Key Facts
Overview
British Columbia's PIPA is recognized as substantially similar to PIPEDA and applies to private-sector organizations, organizations managing personal information within BC, and nonprofits in commercial activities. The OIPC can investigate, audit, and issue binding orders. BC is one of three provinces running its own private-sector privacy law rather than the federal one, alongside Alberta and Quebec, and Quebec's Law 25 sets the strictest consent bar of the three.
What This Means for Your Website
- Explicit consent is required before collecting, using, or disclosing personal information of BC visitors
- Collection must be limited to what is reasonably necessary for identified purposes
- Personal information must be destroyed when the original purpose is fulfilled
- Mandatory breach notification applies for breaches posing significant risk of harm
- Nonprofits in commercial activities must also comply
Key Requirements
The OIPC BC enforces PIPA with penalties up to CAD $100,000 for organizations and CAD $10,000 for individuals. The OIPC has binding order-making power. Consumer requests must be fulfilled within 30 days. The data destruction requirement creates an ongoing compliance obligation.
How ConsentStack Handles This
ConsentStack detects BC visitors and applies explicit consent requirements per PIPA, supporting the province's privacy framework.
Penalties
Up to CAD $10,000 for individuals; up to CAD $100,000 for organizations.
Key Requirements
- Obtain explicit consent before collecting, using, or disclosing personal information
- Identify purposes at or before collection
- Limit collection to what is reasonably necessary
- Implement reasonable security safeguards
- Provide access and correction rights
- Mandatory breach notification for significant risk of harm
Notable Provisions
- Recognized as substantially similar to PIPEDA
- OIPC has binding order-making power
- Covers nonprofits in commercial activities
- Must destroy data once original purpose is fulfilled
Data Subject Rights
Complain to the organization through the process it must have for complaints about how it applies the Act, and on request get information about that process and its privacy policies and practices; the Act sets no response period.
Withdraw consent to the collection, use or disclosure of your personal information at any time on reasonable notice, after which the organization must stop unless the Act permits it without consent; you cannot withdraw where doing so would frustrate a legal obligation, and the Act sets no response period.
On a written request, obtain the personal information an organization controls about you and information about how it has been and is being used, subject to the Act's exceptions and a possible minimal fee (no fee for employee personal information).
As part of an access request, get the names of the individuals and organizations to whom the organization has disclosed your personal information, subject to the same exceptions that limit access.
Ask in writing for an error or omission in your personal information to be corrected; if the organization agrees it must correct it and send the correction to organizations it disclosed the information to in the prior year, and if it refuses it must annotate the record with the requested correction.
If an organization refuses or fails to act on your access or correction request, ask the Information and Privacy Commissioner in writing, within 30 days of being notified or a longer period the Commissioner allows, to review it; no time limit applies if it did not respond within the time the Act requires.
Complain in writing to the Information and Privacy Commissioner for British Columbia that an organization failed to perform a duty, extended a deadline improperly, charged an unreasonable fee, refused a correction without justification, or collected, used or disclosed your information in breach of the Act.
Other PIPEDA Related Regulations
Other North America Regulations
Frequently Asked Questions
Stay compliant with BC PIPA
ConsentStack helps you implement Opt-in consent for British Columbia, Canada automatically.