Key Facts
Overview
Alberta's PIPA is recognized as substantially similar to PIPEDA, covering provincially regulated private-sector organizations and some nonprofits. The OIPC has binding order-making power, stronger enforcement authority than PIPEDA's OPC, which issues only recommendations.
What This Means for Your Website
- Express consent is required for sensitive data of Alberta visitors; implied consent acceptable for non-sensitive
- The OIPC can issue binding orders, not just recommendations
- Mandatory breach notification applies for breaches posing real risk of significant harm
- Personal information must be destroyed when no longer needed
- Currently under legislative review (2024-2025), so changes may be coming
Key Requirements
The OIPC Alberta enforces PIPA with penalties up to CAD $100,000 for organizations and CAD $10,000 for individuals. Binding order-making power gives the OIPC stronger enforcement than PIPEDA's OPC. Consumer requests must be fulfilled within 30 days.
How ConsentStack Handles This
ConsentStack detects Alberta visitors and applies express consent for sensitive data and implied consent for non-sensitive data per PIPA requirements.
Penalties
Up to CAD $10,000 for individuals; up to CAD $100,000 for organizations.
Key Requirements
- Obtain consent: express for sensitive, implied for non-sensitive
- Develop and follow reasonable privacy policies
- Implement reasonable security measures
- Mandatory breach notification for breaches posing real risk of significant harm
- Provide individuals access to their personal information
- Destroy data when no longer needed for original purpose
Notable Provisions
- Recognized as substantially similar to PIPEDA
- OIPC has binding order-making power, stronger than PIPEDA OPC
- Covers some nonprofits in commercial activities
- Currently under legislative review (2024-2025)
Data Subject Rights
On reasonable notice, withdraw or vary your consent at any time, except where that would frustrate a legal obligation between you and the organization; unless the Act lets it continue without consent, the organization must then stop or follow the varied consent, and the Act sets no response period.
Make a written request for access to your personal information in an organization's custody or control, as a copy or by examining the record, subject to limited exceptions; a reasonable fee may apply after a written estimate, and a longer extension needs the Commissioner's permission.
Make a written request for the purposes for which an organization has used and is using your personal information, and the names of the persons to whom, and the circumstances in which, it has been and is being disclosed.
Make a free written request to correct an error or omission in your personal information (not an opinion); the organization must correct it as soon as reasonably possible and, where reasonable, notify organizations it disclosed it to, or annotate it with the correction requested but not made.
Ask the Information and Privacy Commissioner in writing to review any decision, act or failure to act of an organization on your request, within 30 days of being told of the decision or a longer period the Commissioner allows (no limit for an unanswered access request); the order is final, subject to judicial review.
Deliver a written complaint to the Information and Privacy Commissioner within a reasonable time that an organization collected, used or disclosed your personal information in contravention of the Act, refused a correction without justification, charged an inappropriate fee or is otherwise not complying.
Have any right under the Act exercised on your behalf by a person you authorize in writing, or by a guardian, trustee, attorney, personal directive agent or personal representative in the circumstances the Act sets out.
Other PIPEDA Related Regulations
Other North America Regulations
Frequently Asked Questions
Stay compliant with Alberta PIPA
ConsentStack helps you implement Opt-in consent for Alberta, Canada automatically.