Guidance Documents

This Guide addresses the most common procedures that the Office of the Information and Privacy Commissioner (OIPC) uses under the Personal Information Protection Act (PIPA). For all complaints and requests for review, the OIPC’s overriding policy is to encourage the parties to resolve the issues by settlement. OIPC staff are authorized to attempt mediation of all matters before they are referred to a more formal process.

Use this document to take action when a privacy breach has occurred. These key steps apply to public bodies under the Freedom of Information and Protection of Privacy Act (FIPPA) and have been updated to include information about the legislation’s mandatory breach notification requirements.

Privacy impact assessments (PIAs) help you understand the implications your planned initiatives will have on people's privacy and personal information. This template guides you through the process of developing a PIA.

In emergency situations, privacy laws in BC authorize public bodies or private organizations to responsibly disclose an individual’s personal information, including information about their mental, emotional, or other health conditions, to third parties who may be able to help in a crisis. Privacy legislation in BC accommodates the disclosure of personal information in the event it could prevent a tragedy. BC’s Freedom of Information and Protection of Privacy Act (FIPPA) sets out how public bodies can collect, use, and disclose personal information. BC’s Personal Information Protection Act (PIPA) sets out how private sector organizations can collect, use, and disclose personal information. This guidance document informs public bodies and private sector organizations about the circumstances under which they can disclose personal information of an individual to a third party without the individual’s consent in emergency situations.

The Office of the Information and Privacy Commissioner (OIPC) wants to help your organization meet your legal obligations and the expectations of your clients and customers for the privacy and security of their personal information.

In this document, Canadian federal, provincial and territorial privacy authorities identify considerations for the application of key privacy principles to generative AI technologies.

The Freedom of Information and Protection of Privacy Act (FIPPA) regulates the information and privacy practices of public bodies including BC government, local governments, crown corporations, and local police forces, etc.

This guidance is designed to provide best practices for political organizations – including political parties, riding associations, candidates, campaign staff, and volunteers – and their handling of personal information as part of the campaign process. BC’s Personal Information Protection Act (PIPA) applies to the collection, use, and disclosure of “personal information” by political parties in British Columbia.

In November 2021, the data residency provisions of the Freedom of Information and Protection of Privacy Act (FIPPA) were amended to remove the prohibition (with certain exceptions) on disclosure of personal information outside of Canada. The new legislative framework permits the disclosure of personal information outside of Canada in accordance with B.C. Reg. 294/2021.1 And critically, public bodies’ obligations under s. 30 of FIPPA to implement reasonable security measures continue to apply to any disclosure of personal information outside Canada. Therefore, a careful assessment under s. 30 is necessary before any disclosure of personal information outside of Canada.

This document aims to help organizations subject to BC’s Personal Information Protection Act (PIPA) understand what conditions must be present before they can consider conducting random searches for drugs and alcohol. This guide applies to employers who search their own employees as well as employers that use contractors. It also applies to unionized and non-unionized workplaces. This document does not deal with workplace drug or alcohol testing through breath or other samples, nor does it deal with searches or testing after a workplace accident, where an employer or organization might have reasonable cause to suspect an individual is impaired.

On October 17, 2018, cannabis became legal in Canada. The Personal Information Protection Act (PIPA) applies to any private organization that collects, uses, and discloses the personal information of individuals in BC.

This document aims to help readers understand what constitutes a “common or integrated program or activity” (CIPA) under BC’s Freedom of Information and Protection of Privacy Act (FIPPA), and the obligations associated with them.

The Public Health Officer (PHO) has made two orders requiring the collection of personal information at restaurants, bars, gatherings and events.

This document provides recommended guidance for educators to help them choose online learning tools that comply with the requirements of BC’s Freedom of Information and Protection of Privacy Act (FIPPA). It includes information about recent, temporary changes to FIPPA in response to the COVID-19 crisis that allow for the use of tools that store information outside of Canada.

