Detailed Comparison of PIPA (British Columbia) and PIPEDA (Federal) — With Focus on Application to BC Landlords
PIPA = Personal Information Protection Act
PIPA (Personal Information Protection Act) is British Columbia’s provincial private-sector privacy law that governs how organizations (including landlords) collect, use, disclose, and protect personal information of individuals within BC. It applies broadly to commercial and many non-commercial activities in the province and has been declared substantially similar to the federal law, so it generally displaces PIPEDA for most in-province residential tenancy matters.
PIPEDA = Personal Information Protection and Electronic Documents Act
PIPEDA (Personal Information Protection and Electronic Documents Act) is Canada’s federal private-sector privacy law that sets rules for the collection, use, and disclosure of personal information in the course of commercial activities across the country. It continues to apply to federally regulated businesses and to certain interprovincial or international data flows, but it does not generally govern ordinary residential landlord-tenant activity that stays entirely within British Columbia.
This article/blog provides a structured, statute-referenced analysis of the two private-sector privacy statutes, emphasizing differences and practical implications for residential landlords operating in British Columbia.
Landlords need to understand these rules because they routinely collect, use, store, and disclose highly sensitive personal information from applicants and tenants (names, contact details, employment and income records, credit reports, rental history, identification documents, and sometimes banking or other financial data). Mishandling that information can trigger complaints to the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC), binding orders, administrative fines of up to $10,000 for individuals or $100,000 for organizations under PIPA, civil liability, reputational harm, and difficulties attracting or retaining tenants. Compliance is therefore both a legal obligation and a risk-management necessity for anyone offering residential rental housing in BC—whether a large property-management company or an individual renting a secondary suite.
Tenants and prospective tenants also need to know these rules so they can recognize when a landlord is collecting excessive or unnecessary information, insist on meaningful consent and proper notice of purposes, exercise their statutory rights of access and correction, demand secure handling of their data, and file complaints with the OIPC BC if their privacy rights are violated. Awareness empowers both parties to operate within the balanced framework that PIPA (and, residually, PIPEDA) establishes.
1. Statutory Framework and Purpose
Personal Information Protection Act (PIPA)
- Citation: Personal Information Protection Act, S.B.C. 2003, c. 63.
- Purpose (s. 2): To govern the collection, use and disclosure of personal information by organizations in a manner that recognizes both the right of individuals to protect their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
- Key definition – “organization” (s. 1): Includes a person, unincorporated association, trade union, trust or not-for-profit organization. Explicitly covers individuals acting in a commercial capacity (e.g., a homeowner renting a secondary suite for income).
- Key definition – “personal information” (s. 1): Information about an identifiable individual (does not include contact information or work product information in certain contexts).
- Regulator: Office of the Information and Privacy Commissioner for British Columbia (OIPC BC).
- Came into force: 1 January 2004. Declared “substantially similar” to PIPEDA by Order in Council (effective 2004), thereby displacing PIPEDA for most intra-provincial private-sector activity in BC.
Personal Information Protection and Electronic Documents Act (PIPEDA)
- Citation: Personal Information Protection and Electronic Documents Act, S.C. 2000, c. 5.
- Purpose (s. 3): To establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
- Core operational framework: Schedule 1 sets out the 10 Fair Information Principles (based on the CSA Model Code).
- Key definition – “commercial activity” (s. 2(1)): Any particular transaction, act or conduct, or any regular course of conduct, that is of a commercial character.
- Regulator: Office of the Privacy Commissioner of Canada (OPC).
- Application: Federal works, undertakings or businesses (FWUBs); interprovincial or international commercial activity; and private-sector commercial activity in provinces without substantially similar legislation.
2. Scope of Application — Critical Difference for BC Landlords
PIPA
- Applies to every organization in British Columbia that collects, uses or discloses personal information, subject only to the limited exceptions in s. 3 (e.g., personal or domestic purposes, public bodies under FOIPPA, information already governed by PIPEDA, certain journalistic/artistic/literary purposes).
