October 22, 2014
“Dear Valued Customer: We still love you but to comply with Canada's new anti-spam law, we need you to love us back! We need your consent to continue to be in touch with information about our products and services. To confirm it, please click here...”
This is the kind of email message that small businesses in Canada have been sending out beginning last July when a new privacy law went into effect.
The Canadian Anti-Spam law or Bill C-28, was introduced to help stop unwanted e-mail and texts. Businesses selling or promoting products or services now have to prove they have express consent to contact past and potential customers using electronic messages. There are penalties up to $1 million for individuals and $10 million for businesses for non-compliance.
“’Express consent’ requires disclosing the purposes for why consent is being requested and identifying who is seeking consent,” said Michael Geist, Canada Research Chair in Internet and E-Commerce Law at the University of Ottawa.
“This represents a significant change from current practice, where businesses have frequently relied upon ‘implied’ consent for their use of personal information.”
Canadian privacy laws also include the federal Privacy Act, which places limits on the collection, use, and disclosure of personal information by government departments and agencies.
But for small businesses in Canada (small and medium-sized enterprises represent 99.9% of all companies, according to organizers of the BDC Small Business Week), the Personal Information Protection and Electronic Documents Act (PIPEDA) is most important. It covers the collection, use, and disclosure of personal information in the course of commercial activity. It applies in most of Canada, according to the Office of the Privacy Commissioner of Canada. But Quebec, Alberta and B.C. have their own laws, and Ontario has a data protection law that focuses on personal health information specifically.
Here is a checklist of different ways small businesses can safeguard the personal information in their workplaces – and comply with Canadian privacy laws.
Learn more about protecting sensitive information in your workplace by implementing document security best practices.