15.1 Alberta PIPA, OIPC Breach Reporting & Database Handling
Key Takeaways
Alberta PIPA generally applies to local brokerage handling of personal information. PIPEDA applies to federally regulated businesses and cross-border commercial flows.
Collect only what reasonably serves the purpose, identify the applicable consent or legal authority, and apply Rule 44 to covered brokerage disclosures.
PIPA section 34.1 requires notice to the Commissioner without unreasonable delay when a reasonable person would see a real risk of significant harm, even to one person.
PIPA section 37.1 allows the Commissioner to require notice to affected individuals. The OIPC also encourages prompt voluntary notice when appropriate.
Apply every relevant retention period, then destroy the records or render personal information non-identifying within a reasonable time once the legal and business need ends.
Privacy, confidentiality and brokerage records
Alberta’s Personal Information Protection Act (PIPA) generally governs a provincially regulated brokerage’s handling of information about identifiable individuals in Alberta. A prospect’s contact details, a visitor sign-in, a tenant credit report and an employee’s personnel record can contain personal information. PIPA has specific rules for personal employee information. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to federally regulated businesses and to personal information that crosses provincial or national borders in commercial activity. Its Schedule 1 lists ten fair information principles, accountability, identifying purposes, consent, limiting collection, limiting use, disclosure and retention, accuracy, safeguards, openness, individual access and challenging compliance. Apply the Alberta statute’s own provisions to a local brokerage file.
Confidential information under the Real Estate Act Rules includes information about the client, their finances or personal situation, their property and the transaction. It can include terms and strategy that need protection even apart from PIPA. Rule 44 permits disclosure of information about a client, property or transaction when the client authorizes it or the law requires it, in addition to applicable privacy law. Rule 42(c) limits use of confidential information to the purpose for which it was obtained. Discuss unusual disclosures, competing obligations and cross-border processing with the brokerage privacy lead and seek legal advice where needed.
Choose the right consent and use only what is needed
| Situation | Apply the rule |
|---|---|
| Asking for an applicant’s personal records | PIPA sections 7 and 11 generally require consent and a reasonable purpose. Collect only what reasonably serves that purpose. Section 13 normally requires notice of the purpose and a name or position that can answer questions, before or at direct collection. |
| Express consent | Section 8(1) permits oral or written consent. For sensitive information, record the person’s specific authorization, purpose and recipients in writing as a prudent safeguard. |
| Voluntary disclosure for an apparent purpose | Under section 8(2), a person who voluntarily gives information for a purpose can be deemed to consent where it is reasonable to provide it. For example, a phone number supplied to arrange a showing can be used for that showing. Section 13(4) exempts that form of collection from its ordinary notice requirement. |
| Notice with a reasonable chance to decline | Section 8(3) permits this route where the notice is understandable, the person has a reasonable opportunity and time to object, no objection is made, and the information’s sensitivity and circumstances make the use reasonable. Apply the separate federal electronic marketing rules before sending a promotional message. |
| Disclosure to a service provider | Confirm the applicable legal basis and the scope of any client authorization. Rule 45 requires written disclosure and retention of a copy for compensated referrals. When referring to someone believed to be a licensee, take reasonable steps to verify their authority for the referred activities. RECA recommends informed written consent before sharing personal information for a referral. |
The brokerage designates one or more people responsible for compliance under section 5 and develops and follows reasonable policies under section 6. Outsourcing does not end its responsibility for the provider’s handling of the information. Sections 6 and 13.1 also address policy and notice when using a service provider outside Canada. Apply section 33 accuracy and section 34 reasonable safeguards. For example, limit customer relationship management (CRM) access to people who need the data, separate open-house entries and keep sensitive documents off personal spreadsheets. Use listing feeds and photos within the applicable permissions. RECA ProCheck is a public licensing lookup and links to disciplinary decisions. RECA’s Enforcement Actions page publishes decisions for five years and offers a request process for older decisions. A public listing or lookup has a different purpose from a private brokerage file.
Respond to an owner’s access request
A homeowner asks the brokerage for the whole offer file, including the buyer’s financing records. Route the request to the privacy lead and confirm the requester’s identity or authority. PIPA sections 24 and 26 allow a written request with enough detail to find the owner’s own personal information. Record when the request arrives and help the owner narrow it if needed. Search records in the brokerage’s custody or control. Under section 24, protect another individual’s information and sever it where reasonably possible so the owner can receive the accessible portion. An owner can separately be entitled to a true copy of a transaction document under the real estate Rules. Confirm that duty without opening the rest of the file.