This document offers suggestions for organizations to refer to when investigating a privacy complaint made to them under the Personal Information Protection Act (PIPA).

More than ever before, retailers have to be prepared to deal with customers who ask questions about the type and amount of personal information retailers collect, what they intend to do with it, and how they will protect it from misuse. This document answers frequently asked questions about retailers and PIPA.

Effective May 25, 2018, some organizations subject to PIPA must also comply with the European Union (EU) General Data Protection Regulation (GDPR).2 The GDPR applies to organizations that have an established presence in the EU, offer goods and services to individuals in the EU, or monitor the behaviour of individuals in the EU. Organizations that do not comply with the GDPR face significant fines.

Joint guidance with Office of the Privacy Commissioner of Canada and Office of the Information and Privacy Commissioner of Alberta. As direct-to-consumer genetic tests become increasingly available, particularly over the Internet, it is important to understand their privacy risks. This document explains some of the key privacy risks associated with these tests, informs individuals of their rights and encourages them to ask themselves a series of questions before buying one online.

This guidance document discusses the privacy impacts of employee monitoring programs. Employees have a right to privacy in the workplace, which Canadian courts have upheld and must be respected by public and private organizations.

A “social media background check” can mean many things. It can be as simple as checking out a Facebook profile or as complicated as hiring someone to search for every bit of social media about an individual. When organizations and public bodies search for information about an individual, the collection, use, and disclosure of that personal information is subject to the privacy provisions of FIPPA and PIPA. These laws apply whether the individual is applying for paid or unpaid employment, a volunteer position, or if they are applying to run as a candidate in an election.

This guidebook will help ensure your time extension application includes all the relevant information the OIPC needs to process and review your request.

This guidance document aims to identify some of the privacy considerations law enforcement authorities should take into account when deciding whether to outfit law enforcement officers with body-worn cameras. Also described is the privacy framework that should be part of any law enforcement body-worn camera program in order to ensure compliance with Canada’s personal information protection statutes.

Every year, millions of dollars are lost as identity theft threatens the financial security of thousands of Canadians. Identity theft is also a privacy matter – personal information can be lost or compromised. With identity theft on the rise, it is more important than ever for Canadians to take action to protect their personal information.

Guidance from the BC, Alberta and Federal Privacy Commissioner regarding meaningful consent in an online context. Organizations should have a clear, descriptive and accessible privacy policy and, as circumstances warrant, dynamic privacy explanations, in the course of the user experience.

This document explains the implications under the Freedom of Information and Protection of Privacy Act (“FIPPA”) for use of personal email accounts for work purposes by employees of public bodies.

Public bodies planning a "data-linking initiative" or "common or integrated program or activity" must submit a PIA to the Commissioner's office and must also give early notice to the Commissioner.

A two-page overview of the key building-blocks of a privacy management program for the private sector.

This Guide has been jointly prepared by the Office of the Information and Privacy Commissioner (OIPC) for British Columbia and the BC Ministry of Attorney General’s Administrative Justice Office (AJO) to address tribunal access and privacy issues.

In emergency situations, privacy laws in Ontario and British Columbia do not prohibit universities, colleges or other educational institutions from responsibly disclosing a student’s personal information, including information about their mental, emotional or other health conditions, to parents or others who may be able to help in a crisis. There is no question that the decision to disclose a student’s personal information without consent is extremely difficult and requires a reasoned judgment call. The decision rests, on a case-by-case basis, with whoever is responsible, be that a doctor, student counsellor, residence advisor or the head of an institution. The decision must be made very carefully and sensitively, but privacy laws do not stand in the way of an educational institution’s ability to make this decision, where appropriate.

This guide offers suggestions for organizations when investigating a privacy complaint made under PIPA.

These guidelines deal with contracting out arrangements that involve “personal information” as defined in the Freedom of Information and Protection of Privacy Act (FIPPA). A public body cannot, by contracting out, relieve itself of its privacy obligations under Part 3 of the Act.