Rules
PIPEDA for Canadian PR teams: handling media and contact data lawfully
How PIPEDA and the Privacy Commissioner's guidance apply to PR contact lists, journalist databases and campaign sign-ups, including consent, retention and breach duties.
What to take away
- PIPEDA is the federal privacy law for private-sector organizations handling personal information in the course of commercial activity. A PR agency's databases, event registrations and campaign sign-ups usually fall inside it.
- Section 4.01 takes business contact information out of Part 1 of the Act when it is used solely to communicate with a person about their employment, business or profession. A journalist's work address used for a pitch is the typical case. It does not cover everything you hold about that person.
- Anything beyond that, such as consumer sign-ups, contest entries, event attendees and survey responses, needs a stated purpose, consent and a retention rule.
- A breach that creates a real risk of significant harm must be reported to the Privacy Commissioner and to the people affected as soon as feasible, and every breach must be recorded.
- Email rules are a separate law. CASL governs the sending, and PIPEDA governs the data. Quebec's Law 25 adds stricter duties, covered in our Quebec article.
Which PR data falls under PIPEDA
PIPEDA defines personal information as information about an identifiable individual. It applies to organizations that collect, use or disclose it in the course of commercial activity. A PR firm sits in that definition for its own client work, so most of what a team keeps is in scope. The exception is narrow, so check each data set against it.
| Data set | Typical contents | Covered by PIPEDA Part 1? |
|---|---|---|
| Media list | Journalist name, outlet, title, work email, beat | Largely excluded when used solely to communicate about their profession |
| Media list notes | Personal opinions, private numbers, home addresses, family details | Not covered by the exclusion, so treat as personal information |
| Event registrations | Names, personal email, dietary or access needs | Covered |
| Campaign sign-ups and contests | Consumer name, email, postal code, entry details | Covered |
| Survey and research panels | Responses linked to individuals | Covered |
| Influencer lists | Creator names, handles, rates, audience details | Depends on whether details are business contact information; check the purpose |
| Client customer data shared with the agency | Client's customer files | Covered, with the client accountable |
The business contact exclusion in section 4.01 applies where an organization handles an individual's business contact information solely to communicate with that individual about their employment, business or profession. The word solely carries weight: if you use the same work address to build a profile for a different purpose, or sell it, the exclusion does not stretch to that use.
The ten principles, translated for a PR workflow
The Office of the Privacy Commissioner of Canada (OPC) sets out ten fair information principles from Schedule 1 of the Act. Here is how each lands in a communications team.
- Accountability.The organization is responsible for personal information under its control and must appoint someone to oversee compliance. Name a person on the account team, not just a policy author.
- Identifying purposes.State why you are collecting data before or at the time of collection. "Campaign updates" is a purpose; "marketing" alone is thin.
- Consent.Knowledge and consent are required, subject to listed exceptions. See the section below.
- Limiting collection.Collect only what the stated purposes need. A webinar signup does not need a home address.
- Limiting use, disclosure and retention.Use data only for the purposes it was collected for, and keep it only as long as those purposes need.
- Accuracy.Keep contacts as accurate and up to date as the use requires. Old media lists are a common source of misdirected pitches.
- Safeguards.Protect data in proportion to its sensitivity. Shared spreadsheets and unmanaged exports are weak points.
- Openness.Make your policies and practices easy to find.
- Individual access.On request, a person must be told about the existence, use and disclosure of their personal information and can ask for corrections.
- Challenging compliance.People can challenge your compliance, and complaints go to the person accountable.
Consent for campaign data
The OPC's consent guidelines give seven principles for meaningful consent, and several apply directly to PR sign-up forms:
- Give prominence to what information is collected, which third parties receive it, the purposes, and the risks of harm.
- Offer clear yes or no choices. People cannot be required to consent to anything beyond what the service needs.
- Revisit consent when something significant changes, such as a new purpose or a new third-party disclosure.
- Be ready to show that your consent process is understandable. A line buried in a privacy policy is not enough.
The OPC says express consent is generally required where information is sensitive, where the use is outside the person's reasonable expectations, or where there is a meaningful residual risk of significant harm. Implied consent is allowed only in strictly defined circumstances.
For a PR team, the secondary-use problem is the common failure. Registrants collected for a product launch event should not automatically be added to a client's newsletter, shared with a sponsor or loaded into a paid advertising audience. Ask for that as a separate choice.
Scraped and bought contact data
Two rules matter when you source contacts from outside. First, section 7.1 of PIPEDA addresses electronic addresses: the listed exceptions to consent do not apply to an address collected or used through a program designed or marketed primarily for generating, searching for or collecting electronic addresses. In practice, harvesting tools are a poor way to build a list.
Second, buying a list does not shift responsibility. Your organization decides how the data is used, so ask the seller where the data came from and what permission covers your use, and keep the answer on file. For pitching practice once the list is clean, see how to pitch journalists and the media relations questions.
Retention and deletion
PIPEDA limits retention to what the purposes require. It does not set a number of months, so you set a rule and apply it. A practical schedule names each data set, the purpose, the review date and the deletion step:
- Event registrationsdelete personal details when the event follow-up ends, keeping only what you need for reporting in non-identifying form.
- Access requestsif a person has asked for their information, section 8(8) requires you to keep it as long as necessary to let them exhaust any recourse, which overrides the normal deletion step.
Breach duties
PIPEDA requires a report to the Privacy Commissioner and notice to affected individuals for any breach of security safeguards involving personal information under your control where it is reasonable to believe it creates a real risk of significant harm. Both must happen as soon as feasible after you determine that the breach has occurred.
The Breach of Security Safeguards Regulations set what each notice contains:
- Report to the Commissioner:the circumstances and cause, when it occurred, the information involved, the number of people affected, steps taken to reduce harm, steps taken to notify people and a contact person.
- Notice to individuals:the circumstances, the date, the information involved, steps taken, steps the person can take and contact information.
Keep a record of every breach, including ones you decide not to report. The regulations require records to be kept for 24 months after the day you determine the breach occurred, and the Commissioner can ask for access to them. Knowingly failing to report, notify or keep records is an offence carrying fines of up to $10,000 on summary conviction or up to $100,000 on indictment.
A PR team often drafts the public statement and individual notices, so build the notice template before you need it. The approach to messaging under pressure is in crisis communications.
