How Do Canadian Data Protection Laws Impact Your Association?
Navigating the landscape of data protection laws in Canada and how they apply to your association is like piecing together a complex puzzle, but it's a puzzle that holds the key to safeguarding your members' data.
In this guide, we'll simplify the essential data protection laws that directly impact your association's website, database, and web hosting. By unraveling these laws in plain language, you can ensure compliance and fortify your association against potential risks.
Understanding Canada's Data Protection & Compliance
In the digital age, where personal information flows freely, safeguarding data has never been more critical. Hosting and protection of Canadian data operates on multiple levels, from federal to provincial, and spans across various sectors, such as health privacy and consumer protection.
If your association's website offers a simple overview of services, refrains from sending email marketing, and doesn't store personal data, you might not need to delve deep into these regulations. However, it's still essential to be aware of data protection laws should your association start offering interactive tools and features.
Let's unravel key data protection laws that can affect your association:
Canada’s Anti-Spam Legislation (CASL)
Canada's Anti-Spam Legislation (CASL) regulates the sending of commercial electronic messages (CEMs), including promotional emails and text messages. CASL applies to associations with individual members as well as those with organizational members. In general, commercial electronic messages require express or implied consent, identification of the sender and an unsubscribe mechanism. For qualifying non-profit associations, membership can establish an existing non-business relationship that permits implied consent. This consent generally applies during an individual's membership and for up to two years after membership ends. Associations relying on implied consent must still comply with identification and unsubscribe requirements and maintain records supporting their right to send commercial messages.
For associations with organizational members, CASL may also apply to email communications sent to employees or representatives of those organizations. An organization's membership does not automatically establish consent to send commercial messages to every individual employed by that organization. However, CASL provides a business-to-business exemption when messages are exchanged between representatives of organizations that have an established relationship and the messages concern the recipient organization's activities. Where this exemption applies, the usual consent, identification and unsubscribe requirements do not apply. Associations should distinguish between communications related to an organizational membership and other promotional messages, as the applicable CASL requirements depend on the recipient, the existing relationship and the content of the message.
Personal Information Protection and Electronic Documents Act (PIPEDA)
Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) governs the collection, use and disclosure of personal information in the course of commercial activities. Associations with individual members are not automatically subject to PIPEDA simply because they collect and maintain personal information. For non-profit associations, routine activities such as collecting membership fees, maintaining member records, distributing newsletters and organizing member events generally do not trigger PIPEDA. However, certain commercial activities, such as selling or leasing membership lists, may bring those activities under the legislation. The determining factor is the nature of the activity, rather than the association's non-profit status.
For associations with organizational members, PIPEDA generally does not apply to information about corporations or other organizations themselves. However, records may contain personal information about individual representatives, employees or designated contacts. Business contact information, including names, job titles, work telephone numbers and business email addresses, is excluded from PIPEDA when used solely to communicate with individuals in relation to their employment, business or profession. Other personal information about these individuals may still be subject to PIPEDA when handled in the course of commercial activities. Associations should assess their privacy obligations based on the information collected, how it is used and whether applicable federal or provincial privacy legislation governs those activities.
General Data Protection Regulation (GDPR)
Extraterritorial Reach for International Memberships.
The General Data Protection Regulation (GDPR) is a European Union privacy law governing the collection, use, storage and processing of personal data. Although established in the EU, GDPR can also apply to organizations operating outside the EU, including Canadian associations. An association is not automatically subject to GDPR simply because some of its members are EU citizens or residents. However, GDPR may apply when an association offers membership services to individuals located in the EU or monitors their behaviour within the EU. Membership records containing names, email addresses, contact details, professional credentials and payment information are considered personal data under GDPR.
Canadian associations should assess whether their membership activities fall within GDPR's scope. Where GDPR applies, organizations must establish a lawful basis for processing personal data, provide clear privacy information, implement appropriate security measures and respect applicable individual rights, including access, correction and erasure of personal information. Additional obligations may include maintaining processing records, establishing data retention practices and meeting requirements for international data transfers. GDPR compliance depends on the association's activities and how personal data is processed, rather than the citizenship of its members alone.
Ontario's Personal Health Information Protection Act (PHIPA)
Governs the collection, use and disclosure of personal health information by health information custodians and certain organizations acting on their behalf. Associations with members who are healthcare professionals are not automatically subject to PHIPA. Membership records containing names, contact information, professional credentials, registration details and payment information generally do not qualify as personal health information simply because the members work in healthcare. PHIPA's applicability depends on the nature of the information and the organization's role in handling it.
An association may have obligations under PHIPA if it handles personal health information on behalf of a health information custodian or otherwise operates in a role covered by the legislation. Associations should distinguish between ordinary membership information and personal health information when determining their privacy obligations. Other privacy legislation, including the federal Personal Information Protection and Electronic Documents Act (PIPEDA), may also apply depending on the association's activities.
Quebec's Law 25
Quebec's Law 25 introduced significant changes to the province's privacy legislation, including the Act respecting the protection of personal information in the private sector. These changes establish requirements for how organizations collect, use, disclose, retain and protect personal information. Associations, including non-profit organizations, may be subject to these requirements if they carry on organized economic activities in Quebec. This can include associations based outside Quebec that conduct activities within the province. Membership information relating to identifiable individuals, such as personal contact details, registration records and payment information, may fall under the legislation. Information relating solely to an organization is generally not considered personal information, although information identifying its individual representatives may be protected, subject to exceptions for business contact information.
For associations subject to Law 25, obligations include appointing a person responsible for personal information protection, establishing privacy governance policies, implementing appropriate security measures and maintaining procedures for handling confidentiality incidents. Privacy impact assessments are also required in certain circumstances, including projects involving information systems that process personal information and disclosures of personal information outside Quebec. Individual and organizational members are not automatically subject to Law 25 simply because they belong to an association. However, organizational members and individuals operating businesses may have independent obligations based on their own activities in Quebec. Associations should assess their obligations separately from those of their members, considering the information they manage, their activities and the jurisdictions in which they operate.