Picture the front desk of a small Brampton business at the end of a busy day. There is a clipboard with customer names and phone numbers. A photocopy of someone’s driver’s licence sits in a tray. The shared computer has been logged in since morning, the booking software emails reminders through a company in another country, and last year’s paper files are in unlocked boxes in the back room.
Nothing in that picture feels like a legal problem until something goes wrong: a laptop is stolen, a customer asks why you have their information, or an employee sends a list to the wrong address. At that point, the owner discovers that privacy law has applied to the business all along.
The good news is that the rules are built on common-sense principles and scale to the size of your operation. A five-person shop does not need the program a bank has. It does need to know what information it holds, why it holds it, and what it will do if that information gets out. This article explains the general rules and is not legal advice about your particular business.
Which Law Applies to You
Ontario has not passed a general privacy statute for private businesses. As a result, the federal Personal Information Protection and Electronic Documents Act, known as PIPEDA, generally applies to organizations in Ontario that collect, use, or disclose personal information in the course of commercial activity. That covers a very wide range of businesses, including retailers, contractors, restaurants, and online sellers. There is no small-business exemption.
Some other laws may sit beside it:
- Health information. Ontario’s Personal Health Information Protection Act applies to health information custodians such as physicians, pharmacists, and many clinics. A physiotherapy or dental office in Brampton will generally be working under that statute for patient records.
- Marketing messages. Canada’s anti-spam legislation, usually called CASL, governs commercial electronic messages.
- Employee monitoring. Ontario’s Employment Standards Act, 2000 requires larger employers to have a written electronic monitoring policy, as discussed below.
Federal privacy law is under active review. A bill to replace the private-sector part of PIPEDA with a new statute and a tougher enforcement regime has been before Parliament, and it could change obligations and penalties if passed. Check its status with your advisor when you set up or update your program, since the fundamentals below are likely to remain useful either way.
The Ten Principles, Translated
PIPEDA is built around ten fair information principles. You do not have to memorize them, but it helps to know what each one requires in practice.
Accountability. Someone in the business must be responsible for privacy. In a small company that is often the owner or office manager. Give that person’s name or title on your website or in your policy so customers know whom to contact.
Identifying purposes. Know why you are collecting each piece of information, and tell people, ideally before or when you collect it.
Consent. People must generally understand and agree to what you are doing with their information. The more sensitive the information, the clearer the consent needs to be.
Limiting collection. Collect only what you need for the purpose you identified. This is where many small businesses can make quick improvements.
Limiting use, disclosure, and retention. Use information only for the stated purposes, and do not keep it forever. Once it is no longer needed for a business or legal reason, securely destroy it.
Accuracy. Keep information as accurate as your purposes require, particularly where you use it to make decisions about someone.
Safeguards. Protect information with security appropriate to its sensitivity. That includes locks, passwords, access controls, and training.
Openness. Make your privacy practices easy to find and understand.
Individual access. On request, people can generally find out what you hold about them and get access to it, with limited exceptions. You generally have 30 days to respond.
Challenging compliance. You need a simple way for people to complain, and a person who deals with those complaints.
Start With an Inventory
Compliance work goes better when it begins with a plain list rather than a policy template. Sit down with a pad and walk through the business from a customer’s first enquiry onward. What gets written down at each step? Where does it go? Who can see it? How long does it stay?
Include the less obvious places. Cameras at the entrance. WhatsApp messages on an owner’s personal phone. Forms that a contractor fills in at a job site. The accounting package, the point-of-sale system, the email marketing account, and the old hard drive in the closet.
An inventory often reveals information that nobody needs. If you run a hypothetical Brampton car detailing shop and you find you have been copying customers’ driver’s licences “just in case,” ask what that copy actually achieves. If seeing the licence once would do, stop copying it. Information you never collected cannot be stolen from you. The Privacy Commissioner has cautioned businesses about asking for identification beyond what a transaction actually requires, and Social Insurance Numbers in particular should be collected only where the law calls for them, as with payroll.
Consent and Your Privacy Policy
A policy should describe what your business truly does. Copying one from a competitor’s website is risky, because it may promise things you do not do or leave out things you do. A serviceable small-business policy explains what you collect, why, whom you share it with, how long you keep it, how people can get access or complain, and how to reach your privacy contact.
Sharing is the part people forget. If your scheduling, payment, or cloud storage provider is outside Canada, tell customers that their information may be processed in another country and be subject to its laws. Your business remains responsible for information it hands to a service provider for processing, so a contract that addresses confidentiality, security, and breach notice is worth having. A lawyer can review these clauses as part of wider privacy advice for businesses.
Consent itself can be express or implied depending on the sensitivity of the information and what a person would reasonably expect. A customer who gives a delivery address expects it to be used for delivery. They do not necessarily expect it to be sold to a marketing partner or used to send unrelated offers. Where a use would surprise the customer, ask first.
