Bill C-12 explained in plain English

The amendments to PIPEDA clarify what constitutes personal information, require data breach notifications, expand collection rules for national security, and add new compliance obligations for organizations handling personal data.

The amendments to the Personal Information Protection and Electronic Documents Act (PIPEDA) clarify definitions, expand data breach notification requirements, and adjust rules for collecting personal information. Key changes include: 1. Definition of Personal Information: Explicitly defines 'personal information' as information about an identifiable individual, including sensitive data like health or financial records. 2. Data Breach Notifications: Requires organizations to notify individuals if a breach of personal information occurs, with specific procedures for reporting to the Office of the Privacy Commissioner. 3. Collection Limits: Expands the scope of when personal information can be collected, including for national security or international affairs purposes, but requires justification and transparency. 4. Compliance Measures: Adds new sections (e.g., section 7) outlining obligations to communicate with individuals about data use and respond to privacy complaints. 5. Repealed Provisions: Removes outdated references to specific data types (e.g., health information) from certain subsections, streamlining the law. The amendments come into force by order of the Governor in Council and apply to federal organizations and private sector entities handling personal information.