Protecting Personal Information
Understanding the Language of Privacy
Personal information is information that can be used to identify a particular individual (for example, name, address, phone number) and information about an individual (for example, physical description, educational background).
Business contact information includes an individual’s name, position, title, business telephone number, business address, and email address. PIPA allows this information to be disclosed without consent to allow an individual to be contacted as a representative of their organization, for example, as a member of the board.
Commercial activity includes selling, bartering or leasing membership and donor lists, and operating certain private schools, private colleges and pre‐schools. It also includes other activities of a commercial nature, which often means providing a service that is offered at a price competitive with the private sector, such as training courses or day care.
Express consent is explicit permission from an individual to collect, use or disclose his personal information for the stated purpose. Express consent may be given orally or in writing.
Opt‐in consent is a form of express consent. A common form of opt‐in consent is checking a box to indicate that consent is given.
Implied consent is a form of consent given without an express oral or written statement of consent, such as when a person volunteers information to you and the reason you are collecting the information would be obvious to that person. For example, when an individual hands you his credit card, it is obvious that you will use the information stored in the card to process payment for the product or service you are providing.
Notice is given to an individual when you inform him about the information you collect and how it will be used. A notice (or notice statement) under PIPA must say who your privacy contact person is.
Collect, use and disclose: PIPA uses the terms collecting, using and disclosing personal information.
- Collecting means gathering, acquiring, recording, photographing or obtaining personal information from any source.
- Using personal information means processing or employing information for a particular purpose.
- Disclosing information means showing, telling, sending, or giving the personal information to an outside party. Umbrella associations and partners are all outside parties; transferring personal information to any other organization is a disclosure.
Reasonable: PIPA often refers to what is reasonable; this means what a reasonable person would think is appropriate in the situation. Typically, the amount of personal information collected must be reasonable for the transaction. It might be reasonable to look at a driver’s licence to verify an individual’s age; it may not be reasonable to take a copy of the licence.
Employees, volunteers: All paid employees, volunteers, interns, and work‐experience students are treated in the same manner under PIPA. Organizations often need to collect, use and disclose personal information about these individuals for work or volunteer work purposes. They can do this without consent if they provide notice. Organizations not subject to PIPA may choose to provide notice.