- Explicitly covers residential landlords of any scale — from large property-management companies to an individual renting a basement suite.
- OIPC BC guidance (Private Sector Landlords and Tenants, updated guidance) confirms: “PIPA applies to any person, corporation, or unincorporated association offering to rent any property, whether a secondary suite, condominium unit, or apartment.”
PIPEDA
- Applies only to the collection, use or disclosure of personal information in the course of commercial activity.
- Does not generally apply to pure intra-provincial residential tenancy activity in BC because of the substantial-similarity declaration.
- Continues to apply to:
- Federally regulated entities (banks, telecoms, interprovincial carriers, etc.);
- Cross-border or interprovincial flows of personal information that create a real and substantial connection to federal jurisdiction;
- Situations involving personal information of residents of other provinces in certain circumstances.
Practical result for BC landlords:
PIPA is the governing statute for virtually all collection, use, disclosure, storage and security of applicant and tenant personal information that occurs within British Columbia. PIPEDA is relevant only in the limited residual circumstances noted above.
3. Core Obligations — Side-by-Side Legal Comparison
| Obligation | PIPA (BC) — Key Provisions | PIPEDA — Key Provisions / Principles |
|---|---|---|
| Accountability | Organization must designate an individual responsible for compliance (s. 4). Must develop and follow policies and practices (s. 5). | Principle 1 (Accountability): Designate a privacy officer; implement policies and procedures. |
| Identifying purposes | Must identify purposes before or at the time of collection and notify the individual (s. 10). Purposes must be those a reasonable person would consider appropriate (ss. 11, 14, 17). | Principle 2 (Identifying Purposes): Identify purposes before or at the time of collection. |
| Consent | Consent generally required for collection, use and disclosure (s. 6). Consent must be meaningful. Organization may not require consent to collection beyond what is necessary for the product or service (s. 7(2)). Express, implied and deemed consent recognized (ss. 7–8). | Principle 3 (Consent): Knowledge and consent required except where inappropriate (s. 7 exceptions). Consent must be meaningful. Cannot require consent beyond what is necessary for the product/service. |
| Limiting collection | Collect only what is necessary for the identified reasonable purposes (s. 11). Collect by fair and lawful means. | Principle 4 (Limiting Collection): Limit to that which is necessary; collect by fair and lawful means. |
| Use & disclosure | Use/disclose only for the purposes for which it was collected (or a consistent purpose), or with new consent, or as authorized (ss. 14, 17–18). | Principle 5 (Limiting Use, Disclosure and Retention). |
| Retention | Destroy, erase or anonymize personal information as soon as it is no longer necessary for the purpose or required by law (s. 35). | Principle 5: Retain only as long as necessary. |
| Accuracy | Make reasonable efforts to ensure personal information is accurate and complete (s. 33). | Principle 6 (Accuracy). |
| Safeguards / Security | Make reasonable security arrangements to protect against unauthorized access, collection, use, disclosure, copying, modification or disposal (s. 34). | Principle 7 (Safeguards): Appropriate to the sensitivity of the information. |
| Openness / Transparency | Make information about policies and practices available (s. 5). | Principle 8 (Openness). |
| Individual access | Individual has right to request access to their personal information and information about its use and disclosure (s. 23). Organization must respond within 30 days (extendable). | Principle 9 (Individual Access). |
| Correction | Individual may request correction of errors or omissions (s. 24). | Principle 9. |
| Challenging compliance | Individual may complain to the organization and, if unresolved, to the OIPC BC. | Principle 10 (Challenging Compliance). |
4. Consent Rules in Greater Detail (Particularly Relevant to Tenant Screening)
PIPA
- Consent is the default rule (s. 6).
- On or before collection from the individual, the organization must disclose the purposes and the contact information of a person who can answer questions (s. 10).
- Consent is invalid if the organization requires, as a condition of supplying a product or service, consent to the collection, use or disclosure of personal information beyond what is necessary to provide that product or service (s. 7(2)).
