individuals did not provide their information for that purpose, is outside the exception. Similarly, republishing content from public registries for uses untethered to the original purpose (such as publication on mugshot websites or for debt collection unrelated to the registry’s function) is not permitted without consent. The OPC, in its interpretation bulletin, has repeatedly emphasized that the "purpose" clause is not met by mere public availability; the use must be the same as or closely aligned with the one for which the record exists.

In PIPEDA Findings #2020-002 (RateMDs), the Office of the Privacy Commissioner found that while a physician’s address from a college registry was publicly available, its use on a reputation website was not sufficiently related to the original registry’s professional communication purpose to qualify for the exception. The Commissioner also notes organizations must verify that the data source truly falls under a regulated category and that the individual volunteered the information for the public purpose.

Practical compliance

• Confirm the data source is listed in the regulations—a third-party aggregator, even if publicly accessible, usually does not qualify.
• Tie use or disclosure to the original public purpose: avoid secondary marketing, repurposing for analytics, or scraping directories for unrelated commercial uses.
• Documentation: Keep records showing your assessment of fit with the regulation and statutory requirements.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7 Source: Regulations Specifying Publicly Available Information (SOR/2001-7) Source: PIPEDA Interpretation Bulletin: Publicly Available Personal Information, OPC

PIPEDA provides a narrowly tailored exception allowing organizations to use or disclose personal information for statistical, scholarly study, or research purposes without knowledge or consent, provided strictly enumerated conditions are met. The relevant statutory authority is section 7(2)(c) (for use) and section 7(3)(f) (for disclosure).

Section 7(2)(c): Research use without consent An organization may use personal information without knowledge or consent if:

• The use is for statistical, scholarly study, or research purposes;
• The purpose cannot be achieved without using the information in an identifiable form (i.e., de-identified or aggregate data would not suffice);
• It is impracticable to obtain consent (for example, due to the size or age of the data set);
• The organization informs the Office of the Privacy Commissioner of Canada (OPC) before the information is used;
• The organization complies with any prescribed regulations (as of June 2026, no additional federal regulations have been prescribed for this subsection);
• The information will not be used or disclosed for any purpose other than the research purpose, and will not be used or disclosed in a way that affects the individual to whom it relates;
• The organization complies with any conditions imposed by the OPC (in practice, notification is required, and the OPC may follow up or issue advice, though formal review is uncommon).

Section 7(3)(f): Research disclosure without consent Disclosure to a third party for statistical, scholarly study, or research purposes is also allowed without consent, but is subject to the same stringent conditions:

• The disclosure is for the research purpose;
• It is impracticable to obtain consent;
• The organization informs the OPC before the disclosure;
• The organization enters into a data-sharing agreement requiring the recipient to use the information only for research, to safeguard it, and to refrain from attempting to identify or contact individuals;
• The use or disclosure must not affect the individual directly;
• The organization complies with any additional regulations or OPC-imposed conditions (again, as of June 2026, no detailed federal regulations exist for this paragraph).

Key requirements and compliance steps:

• Prior notification to the OPC is mandatory. This notification must precede the use or disclosure, and organizations should retain documentary proof of notification.
• The "impracticability" test sets a high bar: the OPC expects organizations to seriously consider whether consent can reasonably be sought before invoking this exception. High volume, age of records, or inability to locate individuals are the standard grounds for impracticability.
• Strict confidentiality and data minimization must be built into any research use or sharing. Aggregate or de-identified data should be used wherever possible; identifiable data is permitted only where necessary.
• Use/disclosure must not impact individuals—no research result or application can lead to decisions about or adverse effects on a particular person.

Provincial landscape: Alberta and British Columbia PIPA statutes contain parallel, but not identical, research-use provisions; Quebec's Law 25 has its own research framework now requiring privacy impact assessments. Organizations under provincial law should review the applicable requirements.

OPC Guidance and Practice: While PIPEDA prescribes notification and contractual requirements, it delegates the practical details—such as confidentiality commitments and audit provisions—to the data-sharing agreement and OPC advice. The OPC may issue further guidance; organizations should monitor for changes.

