# Standards and Regulatory References

## Primary Legislation

### Personal Information Protection and Electronic Documents Act (PIPEDA) — S.C. 2000, c. 5
- **Part 1, Division 1 (Sections 5-10)** — Protection of Personal Information: establishes obligations for collection, use, disclosure, retention, and accuracy
- **Part 1, Division 1.1 (Sections 10.1-10.3)** — Breach of Security Safeguards: mandatory breach reporting, notification, and record-keeping
- **Part 1, Division 2 (Sections 11-13)** — Complaints and Investigations: OPC complaint-handling powers
- **Part 1, Division 3 (Sections 14-17.2)** — Audits, Compliance Agreements, and Court Remedies
- **Section 5(3)** — Consent requirement for collection, use, or disclosure
- **Section 6.1** — Valid consent factors (reasonable person test, sensitivity, purpose clarity)
- **Section 7(1)-(3)** — Exceptions to consent (employment necessity, legal proceedings, journalistic purposes, publicly available information)
- **Section 8(3)-(8)** — Exceptions to disclosure requirements (national security, law enforcement, legal proceedings)
- **Section 9** — Individual access rights and grounds for refusing access
- **Section 10** — Compliance with CSA Model Code (Schedule 1)
- **Section 28** — Offences and penalties (max $100,000 CAD per offence)
- **Schedule 1** — CSA Model Code CAN/CSA-Q830-96 (10 fair information principles, Clauses 4.1-4.10)

### Digital Privacy Act — S.C. 2015, c. 32
- Amended PIPEDA to introduce mandatory breach reporting (Division 1.1)
- Added Section 6.1 on valid consent requirements
- Enhanced OPC compliance agreement powers (Section 17.1)
- Added record-keeping obligations for security breaches (Section 10.3)

## Regulations

### Breach of Security Safeguards Regulations — SOR/2018-64
- Prescribes content of breach reports to the OPC (Section 2)
- Prescribes content of individual notifications (Section 3)
- Specifies the 24-month record retention period for breach records (Section 4)
- Defines record-keeping requirements for all breaches regardless of RROSH determination

## OPC Guidance

### OPC Guidelines for Obtaining Meaningful Consent (2018)
- Seven guiding principles for valid consent under PIPEDA
- Emphasis on key elements, consumer control, and innovative consent mechanisms

### OPC Position on Cross-Border Transfer of Personal Information
- Organizations remain accountable under Principle 1 for transferred data
- Contractual or comparable protections required
- Transparency obligations about foreign jurisdiction access

### OPC Guidelines on Privacy and Online Behavioural Advertising (2023 update)
- Application of PIPEDA to tracking, profiling, and targeting
- Consent requirements for OBA technologies

## Provincial Substantially Similar Legislation

### Alberta — Personal Information Protection Act (PIPA, S.A. 2003, c. P-6.5)
### British Columbia — Personal Information Protection Act (PIPA, S.B.C. 2003, c. 63)
### Quebec — Act respecting the protection of personal information in the private sector (R.S.Q., c. P-39.1, as amended by Bill 64 / Act to modernize legislative provisions as regards the protection of personal information, S.Q. 2021, c. 25)

## International Standards

### ISO/IEC 27701:2019 — Privacy Information Management System (PIMS)
- Extension to ISO 27001/27002 for privacy management
- Maps to PIPEDA Schedule 1 principles

### APEC Cross-Border Privacy Rules (CBPR) System
- Canada is a participant in the APEC CBPR system
- CBPR certification provides a mechanism for demonstrating cross-border privacy compliance