What email methods are suitable for sending/receiving PIPEDA regulated information?

PIPEDA does not have required configurations or regulated methods for sending/receiving of data via email or any other medium. What it does offer is a list of Guidelines or Principles that should be followed in order to be considered PIPEDA compliant. These principles are:

1. Be Accountable
2. Identify the Purpose
3. Obtain Informed Consent
4. Limit Collection
5. Limit Use, Disclosure and Retention
6. Be Accurate
7. Use Appropriate Safeguards
8. Be Open
9. Give Individuals Access
10. Provide Recourse

You can work with an IT Consultant to help you develop IT policies that support your PIPEDA compliance.

What are my responsibilities?

PIPEDA provides ten (10) principles to help businesses become PIPEDA compliant. Each principle contains a list of responsibilities to help businesses with compliance. They include:

• Be Accountable

• • • Comply with all 10 of the principles.
    • Appoint an individual to be responsible for your organization's compliance.
    • Protect all personal information held by your organization or transferred to a third
      party for processing.
    • Develop and implement personal information policies and practices.

• Identify the Purpose

• • • Before or when any personal information is collected, identify why it is needed and how it will be used.
    • Document why the information is collected.
    • Inform the individual from whom the information is collected why it is needed.
    • Identify any new purpose for the information and obtain the individual’s consent
      before using it.

• Obtain Informed Consent

• • • Specify what personal information you are collecting and why in a way that your
      customers and clients can clearly understand.
    • Inform the individual in a meaningful way of the purposes for the collection, use or
      disclosure of personal data.
    • Obtain the individual’s consent before or at the time of collection, as well as when a
      new use of their personal information is identified.

• Limit Collection

• • • Do not collect personal information indiscriminately.
    • Do not deceive or mislead individuals about the reasons for collecting personal
      Information.

• Limit Use, Disclosure and Retention

• • • Use or disclose personal information only for the purpose for which it was collected, unless the individual consents, or the use or disclosure is authorized by the Act.
    • Keep personal information only as long as necessary to satisfy the purposes.
    • Put guidelines and procedures in place for retaining and destroying personal
      Information.
    • Keep personal information used to make a decision about a person for a reasonable time period. This should allow the person to obtain the information after the decision and pursue redress.
    • Destroy, erase or render anonymous information that is no longer required for an
      identified purpose or a legal requirement.

• Be Accurate

• • • Minimize the possibility of using incorrect information when making a decision
      about the individual or when disclosing information to third parties.

• Use Appropriate Safeguards

• • • Protect personal information against loss or theft.
    • Safeguard the information from unauthorized access, disclosure, copying, use or
      Modification.
    • Protect personal information regardless of the format in which it is held.

• Be Open

• • • Inform customers, clients and employees that you have policies and practices for the management of personal information.
    • Make these policies and practices understandable and easily available.

• Give Individuals Access

• • • When requested, inform individuals if you have any personal information about them.
    • Explain how it is or has been used and provide a list of any organizations to which it has been disclosed.
    • Give individuals access to their information.
    • Correct or amend any personal information if its accuracy and completeness is
      challenged and found to be deficient.
    • Provide a copy of the information requested, or reasons for not providing access,
      subject to exceptions set out in Section 9 of the Act..
    • An organization should note any disagreement on the file and advise third parties
      where appropriate.

• Provide Recourse

• • Develop simple and easily accessible complaint procedures.
  • Inform complainants of their avenues of recourse. These include your organization’s own complaint procedures, those of industry associations, regulatory bodies and the Office of the Privacy Commissioner of Canada.
  • Investigate all complaints received.
  • Take appropriate measures to correct information handling practices and policies.