Bill C-12 explained in plain English

Bill C-12 amends the Personal Information Protection and Electronic Documents Act to update rules on consent, disclosure, and breach reporting for personal information.

Bill C-12, also known as the Safeguarding Canadians’ Personal Information Act, proposes amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA). The bill aims to update rules around the collection, use, and disclosure of personal information. Key changes include defining valid consent, allowing disclosures for specific purposes such as fraud prevention or identifying deceased individuals, and introducing mandatory reporting for significant breaches of security safeguards. It also clarifies the meaning of 'lawful authority' for disclosures to government institutions.

A legislative summary is currently being prepared for this bill by the Parliamentary Information and Research Service of the Library of Parliament. Meanwhile, the following executive summary is available. On 29 September 2011, the Minister Industry and Minister of State (Agriculture) introduced Bill C-12, An Act to amend the Personal Information Protection and Electronic Documents Act (Safeguarding Canadians’ Personal Information Act), in the House of Commons and it was given first reading. The bill amends the Personal Information Protection and Electronic Documents Act. Among other things, it • outlines what constitutes valid consent for the collection, use or disclosure of personal information; • proposes additional exceptions permitting the disclosure of personal information without the knowledge or consent of the individual in order to allow for the release of personal information to help protect victims of financial abuse, to help locate missing persons and to identify injured, ill or deceased individuals; • clarifies the meaning of lawful authority for the purpose of disclosures to government institutions of personal information without the knowledge or consent of the individual; • permits organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of the individual, personal information contained in witness statements related to insurance claims, or produced by the individual in the course of their employment, business or profession; • permits organizations, for certain purposes, to use and disclose, without the knowledge or consent of the individual, personal information related to prospective or completed business transactions; • permits federal works, undertakings and businesses to collect, use and disclose personal information without the knowledge or consent of the individual to establish, manage or terminate employment relationships; • provides a framework for organizations to notify individuals proactively about disclosures of their personal information made in certain circumstances to government institutions; and • requires organizations to report material breaches of security safeguards to the Privacy Commissioner and to notify certain individuals and organizations of breaches that create a real risk of significant harm.