Key Facts
Overview
British Columbia's PIPA is recognized as substantially similar to PIPEDA and applies to private-sector organizations, organizations managing personal information within BC, and nonprofits in commercial activities. The OIPC can investigate, audit, and issue binding orders.
What This Means for Your Website
- Explicit consent is required before collecting, using, or disclosing personal information of BC visitors
- Collection must be limited to what is reasonably necessary for identified purposes
- Personal information must be destroyed when the original purpose is fulfilled
- Mandatory breach notification applies for breaches posing significant risk of harm
- Nonprofits in commercial activities must also comply
Key Requirements
The OIPC BC enforces PIPA with penalties up to CAD $100,000 for organizations and CAD $10,000 for individuals. The OIPC has binding order-making power. Consumer requests must be fulfilled within 30 days. The data destruction requirement creates an ongoing compliance obligation.
How ConsentStack Handles This
ConsentStack detects BC visitors and applies explicit consent requirements per PIPA, supporting the province's privacy framework.
Penalties
Up to CAD $10,000 for individuals; up to CAD $100,000 for organizations.
Key Requirements
- Obtain explicit consent before collecting, using, or disclosing personal information
- Identify purposes at or before collection
- Limit collection to what is reasonably necessary
- Implement reasonable security safeguards
- Provide access and correction rights
- Mandatory breach notification for significant risk of harm
Notable Provisions
- Recognized as substantially similar to PIPEDA
- OIPC has binding order-making power
- Covers nonprofits in commercial activities
- Must destroy data once original purpose is fulfilled
Other PIPEDA Related Regulations
Other North America Regulations
Frequently Asked Questions
How does BC PIPA differ from PIPEDA?
BC PIPA is substantially similar to PIPEDA but the OIPC has binding order-making power and the law also covers nonprofits in commercial activities.
What are the BC PIPA penalties?
Up to CAD $100,000 for organizations and CAD $10,000 for individuals. The OIPC can also issue binding compliance orders.
Does BC PIPA require data destruction?
Yes. Organizations must destroy personal information once the original purpose for collection is fulfilled.
Stay compliant with BC PIPA
ConsentStack helps you implement Opt-in consent for British Columbia, Canada automatically.