What Alberta's PIPA means for your IT

Who PIPA applies to

The Personal Information Protection Act, usually called PIPA, is Alberta's privacy law for private-sector organizations. It covers businesses of all sizes, and it can also apply to non-profits when they collect personal information in connection with commercial activity. If you hold information about customers, patients, donors or employees, there is a good chance PIPA applies to at least part of what you do.

PIPA sits alongside other laws rather than replacing them. Health custodians fall under the Health Information Act, public bodies have their own legislation, and the federal PIPEDA can apply to certain activities such as cross-border commercial transfers or federally regulated businesses. If you are unsure which law covers which records, that is a question to put to your lawyer before you design your IT around an assumption.

The reasonable security requirement

PIPA requires organizations to protect personal information in their custody or control by making reasonable security arrangements against risks such as unauthorized access, use, disclosure, copying or destruction. The law does not list specific products. Instead, what counts as reasonable depends on how sensitive the information is, how much of it you hold and what a sensible organization of your size would do.

In practice, the Office of the Information and Privacy Commissioner of Alberta looks at whether you had sensible controls in place when something went wrong. For most small organizations, that means a set of everyday safeguards that are well documented and actually followed. Expect questions about whether you knew the risks, whether controls were configured properly and whether staff had been told what to do. A good test is whether you could explain each safeguard to an investigator in plain language.

• Multi-factor authentication on email and remote access
• Encrypted laptops and mobile devices
• Supported operating systems with current patches
• Access limited to staff who need the information
• Backups that are tested and protected from tampering

Know where personal information lives

You cannot protect what you have not found. Personal information tends to spread across email inboxes, shared drives, line-of-business applications, scanned documents, phones and old laptops in a closet. A simple data inventory that lists each system, what personal information it holds, who can access it and where it is stored gives you a foundation for every other privacy decision.

The inventory also helps when you use cloud services. PIPA includes notice and policy requirements when an organization uses a service provider outside Canada to handle personal information. Knowing which vendors store data where makes it far easier to meet those obligations and to answer customer questions with confidence. Review the inventory whenever you add a new application.

Retention and disposal

PIPA expects organizations to keep personal information only as long as it is reasonably required for legal or business purposes, and then to destroy it or make it anonymous. Many small businesses do the opposite and keep everything forever because storage is cheap. That habit increases the amount of information exposed if an account or server is ever compromised.

Set retention periods for your main record types, configure automatic deletion where your systems support it, and use proper data wiping or certified destruction when you retire computers, drives and printers. Keep a record of what was disposed of and how, so you can demonstrate that the process is real.

Assign responsibility and write it down

PIPA requires an organization to designate one or more individuals to be responsible for compliance. In a small business this is often the owner or office manager, supported by an IT provider. That person should know where the policies are, who to call if something goes wrong and how to handle a request from someone who wants to see their own information.

Written policies do not need to be long. A clear privacy policy, an acceptable use policy for staff and a short incident response plan cover most of what a small organization needs. Review them once a year and whenever you add a major system. Store them where staff can find them, and make sure new hires read them during onboarding.