Respond accurately and completely as reasonably possible under section 27. Section 28 generally allows 45 days after receipt of the written request, subject to applicable statutory timing rules. Section 31 permits an extension on specified grounds with notice. If the brokerage refuses any part of the requested access to personal information, section 29 requires reasons, the applicable provision, a contact and notice of the right to seek review by the Commissioner.
Protect confidential discussions during a showing
Before a showing, ask the listing brokerage whether recording is in use, what areas it covers and whether it includes audio. Tell your client what is confirmed and what remains uncertain. Agree to discuss the client’s price, motivation or financing in a private location away from the property’s recording devices. If the client wants more privacy, ask whether the owner will turn off a device or arrange an alternative viewing. Leave the equipment as found.
If a brokerage operates a showing camera, check the reasonable purpose, applicable consent and notice, coverage and retention, and restrict access to recordings. The OIPC’s private-sector surveillance guidance addresses that commercial setting. PIPA section 4(3)(a) separately excludes collection, use or disclosure solely for an individual’s personal or domestic purposes. A device’s presence alone does not establish its purpose or whether the exclusion applies.
Retain records for the applicable purpose and period
PIPA section 35 allows retention while reasonably needed for legal or business purposes. Within a reasonable time after that need ends, destroy the records or render the personal information non-identifying. The Real Estate Act section 25(9) separately requires business and accounting records to be kept in Alberta for at least three years from creation, or longer if the executive director directs in a particular investigation or prosecution. Apply any additional legal duty. For example, FINTRAC requires a real estate information record to be kept for five years from the last business transaction and a receipt-of-funds record for at least five years from creation. Record type and trigger determine the disposal date.
Assess and respond to a breach
Under PIPA section 34.1, notify the Commissioner without unreasonable delay after a loss or unauthorized access or disclosure where a reasonable person would see a real risk of significant harm. Consider what was exposed and the likelihood that it could cause significant harm, such as identity theft, financial loss or reputational harm. One affected person can meet the test. Contain the incident, preserve evidence, assess the risk and document the decision. The notice under Regulation section 19 includes the circumstances and timing, the information, risk assessment, estimated number at risk, actions taken and a contact.
Section 37.1 allows the Commissioner to require individual notice and set the time. Regulation section 19.1 specifies the contents and generally calls for direct notice unless the Commissioner authorizes indirect notice. The OIPC encourages organizations to notify affected people promptly on their own initiative when the risk warrants it. For example, an unencrypted drive containing usable bank and identity data lost in public warrants immediate internal escalation and assessment. Reporting to the OIPC and warning affected clients are distinct steps.
Official sources
A brokerage accidentally emails a buyer’s driver’s licence scan and mortgage pre-approval to an unknown external recipient. The message cannot be recalled. What does PIPA require if a reasonable person would find a real risk of significant harm?
Wait for the buyer to show evidence of actual identity theft.
Notify the Alberta Information and Privacy Commissioner without unreasonable delay.
Notify the buyer only and close the incident file.
Notify RECA only because a single person’s records were involved.
Two months after closing, a seller asks the brokerage to delete the purchase contract and trust ledger and the required FINTRAC receipt-of-funds record. Which response properly applies Alberta retention and federal recordkeeping?
Delete the file because withdrawal of consent ends every retention duty.
Keep all three records for two months from the seller’s request, then delete them.
Delete the receipt-of-funds record as soon as the provincial three-year period ends.
Safeguard the records and apply each legal minimum, including three years from creation under the Real Estate Act and at least five years from creation for the FINTRAC receipt-of-funds record.
A homeowner asks to verify an associate’s licence and also requests unrestricted access to the brokerage’s customer relationship management records. How should the brokerage respond?
Direct the homeowner to RECA ProCheck for licensing and route any request for the homeowner’s own personal information through the brokerage’s privacy lead.
Publish the transaction portal because public licence verification makes client files public.
Grant unrestricted database access if the homeowner agrees to use it only for a sale.
Direct the homeowner to ProCheck for all client correspondence and tax documents.
Sections you finish are checked off in the contents.