Enforcement posture: OPC enforcement in this area historically focuses on organizations that skip the notification requirement or repurpose research data for secondary, non-research uses. Organizations misusing research as a backdoor for marketing or customer analytics have faced negative findings.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7

Section 7.3 of PIPEDA creates a specific carve-out for federally regulated workplaces, allowing organizations to collect, use, or disclose employee personal information without consent if the activity is "necessary to establish, manage, or terminate an employment relationship" (S.C. 2000, c. 5, s. 7.3). This provision is crucial for banks, telecommunications carriers, airlines, and other federal undertakings that operate interprovincially or across borders, and has significant compliance implications given Canadian employee data often flows outside Canada in multinational groups.

## When does s.7.3 apply? Section 7.3 applies only to organizations subject to PIPEDA as federally regulated works, undertakings, or businesses (WUBs) and their employee personal information. Most provincially regulated private-sector employers fall under substantially similar local laws (Alberta PIPA, BC PIPA, Quebec Law 25).

The exception removes the obligation to obtain consent, but imposes limits and safeguards:

• The collection, use, or disclosure must be necessary for establishing, managing, or terminating the employment relationship (not for secondary, tangential, or future-anticipated uses).
• The activity must relate to employees, not customers, contractors, or job applicants unless the applicant is being considered for employment.

Notice is still required—the employer must notify employees that their personal information could be collected, used, or disclosed without consent for these purposes (s.7.3(2)).

## OPC Guidance The Office of the Privacy Commissioner (OPC) has clarified that s.7.3 is not a blanket waiver: uses must be demonstrably related to HR administration (payroll, benefits, performance management, discipline, and termination) or to legal obligations arising from the employment contract. Using employee data for marketing, analytics, post-employment alumni tracking, or third-party vendor profiling is not covered. The OPC’s interpretation bulletin underscores that organizations must document the necessity and ensure data minimization.

## Limits

• Disclosure for non-HR purposes or to third parties for unrelated business needs requires employee consent.
• Employee monitoring (such as email or device surveillance) must be necessary—with proportionality assessed per s.5(3) "appropriate purposes" gate.
• This exception does not override breach notification obligations, access rights, or security safeguard requirements. All core PIPEDA principles still apply.

## Cross-border context This statutory exception often triggers in cross-border HR operations, payroll outsourcing, and internal investigations. The necessity and notice requirements must be strictly documented, and organizations should ensure onward transfers to foreign affiliates or vendors are limited to what is required for the employment purpose and that employee rights under s.8 (access/correction) are maintained.

## Provincial law overlay In Alberta and BC, similar exceptions are codified directly for all employers (see s.15 of Alberta PIPA and s.13 of BC PIPA). In Quebec, Law 25 imposes its own requirements for employee data; employers should consult local guidance.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7.3

The previously cited OPC Interpretation Bulletin link was dead and has been replaced by the operative statutory text. No material change to authority—only the link was updated as of this review.

Under PIPEDA, the right to withdraw consent is foundational but not absolute: Principle 4.3.8 of Schedule 1 states plainly, "An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice." This carve-out is critical for organizations in finance, healthcare, telecommunications, and any sector facing statutory or regulatory retention duties: it is the primary basis on which an organization may refuse or delay withdrawal even after valid, meaningful consent was originally obtained.

1. Legal restrictions: override by statute, regulation, or court order Legal restrictions refer to obligations imposed by Canadian federal or provincial law, or by valid court orders, that require an organization to maintain, use, or disclose certain personal information. Typical examples include:

• Financial institutions’ duty to report customer credit data to credit bureaus under provincial credit reporting acts (see OPC Case #2003-211, bank refusal to delete overdraft information).
• Anti-money laundering (AML) recordkeeping requirements under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, mandating retention of financial transaction records for fixed periods.
• Statutory or regulatory obligations for record retention in health care (hospital record-keeping standards, professional college codes).
• Tax law (Income Tax Act retention periods and production-on-request obligations).
• Federal court orders or administrative subpoenas compelling maintenance or provision of records.

When a legal restriction applies, the organization must identify the specific law or order that demands continued use or retention and document how the restriction applies to each piece of personal information at issue. The Office of the Privacy Commissioner (OPC) has repeatedly held that organizations bear the burden of demonstrating the legal requirement and must cite the statute, regulation, or order. Blanket statements or vague references to “legal restrictions” are insufficient in both complaint investigations and court review.

