IAPP Certified Information Privacy Professional, Canada

Commissioners carry much of Canada’s privacy oversight. You study their powers to investigate, mediate and report, how complaints move through the system, and what recourse remains in the courts.

• The Privacy Commissioner of Canada and its role
• Provincial and territorial commissioners
• Complaints, investigations and findings
• Compliance agreements and audits
• Court remedies and damages
• Learning from published findings

You build A case brief of one commissioner’s finding, with the practices it requires.

Canadian law rests on principles older than any one statute. You work through the CSA Model Code’s principles and see how each reappears in private, public and health sector rules.

• The origins of privacy principles in Canada and abroad
• Accountability and identifying purposes
• Consent, limiting collection and limiting use
• Accuracy, safeguards and openness
• Individual access and challenging compliance
• The principles across the three sectors

You build A principles checklist that tests a data practice against the Model Code.

PIPEDA governs most private-sector handling of personal information in Canada. You decide when it applies, set up accountability, and handle consent, including implied consent and withdrawal.

• Scope: commercial activity and federal works
• Personal information and what is excluded
• Accountability and the privacy officer
• Identifying purposes and the reasonable person test
• Forms of consent: express, implied and withdrawn
• Exceptions to consent

You build A consent design for a customer-facing service, tested against PIPEDA.

The remaining principles set daily practice. You limit collection, use and retention, safeguard information, answer access requests, report breaches that create a real risk of significant harm, and manage service providers.

• Limiting collection, use, disclosure and retention
• Safeguards proportionate to sensitivity
• Access and correction requests
• The real risk of significant harm test
• Breach records and reporting
• Service providers and cross-border processing

You build An access-request procedure and a breach reporting decision tree.

Alberta, British Columbia and Quebec have their own private-sector laws. You identify when a provincial law is substantially similar and displaces PIPEDA, and learn what is distinct in each, including Quebec’s newer rules.

• Substantially similar legislation and what it means
• Alberta’s Personal Information Protection Act
• British Columbia’s Personal Information Protection Act
• Quebec’s private sector law and its recent changes
• Employee personal information rules
• Operating across provinces

You build A comparison of the three provincial private-sector laws and PIPEDA.

CASL regulates commercial electronic messages, and also software installation and address harvesting. You apply its consent, identification and unsubscribe duties, and learn how it is enforced.

• Scope: commercial electronic messages
• Express and implied consent
• Message content, identification and unsubscribe
• Installing computer programs and consent
• The CRTC, Competition Bureau and Privacy Commissioner
• Designing a compliant email program

You build A CASL-compliant consent and unsubscribe process for a marketing program.

Governments follow different rules from businesses. You study the federal Privacy Act, access to information, provincial and territorial equivalents, and the privacy impact assessments that public bodies complete.

• The Privacy Act: collection, use and disclosure
• Access to information and the balance with privacy
• Provincial and territorial public sector laws
• Consent, access and correction in the public sector
• Data management and sharing between agencies
• Privacy impact assessments for government programs

You build A privacy impact assessment for a public sector program.

Health information is protected mainly by provincial statutes. You apply the definitions, custodian duties, consent rules, access and correction rights, safeguards and breach protocols that health privacy acts share.

• Provincial health privacy acts and their scope
• Personal health information and custodians
• Consent models: the circle of care and express consent
• Access, correction and fees
• Safeguards, agents and third-party service providers
• Breach notification and reporting to commissioners

You build A health privacy compliance guide for a clinic.

A single scenario crosses sectors and provinces. You advise a company with commercial, public sector and health lines of business, decide which laws apply, and plan for access requests, breaches and messaging.

• Facts, jurisdictions and sectors
• Choosing the governing laws
• Mapping duties across the principles
• Planning breach and request handling
• Writing the advice to the client

You build A written compliance opinion for a multi-province organization.