Bill 54: Personal Information Protection Amendment Act, 2009 received Royal Assent on November 26, 2009 and will come into force by proclamation. The proposed changes to the Personal Information Protection Act (PIPA) are intended to strengthen the existing protections of personal information and better align the protections with emerging business practices. The key amendments to PIPA include:
- requiring organizations to notify individuals if their personal information is transferred to a service provider outside of Canada;
- making it an offence for an organization to fail to notify the Alberta Information and Privacy Commissioner of a privacy breach that could result in a real risk of significant harm to an individual;
- clarifying the provisions regarding the collection, use and disclosure of personal information of current and former employees, including some revised consent provisions;
- clarifying provisions regarding the retention and destruction of personal information;
- streamlining the Alberta Information and Privacy Commissioner's processes; and
- adding new offence provisions (for example, it will be an offence for an organization to take adverse action against a "whistleblower" employee).
These amendments will require organizations to:
- amend their privacy policies;
- review their procedures surrounding the transfer of personal information across borders;
- ensure that the Alberta Information and Privacy Commissioner is contacted with respect to privacy breaches that could cause significant harm to an individual; and
- ensure adequate record retention and destruction processes are in place.