2. Contractual restrictions: narrow construction, legitimate necessity Contractual restrictions mean obligations arising from an active contract between the individual and the organization—typically, when the continued use of data is necessary to fulfill an agreed service or obligation. The clearest example is staged payment services (subscription businesses, installment credit): an individual who withdraws consent to the use of payment data before the end of a contract term generally cannot require deletion or cessation of processing that is genuinely necessary to complete the contractual obligation. The OPC’s practice is to read contractual necessity narrowly: only data demonstrably required to fulfill the contract can be retained or used. Routine retention of data "just in case," or for secondary marketing or analytics post-relationship, is not protected.

3. Organizational burden of proof and notification If an organization refuses or delays withdrawal on legal or contractual grounds, it must explain the specific basis to the individual and document the analysis internally. The OPC’s guidance and decisions, including in Case #2003-211, consistently state that "the onus is on the organization" to justify the refusal and to inform the individual of the specific implications, including expected timelines for deletion or cessation once the legal or contractual restriction no longer binds.

4. Examples from OPC findings

• In Case #2003-211, a bank lawfully refused to withdraw consent for credit reporting on overdrafts, citing a statutory obligation under the provincial credit reporting act and industry retention standards.
• In multiple telecom cases, providers have relied on the CRTC’s customer-record retention regulations to deny immediate data deletion.
• The OPC’s bulletin on consent stresses that organizations should design processes to reassess and fulfill withdrawal requests as soon as the legal or contractual restriction lapses.

This legal-contractual carve-out also exists in Alberta PIPA and BC PIPA; in Quebec’s Law 25, the retention and withdrawal rules are set specifically by statute and mirrored in CAI guidance.

Source: Personal Information Protection and Electronic Documents Act (PIPEDA), S.C. 2000, c. 5, Schedule 1, Principle 4.3.8 Source: PIPEDA Case Summary #2003-211, Office of the Privacy Commissioner of Canada

PIPEDA does not list "international transfer" as a separate lawful basis. Rather, the same consent or exception that permits collection, use, or disclosure domestically applies regardless of whether the processing occurs in Canada or abroad. However, cross-border transfers trigger special accountability and transparency requirements, particularly as personal information routinely moves to U.S. or other foreign service providers.

## Section 4.1.3: Accountability for onward transfers

Section 4.1.3 of Schedule 1 establishes the accountability principle: "An organization is responsible for personal information in its possession or custody, including information that has been transferred to a third party for processing. The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party." This means that organizations transferring personal information across borders must ensure—usually by contract with the foreign processor—that the information is protected to a standard similar to PIPEDA, even outside Canada.

The Office of the Privacy Commissioner of Canada (OPC) has consistently interpreted "transfer for processing" to fall within the original purpose for which the personal information was collected. The OPC's principal guidance (originally 2009, reaffirmed in 2019 after public consultation) states: "A transfer of personal information for processing does not require additional consent beyond that which the organization has already obtained for the collection, use, and disclosure. However, organizations must inform individuals that their information may be sent outside Canada and may be accessible to law enforcement and national security authorities in the foreign jurisdiction."

## Key compliance requirements

• No new consent required solely for a transfer: As long as the personal information is processed only for the original collected purpose, transferring it to a processor outside Canada does not require new or separate consent. Doing otherwise (i.e., processing for a materially different purpose) would require fresh consent or another PIPEDA exception.
• Transparency is mandatory: Organizations must notify individuals in their privacy policies and at collection if personal information will be transferred outside Canada for processing. The OPC expects "clear and understandable" language that names the countries involved, the types of processing, and the risk that foreign authorities may access the information.
• Onward-contract requirement: The transferring Canadian organization must impose—usually by contract—requirements on the foreign recipient to provide protection comparable to PIPEDA (data security, data use restrictions, breach notification to the Canadian controller, onward-transfer restrictions, etc.).
• No adequacy determination under PIPEDA: Unlike GDPR, PIPEDA does not require the recipient country to be "adequate," nor does it ban transfers based on a country's legal framework. The obligation is on the Canadian organization to ensure effective protection contractually and to notify individuals about foreign-processing impacts.

## Enforcement

The OPC has enforced the requirement that organizations be able to demonstrate both (a) due diligence on third-party processors and (b) effective transparency to individuals. In several findings, the OPC found organizations in breach for failing to properly disclose foreign outsourcing arrangements or for failing to include appropriate contractual protections. Notably, where information is used by a third party for its own purposes (not just processing), this constitutes a "disclosure" under PIPEDA and brings consent or an explicit exception into play (see OPC Finding #2019-003: "transfer for processing" vs. "disclosure").