- Implied consent is recognized where a reasonable person would consider the purpose obvious and the individual voluntarily provides the information (s. 8).
- Deemed consent exists in limited notice-and-opt-out situations.
- Withdrawal of consent is permitted, subject to legal or contractual restrictions and reasonable notice (s. 9).
PIPEDA
- Similar structure, but consent is framed through Schedule 1, Principle 3, and the statutory exceptions in s. 7.
- The OPC’s Guidelines for Obtaining Meaningful Consent emphasize that individuals must understand the nature, purpose and consequences of the collection, use or disclosure.
- Same prohibition on requiring consent beyond what is necessary for the product or service.
Landlord application (PIPA-focused):
A landlord may collect name, contact information, employment/income verification, rental history, references and (with express consent) a credit report because these are generally considered reasonably necessary for assessing suitability. Blanket requirements for SINs, full banking statements, or criminal-record checks (absent a specific reasonable justification) will usually fail the reasonableness and necessity tests under PIPA.
5. Breach Notification
PIPA
- No mandatory reporting obligation to the OIPC for private-sector organizations under the current statute.
- Organizations must still notify affected individuals if a breach creates a real risk of significant harm (derived from the security and accuracy obligations and OIPC guidance).
- (Note: BC’s public-sector FOIPPA has mandatory breach reporting; private-sector PIPA does not yet mirror this.)
PIPEDA
- Mandatory reporting to the OPC and notification to affected individuals when a breach creates a real risk of significant harm (ss. 10.1–10.3 and related regulations).
- Record-keeping obligations for all breaches.
6. Enforcement and Remedies
PIPA
- OIPC BC may investigate complaints, initiate investigations, mediate, conduct inquiries, and issue binding orders (ss. 36–52).
- Offences: fines up to $10,000 (individual) or $100,000 (organization) (s. 56).
- Individuals may also pursue civil remedies in certain circumstances.
PIPEDA
- OPC investigates complaints and may make recommendations.
- Recent amendments introduced administrative monetary penalties.
- Individuals may apply to the Federal Court for remedies after an OPC report.
- Compliance orders and damages available in court.
7. Cross-Border and Extraterritorial Considerations
- PIPA can apply to organizations outside BC if there is a real and substantial connection to British Columbia (confirmed by the BC Court of Appeal in the Clearview AI litigation).
- PIPEDA applies to organizations outside Canada that have a real and substantial connection to Canada.
- When a BC landlord transfers personal information outside Canada (e.g., to a cloud provider or credit-reporting agency), PIPA still requires reasonable security arrangements; additional contractual protections are strongly recommended.
8. Practical Summary for BC Landlords
- Governing law: PIPA.
- Core duties: Obtain meaningful consent, collect only what is reasonably necessary, use only for identified purposes, secure the information, retain only as long as necessary, provide access and correction rights, and designate a privacy contact.
- Screening: Limit requests to information a reasonable person would consider appropriate. Credit checks require express consent. Avoid over-collection (SIN, unnecessary banking details, blanket criminal checks, social-media scraping without clear justification).
- Retention: Destroy or anonymize rejected applications after a reasonable period (commonly 6–12 months, subject to human-rights limitation periods and any other legal requirements). Keep tenancy records longer as required by the Residential Tenancy Act, tax law, etc.
- Breach response: Notify affected individuals of significant-risk breaches; document the incident even though OIPC reporting is not mandatory.
- PIPEDA residual exposure: Relevant only if the landlord’s activities involve federally regulated entities, interprovincial/international data flows, or personal information of non-BC residents in a manner that engages federal jurisdiction.
Learn More: BC Landlord’s Guide to the Personal Information Protection Act (BC)
This analysis is based on the current text of both statutes, the substantial-similarity declaration, OIPC BC guidance (including the Private Sector Landlords and Tenants guidance), and relevant case law and Commissioner orders. Privacy law continues to evolve; organizations should consult the official statutes, OIPC BC resources, and legal counsel for advice tailored to specific circumstances. This is not legal advice.
