Data Privacy Trends in Canada
2022 promises to be a packed year for data privacy legislation in Canada. In the year up to March 2021, the federal privacy commissioner had received 782 breach reports, affecting around nine million Canadian accounts. Meanwhile, the Canadian Center for Cyber Security reported 235 incidents of ransomware attacks against businesses.
Sensitive consumer data is more exposed than ever as people are more reliant on digital services due to the impact of COVID-19. According to one study, 50% of Canadians report making online purchases for items that they would typically have bought in-store.
Privacy Concerns around Digital Payments
Electronic and digital payment methods generally involve transmitting personal information electronically to other organizations, such as financial institutions and payment processing companies. While most organizations go to great lengths to ensure the security of these types of digital transactions, errors or breaches in security can occur.
Typically, electronic and digital payments involve a more complex exchange of purchase and other personal information from consumers to the retail business. For example, purchases can be associated with other information, such as consumer purchasing habits and location, thus increasing privacy concerns.
Personal information in electronic and digital payments should only be shared, traded or sold, in accordance with applicable privacy legislation.
Applicable Data Privacy Legislation in Canada
The Personal Information Protection and Electronic Documents Act, or PIPEDA, sets out ground rules for the management of personal information in the private sector.
PIPEDA applies across Canada to organizations that collect, use, or disclose personal information in the course of commercial activities unless provincial privacy legislation deemed substantially similar to PIPEDA applies. Quebec, Alberta and British Columbia each have substantially similar legislation privacy covering the private sector.
In all provinces, including provinces with substantially similar laws, PIPEDA continues to apply to companies engaged in interprovincial or international transactions and to all federally regulated organizations (such as banking and telecommunications).
In addition to privacy legislation, there are other rules and standards in place to promote the protection of your information when performing payments. This includes PCI DSS v4.0, a set of standards set by the payment card industry (Payment Card Industry Data Security Standard).
Download our infographic on the state of legislation around data privacy and payments in Canada to learn more.
Canadian privacy compliance is not a single regime, and this infographic maps it as at April 2022. PIPEDA sets the federal ground rules for how private-sector organisations collect, use and disclose personal information, with substantially similar provincial legislation operating in Alberta, British Columbia and Quebec. Alongside the privacy laws, it summarises what PCI DSS v4.0 requires of organisations handling payment card data. Useful for compliance and contact centre teams working out which obligations apply where they operate, and where privacy law and payment security overlap.
