The Application of PIPEDA to Municipalities, Universities, Schools, and Hospitals

December 2015

Our office is frequently asked about the application of the Personal Information Protection and Electronic Documents Act (PIPEDA) to the activities of municipalities, universities, schools, and hospitals, often referred to as the "MUSH" sector.

The Application of the Act

PIPEDA applies to every organization that collects, uses or discloses personal information in the course of commercial activities. PIPEDA defines commercial activity as:

"any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists."

The OPC’s interpretation bulletin on commercial activity summarizes the general principles that have emerged from court decisions and the Commissioner’s findings to date.

The term organization "includes an association, a partnership, a person and a trade union." The definition of organization is intended to be broad and inclusive.

The federal government may exempt organizations and/or activities in provinces that are deemed to have adopted substantially similar privacy legislation. In those provinces that have passed substantially similar legislation, PIPEDA will continue to apply to the federally regulated private sector — such as banks, airlines, telephone and broadcasting companies, and railways — and to personal information in interprovincial and international transactions by all organizations engaged in commercial activities. To date, Quebec, British-Columbia, Alberta, and, in matters relating to health care, Ontario, New Brunswick and Newfoundland and Labrador, have promulgated legislation deemed substantially similar to the federal law.

PIPEDA and the MUSH Sector

The Constitution Act, 1867 gives the provinces authority over municipal institutions, education and hospitals. PIPEDA is based on the federal government's jurisdiction over "the regulation of trade and commerce."

While municipalities, educational institutions and hospitals may occasionally provide services on a fee basis, they are not, on the whole, engaged in trade and commerce as contemplated by the Canadian Constitution. Furthermore, these institutions are completely or largely dependent on municipally or provincially levied taxes and provincial grants.

As a result, our Office is of the view that, as a general rule, PIPEDA does not apply to the core activities of municipalities, universities, schools, and hospitals. By core activities we mean those activities that are central to the mandate and responsibilities of these institutions.

Providing a service for a fee does not necessarily trigger the application of the Act if the service is part of the institution's core activities. For example, charging a fee for a private room or charging extra for a fiberglass cast does not automatically make a hospital or even that transaction subject to the Act. Similarly, a municipality can charge a per bag fee to collect garbage, or charge for the use of a playing field or arena, without becoming subject to the Act.

A municipality, university, school or hospital may become subject to the Act when it engages in a non-core commercial activity, unless substantially similar provincial legislation applies. For example, if a university sold or bartered an alumni list, that activity would be considered a commercial activity and that particular transaction would be subject to the Act. As well, personal information collected by a university or a hospital in the course of operating a parking garage would probably be subject to the Act since this would not be considered a core activity.

A coffee shop in a hospital or university, a TV rental service in a hospital, a university bookstore or any other business conducting commercial activity operated by a third party within one of these institutions would be subject to the Act, unless substantially similar provincial legislation applies.

Private educational institutions and private hospitals are in a different situation. Generally speaking, many of these institutions are more clearly engaged in commercial activities and we would recommend that they operate on the assumption that they are subject to PIPEDA, unless substantially similar provincial legislation applies.

Provincial and Territorial Legislation

In many provinces, personal information collected by municipalities, universities, schools and hospitals is protected by provincial legislation. Typically, this is public sector legislation, often a Freedom of Information and Protection of Privacy Act. In several cases, health information protection acts and private sector acts may also apply. Here is additional information on relevant provincial legislation.

In the health sector, the core activities of public hospitals or publicly funded long-term care facilities are not subject to PIPEDA. However, health care providers in private practice such as doctors, dentists and chiropractors are engaged in a commercial activity and thus subject to the Act, unless substantially similar provincial legislation applies.

Alberta, New Brunswick, Newfoundland, Nova Scotia, Saskatchewan, Manitoba and Ontario have enacted personal health information legislation that applies to the health care sector, including hospitals. Quebec's Act respecting health services and social services also contains important provisions regarding personal health information. British Columbia has several laws that address health information privacy. The Northwest Territories, PEI and Yukon have adopted personal health information laws that have yet to come into force.

The situation in the three Territories is somewhat more complex. PIPEDA applies to all federal works, undertakings and businesses (FWUBs) and to the personal information of employees of, and applicants for employment with, FWUBs. A FWUB is "any work, undertaking or business that is within the legislative authority of Parliament.

Since all organizations in the Territories are considered to be FWUBs, PIPEDA applies to information about employees of municipalities, universities, schools and hospitals in the Territories.

However, PIPEDA does not apply to patient or student information in publicly funded hospitals or schools in the Territories because they are not considered to be engaged in commercial activities.

Health information protection acts may also apply. Here is additional information on relevant provincial and territorial legislation.

Updated in December 2015