4.1 PIPEDA & Federal Private-Sector Privacy in Investigations

Core Principle: In commercial private investigations, the collection, use, and disclosure of personal information are governed by the Personal Information Protection and Electronic Documents Act (PIPEDA). While PIPEDA establishes a fundamental right of individual privacy, Section 7 provides essential statutory exemptions that permit investigators to collect evidence without knowledge or consent when investigating legal contraventions or contractual breaches.

Private investigators in Ontario do not operate in a legal vacuum. Beyond provincial licensing standards under the Private Security and Investigative Services Act, 2005 (PSISA), every investigative agency engaged in commercial services must comply with federal privacy legislation. The primary federal statute governing the private sector is the Personal Information Protection and Electronic Documents Act (PIPEDA, Statutes of Canada 2000, Chapter 5).

---

1. Federal Scope and Legislative Jurisdiction

PIPEDA was enacted by the Parliament of Canada pursuant to its constitutional authority over "Trade and Commerce" under Section 91(2) of the Constitution Act, 1867. As a result, its scope is tied directly to commercial activity.

Application to Ontario Private Investigators

Under PIPEDA, "commercial activity" means any particular transaction, act, or conduct—or any regular course of conduct—that is of a commercial character, including the selling, bartering, or leasing of donor, membership, or other fundraising lists.

While provinces such as British Columbia, Alberta, and Quebec have enacted their own "substantially similar" provincial private-sector privacy legislation, Ontario has not enacted a general private-sector privacy statute. Consequently:

• PIPEDA directly governs all private-sector commercial organizations in Ontario, including licensed private investigation agencies, corporate security firms, and independent investigative contractors.
• When a client retains a licensed investigation agency to locate a person, investigate insurance fraud, or conduct corporate due diligence, that contract constitutes a commercial transaction, bringing the entire investigation under the statutory oversight of PIPEDA.

The Expansive Definition of "Personal Information"

Under Section 2(1) of PIPEDA, personal information is defined broadly as:

"Information about an identifiable individual."

Canadian courts and the Office of the Privacy Commissioner of Canada (OPC) interpret this definition expansively. Information relates to an identifiable individual whenever there is a serious possibility that an individual could be identified through the data, either alone or when combined with other available information. In the context of private investigations, personal information includes:

• Names, home addresses, personal email addresses, and telephone numbers;
• Age, marital status, family relationships, and personal living arrangements;
• Employment history, performance evaluations, disciplinary records, and salary details;
• Financial records, banking assets, income streams, and credit scores;
• Physical descriptions, identifying marks, and vehicle licence plate numbers;
• Audio recordings, telephone recordings, and visual surveillance footage capturing an individual's face, movements, habits, and daily routines.

---

2. The 10 Fair Information Principles (Schedule 1)

PIPEDA is built upon the Canadian Standards Association's Model Code for the Protection of Personal Information, recognized as the 10 Fair Information Principles codified in Schedule 1 of the Act. Every private investigation agency must structure its information-handling workflows around these ten core tenets:

---

3. Statutory Investigative Exemptions: Section 7

Under ordinary commercial circumstances, Principle 3 mandates prior knowledge and consent before an organization can collect personal data. However, requiring a private investigator to obtain written consent from a subject suspected of embezzlement or fraudulent disability claims would defeat the entire purpose of the inquiry.

To reconcile individual privacy rights with legitimate civil and commercial investigations, Parliament enacted explicit statutory exemptions under Section 7 of PIPEDA.

PIPEDA s. 7: KEY EXCEPTIONS TO KNOWLEDGE AND CONSENT

Collection - s. 7(1)
  (b)   investigating a breach of an agreement or a contravention of
        Canadian/provincial law, where consent would compromise the
        availability or accuracy of the information
  (b.1) information in a witness statement needed to assess,
        process or settle an insurance claim
  (d)   publicly available information specified by regulation

Disclosure - s. 7(3)
  (a)   to the organization's own lawyer
  (c)   to comply with a subpoena, warrant, court order or rules of court
  (c.1) to a government institution that requests it and identifies
        its lawful authority
  (d)   on the organization's initiative, to a government institution,
        if it has reasonable grounds to believe the information
        relates to a contravention of law
  (d.1) to another organization, where reasonable for investigating
        a breach of an agreement or contravention of law and consent
        would compromise the investigation

Non-Consensual Collection: Section 7(1)(b)

Under Section 7(1)(b), an organization may collect personal information without the knowledge or consent of the individual only if:

1. The collection is clearly reasonable for purposes related to investigating a breach of an agreement (such as an insurance policy, commercial contract, or employment agreement) or a contravention of the laws of Canada or a province (such as insurance fraud, theft, or breach of fiduciary duty); and
2. It is reasonable to expect that the collection with the knowledge or consent of the individual would compromise the availability or the accuracy of the information.

Both prongs must be met. An investigator cannot collect personal information without consent simply because doing so is faster or cheaper. There must be an objective, articulable basis demonstrating a potential breach of contract or violation of law.

Non-Consensual Disclosure: Section 7(3)

Section 7(3) governs when an organization may disclose personal information without consent. The provisions investigators use most are:

• s. 7(3)(a): to a lawyer representing the organization;
• s. 7(3)(c): to comply with a subpoena, warrant or court order, or with rules of court on producing records;
• s. 7(3)(c.1): to a government institution that has requested the information, identified its lawful authority and indicated a listed purpose, such as enforcing a law;
• s. 7(3)(d): on the organization's own initiative, to a government institution, where it has reasonable grounds to believe the information relates to a contravention of the laws of Canada, a province or a foreign jurisdiction; and
• s. 7(3)(d.1): to another organization, where the disclosure is reasonable for investigating a breach of an agreement or a contravention of law and consent would compromise the investigation.

