Knowing the Law About Document Destruction
There is a lot of information that can be found online about the multitude of regulations and legislation that companies must abide by in the United States including HIPAA, FACTA and others but those don’t directly relate to Canadian business. Finding information about Canadian laws can sometimes be more difficult but not being informed can prove costly to your business. In this post we’d like to shed some light on what government regulations govern privacy and document destruction standards in Canada.
In Canada, everyone is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA). It provides guidelines for business on the collection, use and disclosure of personal information collected for the purpose of commercial activity. This relates to a variety of factors but also relates to the destruction of confidential documents.
The Privacy Commissioner of Canada oversees PIPEDA and covers all provinces unless they have provincial legislation that meets the same standards of PIPEDA. As of 2010, Quebec, Alberta and British Colombia are the only provinces to have their own legislation regarding privacy. In British Colombia businesses and citizens are protected under the Personal Information Protection Act, which was established in 2003.
The full Personal Information Protection Act can be read here but one of the most important things to read is quoted below:
“Retention of Personal Information:
35 (1) Despite subsection (2), if an organization uses an individual’s personal information to make a decision that directly affects the individual, the organization must retain that information for at least one year after using it so that the individual has a reasonable opportunity to obtain access to it.
(2) An organization must destroy its documents containing personal information, or remove the means by which the personal information can be associated with particular individuals, as soon as it is reasonable to assume that
(a) the purpose for which that personal information was collected is no longer being served by retention of the personal information, and
(b) retention is no longer necessary for legal or business purposes.”
Shredding can be done in-house, but can be costly if you leave it to untrained employees who may look to speed up the process by disposing of documents in the trash instead of shredding; leaving your business open to devastating risks. The best way to ensure your business is in compliance with the Personal Information Protection Act and PIPEDA is to work together with professionals who know the industry. Best Shredding can work with you to provide the best solution for your business and its document destruction needs. If you would like to know more about how document destruction relates to either one of these Acts please contact us today and we’ll be happy to help.