When Something Goes Wrong
PIPEDA has mandatory breach rules, and they apply to small companies. A breach of security safeguards includes loss of, unauthorized access to, or unauthorized disclosure of personal information. The email sent to the wrong group, the stolen laptop, and the ransomware attack can all qualify.
If a breach creates a real risk of significant harm to a person, you must:
- Report it to the Office of the Privacy Commissioner of Canada as soon as feasible
- Notify the affected individuals as soon as feasible, usually directly
- Notify any other organization or government body that may be able to reduce the harm, such as a payment processor or the police
Significant harm is broad. It includes identity theft, financial loss, humiliation, and damage to reputation or relationships. Deciding whether the risk is real involves looking at how sensitive the information is and how likely it is to be misused.
You must also keep a record of every breach of safeguards, even those that do not meet the reporting threshold, for 24 months. Knowingly failing to report, notify, or keep these records is an offence, and fines can reach $100,000.
Write a one-page plan before you need it. It should say who decides what to do, how to contain the problem (change passwords, disconnect the affected device), who to call (your IT provider, your insurer, your lawyer), and where to log what happened. If a theft or cyberattack is involved, a report to Peel Regional Police may also be appropriate. Having these names ready on an ordinary Tuesday makes for much better decisions during an emergency on a Saturday night. Also check whether your commercial insurance includes cyber coverage, and what notice conditions it imposes.
Marketing Emails and Text Messages
CASL is separate from PIPEDA and often catches small businesses off guard. As a general rule, before sending a commercial electronic message, such as a promotional email or text, you need the recipient’s consent, and every message must identify the sender, give contact details, and include an unsubscribe mechanism that works. Unsubscribe requests must be honoured within 10 business days.
Consent can be express, where someone has opted in. It can also be implied in defined circumstances, such as a recent purchase from you, but implied consent generally has time limits. Keep records showing where each address on your list came from, since the burden falls on the sender to prove consent. Penalties under CASL can be very high, up to $10 million per violation for a business, although the amount in a given case depends on many factors. Buying a mailing list or scraping addresses from a local business directory is a good way to run into trouble.
Employees and Workplace Monitoring
Employee records raise a point that surprises many owners. PIPEDA’s coverage of employee information is mainly directed at federal works and undertakings, such as banks, airlines, and interprovincial trucking companies. For a provincially regulated Brampton retailer, PIPEDA generally does not govern its employee files the way it governs customer files. That is not a licence to be careless. Employees’ information still calls for confidentiality and security, and other duties can apply, including those arising from employment law and from court decisions about privacy.
Ontario’s Employment Standards Act, 2000 adds a specific requirement. An employer with 25 or more employees on January 1 of any year must have a written policy on electronic monitoring in place before March 1 of that year, and it must cover all employees. It must say whether and how the employer monitors employees electronically and for what purposes, and must be given to employees. The Act does not itself create a right not to be monitored, but honesty about GPS in vans, cameras in stockrooms, and software on work laptops is good practice even if you are below the threshold.
Cameras deserve a moment of thought. Security cameras over a cash register are easy to justify. Audio recording, or a lens aimed at a staff break room, is much harder to defend. Post signs where customers will see them, limit who can view footage, and set a period after which recordings are overwritten.
A Workable Checklist
If you have an hour this month, here is a reasonable place to begin:
- Name your privacy contact and write down the role
- List what you collect and stop collecting what you do not need
- Lock paper records and turn on multi-factor authentication for email and key accounts
- Post an accurate privacy policy on your website and have a copy at the counter
- Review contracts with cloud and software providers
- Draft a one-page breach plan and start a breach log
- Set a retention schedule, then shred and securely wipe what has expired
- Check your email marketing list for proof of consent
- Show staff how to spot phishing and tell them what to do if they make a mistake
That last item matters more than it might seem. Staff who are afraid of being blamed tend to hide errors, and hidden breaches turn into bigger ones.
Where Legal Help Fits
Plenty of this can be done without a lawyer. Legal advice tends to pay for itself at specific moments: when you handle sensitive information such as health or financial data, when a breach has occurred and you need to decide whether it is reportable, when a customer or regulator complains, or when you are buying or selling a business and a customer database is part of the deal. If you would like to talk through your situation, you can contact the firm to arrange a consultation.
Good privacy habits also tell customers something about how you run your business. In a community where word travels quickly among neighbours and family, being known as the shop that takes care of people’s information is worth more than the hour it takes to get started.
Sources and Further Reading
- Office of the Privacy Commissioner of Canada: Privacy for businesses
- Office of the Privacy Commissioner of Canada: What you need to know about mandatory reporting of breaches of security safeguards
- Justice Laws: Personal Information Protection and Electronic Documents Act
- Ontario: Written policy on electronic monitoring of employees