Bill S-4, the Digital Privacy Act, received royal assent on June 18 (this was nine years in the making – the parliamentary review of PIPEDA that led to the bill began in 2006). The bill makes a number of changes to PIPEDA, not least of which is the creation of a breach reporting regime, which will come into effect on a date to be determined by Industry Canada. A comprehensive summary of these changes can be found here.
The change that is probably most relevant for marketers is the way that PIPEDA now deals with “business contact information”. It is well known that PIPEDA (and other private sector privacy laws) provide exceptions for business contact information. However, these exceptions are all a little different, and up until June 18, a business email address was not excluded from PIPEDA. Because the list of data elements excluded from PIPEDA was drafted as an exhaustive list (the name, title or business address or telephone number of an employee of an organization), the Privacy Commissioner of Canada concluded years ago that anything not on this list, like an email address, could not be excluded.
Business contact information is now defined broadly as “any information that is used for the purpose of communicating or facilitating communication with an individual in relation to their employment, business or profession such as the individual’s name, position name or title, work address, work telephone number, work fax number or work electronic address”.
According the new section 4.01, PIPEDA does not apply to the collection, use or disclosure of business contact information “solely for the purpose of communicating or facilitating communication with the individual in relation to their employment, business or profession.” Thus, although business contact information is not excluded from PIPEDA altogether, the circumstances under which it can be collected, used and disclosed without consent are quite broad.
In reality, the fact that business email addresses were not excluded probably did not stop a lot of B2B marketers from acting is if they were. At least now they can be used without breaking the law.