PIPEDA and e-signatures

Does PIPEDA apply to you?

• Part 1 of the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to organizations that collect, use or disclose personal information in the course of commercial activities (section 4).
• Alberta, British Columbia and Quebec have private-sector privacy laws deemed substantially similar to PIPEDA. Organizations covered by them are generally exempt from PIPEDA for personal information handled within the province, according to the Office of the Privacy Commissioner of Canada (OPC).
• PIPEDA still applies to federally regulated organizations, such as banks, airlines and telecommunications companies, and to personal information that crosses provincial or national borders.

Part 1: the privacy rules

PIPEDA’s Schedule 1 sets out ten principles. Four of them shape how you use an e-signature service.

Consent

• You need the person’s knowledge and consent to collect, use or disclose their personal information, except where inappropriate (principle 4.3).
• Consent is only valid if it is reasonable to expect the person would understand the nature, purpose and consequences of what they are consenting to (section 6.1).
• Identify your purposes at or before the time you collect the information (principle 4.2).
• Do not make consent to extra collection a condition of the service, beyond what the stated, legitimate purposes need (principle 4.3.3). The related rule on limiting collection says to collect only what is necessary (principle 4.4), so do not ask signers for attachments or details you do not need.

Safeguards

• Protect personal information with safeguards appropriate to its sensitivity, whatever the format (principle 4.7).
• The methods should include physical, organizational and technological measures, for example limiting access on a need-to-know basis, passwords and encryption (principle 4.7.3).
• Report to the OPC any breach of security safeguards that creates a real risk of significant harm, notify the people affected, and keep a record of every breach (sections 10.1 and 10.3).

Accountability for information you transfer

• You are responsible for personal information in your possession or custody, including information transferred to a third party for processing, such as an e-signature provider. Use contractual or other means to provide a comparable level of protection while the provider processes it (principle 4.1.3).
• Designate someone accountable for your compliance (principle 4.1).
• The OPC’s guidelines on processing personal data across borders explain that a transfer for processing is a use of the information, not a disclosure. PIPEDA does not prohibit transfers to another country, but you should assess the risks, including the laws of the country where the processor operates.
• The same guidelines say to make it plain to people that their information may be processed in a foreign country and may be accessible to that country’s courts, law enforcement and national security authorities.

Openness

• Make specific information about your personal information policies and practices readily available, in a form that is generally understandable (principle 4.8).
• Include the name or title and address of the person accountable for your practices, and a description of the personal information you hold and how you use it (principle 4.8.2).

Part 2: electronic documents for federal law purposes

• Part 2 provides electronic alternatives where federal laws contemplate the use of paper (section 32). It does not change the rules for requirements in provincial laws; for those, look to your province’s electronic commerce law.
• A signature required by a federal law can be met by an electronic signature only if that law or provision is listed in Schedule 2 or 3 of PIPEDA and the related regulations are complied with (section 43).
• Some uses need a “secure electronic signature”: an original document (section 42), a statement made under oath or solemn affirmation (section 44), a statement certifying that information is true, accurate or complete (section 45), a witnessed signature (section 46) and a seal (section 39).
• A secure electronic signature must come from a technology or process prescribed by regulation (section 31). The Secure Electronic Signature Regulations prescribe a digital signature backed by a digital signature certificate from a certification authority recognized by the President of the Treasury Board.

A checklist

1. Confirm which privacy law applies to you: PIPEDA, a provincial law, or both.
2. Name the person accountable for privacy and publish their title and contact information.
3. Tell signers what you collect, why, and who processes it for you, including any processing outside Canada.
4. Collect only what each agreement needs.
5. Sign a written agreement with your e-signature provider that gives a comparable level of protection.
6. Limit who in your organization can see signed documents.
7. Keep a breach plan: assess, report and notify where required, and record every breach.
8. For a federal form or filing, check whether the law is listed in Schedule 2 or 3 of PIPEDA and whether it calls for a secure electronic signature.