## Provincial overlays

Alberta and Quebec require notification at or before transfer outside Canada (AB PIPA s.13.1, QC Law 25). Quebec, post-Law 25, now requires a transfer impact assessment. PIPEDA-covered entities operating in these provinces must meet both federal and provincial transparency and due diligence requirements.

## Practical compliance takeaways

• Name the countries of primary processing (not just "outside Canada") in the privacy notice.
• Ensure all vendor and affiliate contracts include PIPEDA-comparable protection clauses.
• Monitor for legal or contractual changes that may affect "comparable protection" status (e.g., significant changes to foreign law or government access regimes).
• If the processor uses the data for its own purposes (not on behalf of the Canadian organization), that is a "disclosure" and triggers separate consent or exception analysis.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, section 4.1.3 Source: Guidelines for processing personal data across borders, Office of the Privacy Commissioner of Canada Source: Consultation on transborder dataflows, Office of the Privacy Commissioner of Canada

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), "performance of a contract" is not recognized as an independent lawful basis for processing personal information. This is a critical distinction from the EU General Data Protection Regulation (GDPR) and the UK GDPR, both of which list “performance of a contract to which the data subject is party” as a standalone legal ground (Art. 6(1)(b) GDPR). In Canada, the baseline rule is that organizations must obtain the knowledge and meaningful consent of the individual for any collection, use, or disclosure of personal information in commercial activities (Schedule 1, Principle 4.3; section 6.1). Consent remains the rule unless a statutory exception in section 7 applies.

What this means in practice: where a Canadian business wishes to process personal information solely because it is “necessary to fulfill a contract”—for example, to provide a service, ship goods, or administer an account—it must still obtain either express or implied consent, subject to the sensitivity of the information and the reasonable expectations of the individual. There is no general “contractual necessity” carve-out as in the EU. Exceptions under section 7 (such as emergency situations, law enforcement, or publicly available information) must be invoked specifically and narrowly, and do not replicate GDPR’s contract ground.

PIPEDA does treat contractual necessity as a limit on the withdrawal of consent (Principle 4.3.8); individuals may not withdraw consent where ongoing processing is required to fulfill an existing contract, but that is a restriction on the right to object, not an affirmative basis for processing in and of itself. Similarly, “contractual restrictions” justify certain refusals of data deletion or withdraw—but only to the extent the information is objectively required to fulfill the contract (see the guide’s section on withdrawal of consent for detail).

This approach frequently surprises organizations operating cross-border. A Canadian entity handling both EU and Canadian residents must structure its privacy notices and operational flows to address this divergence: it must not rely on “contract performance” for Canadian processing, but rather document consent or a narrow PIPEDA exception.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, Principle 4.3; section 6.1

PIPEDA imposes heightened requirements for obtaining valid consent to collect, use, or disclose the personal information of children and youth, but it does not set a statutory age threshold at the federal level. The baseline rule—codified in Schedule 1, Principle 4.3 and section 6.1—remains: consent must be meaningful, and the individual must have the capacity to understand the nature, purpose, and consequences of the collection, use, or disclosure. Where capacity is lacking, organizations must seek consent from a parent or legal guardian.

OPC guidance and its practical effect The Office of the Privacy Commissioner of Canada (OPC) interprets meaningful consent for children through both its 2018 Guidelines for obtaining meaningful consent and public statements. The OPC’s position is that, in all but exceptional circumstances, individuals under age 13 are unable to provide meaningful consent for themselves. Organizations offering services to or knowingly collecting personal information from users under 13 must obtain consent from a parent or legal guardian. For youth aged 13 to 17, organizations must evaluate—contextually and with care—whether the youth has the maturity to understand the key elements of meaningful consent (nature of the information collected, purposes, third-party disclosures, and residual risks). In such cases, the consent process must use plain, age-appropriate language and be tailored to the youth’s maturity level.

How the meaningfulness and sensitivity tests interact Children’s information is generally considered sensitive under OPC guidance (see the guide’s section on “Sensitive personal information — the contextual test…”). For sensitive information, Principle 4.3.6 and the OPC’s interpretation bulletins require express, opt-in consent. Organizations collecting data from children should design flows that combine bright-line parental/guardian consent for under-13s, age-tailored consent for older youth where capacity is demonstrated, and easy mechanisms for parental withdrawal in all cases.

