Consent and privacy

In order for consent to be considered meaningful under PIPEDA, individuals should have a clear understanding
of what will be collected, how their personal information will be used, and with whom it will be shared.
Consent is only valid if it is reasonable to expect that an individual to whom the organization’s activities are
directed would understand the nature, purpose and consequences of the collection, use or disclosure of the
personal information to which they are consenting. 11
Recognizing organizations’ need to collect, use and disclose personal information for reasonable purposes,
PIPEDA also contains a number of exceptions to the requirement for knowledge and consent, based on the
reality that obtaining individuals’ consent may not be appropriate in every circumstance. For example,
information may be used or disclosed without consent in an emergency that threatens the life, health or
security of an individual. Some other exceptions include investigating a breach of an agreement or
contravention of a law where seeking consent might compromise an ongoing investigation. Such exceptions
recognize that individual consent, and the autonomy it protects, do not override all other interests, but rather
that there needs to be a balance between privacy and competing values which individual consent might
undermine. 12 In this sense, as is discussed below, PIPEDA already recognizes, and accommodates, both
limitations inherent in the consent principle. Certain statutory obligations apply even if consent is not
required. For example, subsection 5(3) of PIPEDA limits the purposes for which an organization may collect,
use or disclose personal information to those that “a reasonable person would consider are appropriate in the
circumstances.” This helps ensure that individuals remain protected from inappropriate collection, use and
disclosure of their personal information even if an individual consents or where consent is not required. 13 All
other PIPEDA principles, such as safeguards and accountability, also continue to apply even where consent is
not required.
PIPEDA requires that the purposes for which an individual’s information is to be collected, used or disclosed be
explained in a clear and transparent manner. Consent must be obtained before or at the time of collection, or
when a new use of personal information has been identified. Organizations may not deny a product or service
to an individual who fails to consent to the collection, use or disclosure of information beyond that required to
fulfill an explicitly specified and legitimate purpose. At the same time, individuals should be informed of the
consequences of withdrawing consent, particularly if they are withdrawing consent to a collection, use or
disclosure of their personal information that is essential to the service they are signing up for.
PIPEDA recognizes that the form of consent can vary, taking into account the sensitivity of the information and
the reasonable expectations of the individual. Express consent is the most appropriate and respectful form of
consent to use generally, and is required when sensitive 14 information is at issue. Implied consent can be
acceptable in strictly defined circumstances. 15
_____________________________________________________________________________________________________
30 Victoria Street – 1st Floor, Gatineau, QC K1A 1H3 • Toll-free: 1-800-282-1376 • Fax: (819) 994-5424 • TDD (819) 994-6591
www.priv.gc.ca • Follow us on Twitter: @privacyprivee
3