Selling Into a Province With Its Own Rules

The architecture, briefly

Canada has federal private sector privacy legislation applying to personal information collected, used or disclosed in the course of commercial activity.

Three provinces have enacted their own private sector legislation, which has been recognised as substantially similar and which applies to organisations operating within those provinces.

Several provinces also have separate legislation covering health information, which operates independently of both.

That is the shape. What follows is a general description rather than legal advice, and which regime applies to a particular business is a question for somebody qualified.

The question people actually ask

Whether selling to somebody in another province brings you under that province's law.

The short answer is that it depends on where your organisation operates rather than only on where your customer lives, and that the federal legislation continues to apply to information crossing provincial or national borders in the course of commercial activity.

So a business in one province shipping to another is not straightforwardly subject to every provincial regime in the country.

The recently assented Quebec legislation is the one prompting most of these questions, because its scope provision refers to enterprises carrying on an enterprise in Quebec, which is broader than having premises there.

That is precisely the sort of question worth putting to a professional rather than deciding from an article.

What substantially similar means in practice

• The same core principles run through all of them.
• Collect only what you need, for a stated purpose.
• Be open about what you collect and why.
• Obtain appropriate consent.
• Keep it secure and only as long as necessary.
• Let people see what you hold and correct it.

A business meeting those properly is in reasonable shape under any of the regimes, which is why the practical answer for most small businesses is less complicated than the legal picture.

Where the differences bite

The edges are where jurisdiction genuinely matters, and there are a handful worth knowing about.

Employee information is treated differently: the provincial regimes generally cover employee personal information for organisations within them, whereas the federal legislation covers it only for federally regulated businesses.

Breach reporting thresholds, timing, and record-keeping requirements are not identical.

Consent standards vary in their detail, particularly around what counts as sensitive.

And the Quebec reform introduces obligations that have no direct equivalent elsewhere yet, including impact assessments and rules on automated decisions.

For a small business the employee point is frequently the most immediately relevant, because it is the one people do not expect.

Health information is separate again

Worth stating clearly because it catches businesses that are not healthcare providers.

Several provinces have dedicated health information legislation with its own custodians, rules, and regulators.

That regime can reach businesses that handle health information incidentally: an occupational health arrangement, a wellness programme, a fitness or therapy business, or a supplier processing information for a clinic.

If health information passes through your business in any form, the applicable rules are probably not the ones you have been reading about, and that is worth establishing specifically.

A worked example

A supplier in one province, selling to customers in several, asked which privacy law they were subject to.

The honest answer required their lawyer, and it took about an hour of her time.

The result was straightforward: their commercial activity crossing provincial borders fell under the federal legislation, their employee records fell under their own province's regime because they operated there, and their Quebec sales raised a question worth revisiting as the new obligations phase in.

What they did in the meantime was practical rather than jurisdictional. They wrote one privacy policy describing what they actually did, met the higher standard where regimes differed, and named somebody responsible.

The owner's view was that the hour with the lawyer had mostly bought certainty about what not to worry about.

Build to the higher standard

The approach that avoids most of this becoming a project.

Where two regimes differ, meeting the more demanding one satisfies both, and the additional effort is usually small.

A single clear privacy policy, one retention schedule, one process for requests, and one incident procedure will serve across regimes far more efficiently than attempting to vary practice by customer location.

Varying by province is impractical for a small business anyway: you would have to know where every individual was, keep that current, and apply different rules to different records.

One consistent standard, set at the higher level, is both simpler and easier to describe honestly.

When to get advice

Worth naming so this is proportionate rather than either ignored or over-lawyered.

If you employ people in more than one province.

If you handle health information in any capacity.

If you sell substantially into Quebec, particularly as the new obligations approach.

If you are in a regulated profession with its own requirements layered on top.

Or if a customer, insurer, or public body asks you to confirm your position in writing, which is when a guess becomes a representation.

Otherwise, the general standard described above is a reasonable place for a small business to operate from.

The counter-case

Jurisdictional analysis can become a way of avoiding the actual work.

A business that spends three months establishing precisely which regime applies, while holding nine years of unencrypted customer data on a laptop, has answered an interesting question and improved nothing.

The obligations that matter most in practice are common to every regime, and they are the ones with practical consequences: knowing what you hold, keeping it securely, not keeping it forever, and being able to respond when somebody asks.

Do those first. The jurisdictional question determines the detail rather than the direction.

And for many small businesses the answer, once obtained, changes very little about what they should actually do.

The practical position

1. Assume the common principles apply to you.
2. Write one policy describing what you actually do.
3. Meet the higher standard where regimes differ.
4. Check the employee information point for your province.
5. Establish separately whether health rules reach you.
6. Get advice if you sell substantially into Quebec.
7. Do the practical work before the legal analysis.

Step seven is the one worth insisting on, since the practical work is required under every regime and does not depend on the answer.

The Quebec reform is covered in Quebec passed a privacy law this month.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.