Action points for organizations

• Seek parental or guardian consent for users under 13.
• Use plain-language, age-appropriate notices for users 13–17; require parental consent if any doubt about capacity remains.
• Treat information about children as sensitive requiring express consent and heightened safeguards.
• Design withdrawal and correction mechanisms that are accessible to parents and guardians.

Provincial overlay Alberta and BC PIPA do not set a fixed age but follow the contextual capacity approach (with guidance from provincial commissioners). Quebec Law 25 requires express parental consent for children under 14, effective as of September 2023.

Enforcement posture The OPC has brought enforcement actions (see the youth-targeted social media and gaming investigations in 2021–2023) against platforms failing to implement adequate consent and verification mechanisms. While not mandated by statute, the “under 13 = parent/guardian” rule is widely applied by the OPC and used in compliance assessments and findings.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, Schedule 1, Principle 4.3 Source: Guidelines for obtaining meaningful consent, Office of the Privacy Commissioner of Canada (2018) Source: Children and PIPEDA, Office of the Privacy Commissioner of Canada

Section 7(3)(c) of PIPEDA permits organizations to disclose personal information to a government institution without the individual's knowledge or consent if certain statutory conditions are met. This exception most commonly applies to disclosures to police, national security agencies, CRA, competition authorities, securities regulators, and other federal or provincial enforcement bodies. It is one of the major lawful bases for compelled or voluntary disclosure beyond the consent model, but its triggers, compliance steps, and limitations are distinct from other section 7 exceptions (such as contract breach or fraud).

## Statutory framework — section 7(3)(c) and related paragraphs

Under section 7(3), an organization may disclose personal information without knowledge or consent if:

• The disclosure is made to a government institution (federal, provincial, or municipal), or a part of a government institution;
• The organization has reasonable grounds to believe the information relates to a contravention of the laws of Canada, a province, or a foreign jurisdiction, that has been, is being, or is about to be committed; OR
• The government institution has identified its lawful authority to obtain the information and indicated that the disclosure is requested for law-enforcement, national security, or administration of law purposes.

Section 7(3)(c.1) and (c.2) create parallel exceptions for government institutions with statutory investigative powers (such as CSIS, FINTRAC, or the RCMP operating under specific statutes).

In addition, disclosures may be compelled by court order, subpoena, or warrant under section 7(3)(c), overriding any consent requirement. When compelled, organizations have little discretion except to verify the legal validity of the order.

## OPC guidance and compliance measures

The Office of the Privacy Commissioner of Canada (OPC) emphasizes that:

• The “reasonable grounds” criterion requires the organization (not just the requesting agency) to assess whether it is likely the information relates to an identified contravention. The threshold is not suspicion alone—OPC expects organizations to document the facts that support disclosure.
• Disclosures to government bodies should be as limited as possible—only the information reasonably necessary for the stated law-enforcement purpose.
• Organizations should not take government requests at face value; they must verify the lawful authority, scope, and document decision-making. Bulk or speculative disclosures are not justified.

OPC’s "Guidelines for Processing Personal Data Across Borders" (2019 update) recommend documenting all disclosures to government institutions, including: the requestor, the legal authority cited, date/time/request specifics, information disclosed, and internal assessment notes. Organizations should also update their privacy policies to inform individuals of the potential for such disclosures (as a transparency best practice, though not a statutory requirement).

## Notification and access rights — practical limits

Unlike breach-notification rules, PIPEDA does not require organizations to notify individuals at the time of law enforcement disclosure. However, under Principle 4.9 (access rights), individuals may later request an account of such disclosures. Section 9(2.3) allows organizations to refuse disclosure if it could reasonably be expected to harm a criminal investigation or national security. Organizations should assess such requests case by case.

## Court orders and compelled disclosures

If a valid Canadian court order, warrant, or subpoena demands disclosure, organizations must comply, but should review the order for scope and legal sufficiency. Where in doubt, legal review is prudent.

## Cross-border requests

Section 7(3)(c) expressly includes foreign law enforcement, but the same “reasonable grounds” test and documentation requirements apply. OPC guidance underscores the need for careful assessment, particularly regarding MLAT (mutual legal assistance treaty) requests and requests from US agencies subject to the CLOUD Act.

Source: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5, s. 7(3)(c) Source: Guidelines for Processing Personal Data Across Borders, Office of the Privacy Commissioner of Canada (2019)