Together, these rules let an agency report findings to its client's lawyer, respond to a court order, and share fraud evidence with police or another organization's investigation.

Publicly Available Information and the Retired "Investigative Body" Rules

The Regulations Specifying Publicly Available Information (SOR/2001-7) list five classes that may be collected, used and disclosed without consent, but only for the purpose for which the information is public:

1. telephone directory listings, where the subscriber could have opted out;
2. professional or business directories, listings or notices;
3. statutory registries with a legal right of public access;
4. records of judicial or quasi-judicial bodies available to the public; and
5. publications such as magazines, books and newspapers, where the individual provided the information.

The ministry's study guide still refers to the Regulations Specifying Investigative Bodies (SOR/2001-6), which once let licensed investigation firms with a CSA Model Code privacy policy exchange information without consent. That regulation was repealed in 2016 (SOR/2016-63). The Digital Privacy Act (S.C. 2015, c. 32) replaced the "investigative body" concept with s. 7(3)(d.1) and (d.2). If an exam question uses the older wording, recognize that it describes the same idea: limited non-consensual sharing for investigations.

---

4. The Section 5(3) 'Reasonable Person' Standard and Covert Surveillance

Even when an investigation falls squarely within the statutory exemptions of Section 7(1)(b), an investigator does not have unlimited discretion to conduct intrusive surveillance. Section 5(3) of PIPEDA establishes an overarching qualitative constraint:

Section 5(3): "An organization may collect, use or disclose personal information only for purposes that a reasonable person would consider are appropriate in the circumstances."

The OPC Four-Part Test for Covert Video Surveillance

The Office of the Privacy Commissioner (OPC) developed a four-part reasonableness test for video surveillance, which the Federal Court applied in Eastmond v. Canadian Pacific Railway, 2004 FC 852 (a workplace camera case). The OPC's guidance on covert video surveillance in the private sector applies the same thinking to investigators: covert surveillance is intrusive and must be justified.

1. Demonstrable Necessity: Is the covert surveillance demonstrably necessary to meet a specific, legitimate business need or solve a genuine evidentiary dispute? There must be credible, preexisting evidence of wrongdoing, such as inconsistent disability claims or suspicious financial discrepancies. Covert surveillance cannot be used as a routine "fishing expedition" or standard onboarding check.
2. Effectiveness: Is the surveillance likely to be effective in meeting that specific need? The investigative method must have a realistic probability of gathering relevant evidence regarding the suspected breach.
3. Proportionality: Is the severity of the privacy loss proportional to the benefit gained? The inquiry must weigh the degree of intrusiveness against the value of the information sought. Zooming into bedroom windows, trailing a subject into private locker rooms, or recording intimate domestic activities fails the proportionality test.
4. Exhaustion of Less Invasive Alternatives: Were less privacy-invasive investigative alternatives considered and exhausted? The investigator and retaining client must show that standard audits, interviews, documentation reviews, or medical evaluations were either attempted or would have been demonstrably futile before initiating covert physical surveillance.

---

5. Commercial Inquiries vs. Internal Employment Records

A critical distinction arises regarding employment privacy under PIPEDA:

• Federally Regulated Employees: PIPEDA explicitly applies to personal information collected, used, or disclosed about employees of federally regulated undertakings (e.g., banks, telecommunications carriers, airlines, interprovincial trucking companies).
• Provincially Regulated Employees in Ontario: PIPEDA does not directly govern the internal employment records of provincially regulated Ontario companies (e.g., local retailers, manufacturers, restaurants). However, the moment a provincially regulated employer hires an external, commercial private investigation agency, the agency's commercial relationship brings the third-party investigative collection under PIPEDA.

Investigators handling corporate workplace inquiries must therefore adhere strictly to PIPEDA standards, ensuring that internal surveillance or skip tracing does not exceed the commercial mandate or infringe common law privacy rights.

---

6. OPC Complaints and Federal Court Remedies

When a member of the public believes an investigator or commercial enterprise has breached PIPEDA, they may seek administrative and judicial redress:

Privacy Breach Occurs ──► Complaint to Privacy Commissioner (OPC) ──► Investigation & Report ──► Application to Federal Court ──► Court Orders & Damages

1. Office of the Privacy Commissioner of Canada (OPC): The OPC acts as an independent ombudsman. It investigates complaints, mediates disputes, and publishes formal findings and recommendations. The OPC does not issue binding financial penalties directly, but its reports carry significant legal authority.
2. Application to the Federal Court of Canada: Under Section 14 of PIPEDA, a complainant (or the Privacy Commissioner with the complainant's consent) may apply to the Federal Court of Canada for a formal hearing following an OPC investigation.
3. Federal Court Remedies: Under Section 16, the Federal Court possesses extensive statutory powers. The Court may:
   • Order an organization to correct its information-handling practices and cease unlawful collection;
   • Order the publication of a public notice detailing the violation; and
   • Award substantial monetary damages to the complainant, including damages for humiliation, mental anguish, and loss of dignity.

For Ontario private investigators, a finding of non-compliance not only exposes the agency to civil damages in Federal Court, but can also trigger a regulatory complaint to the Registrar under PSISA for professional misconduct.