Anonymised, illustrative composite. Two hundred and fourteen personnel files went up on day one, under an agreement that said nothing about destroying them. The bidder was entirely bona fide, which is why this is not a leak problem.
At a glance
A family-owned interprovincial trucking, cross-dock and warehousing group went to market with one strategic buyer already identified. The buyer was credible and made no attempt to misuse anything. The finance director populated the data room over a weekend.
Into the Human Resources folder went 214 complete personnel files exactly as they sat on the shared drive — social insurance numbers, dates of birth, home addresses, driver abstracts, medical accommodation notes and two garnishment orders — and into folder 9 a full export of the customer system.
Nobody had asked what permitted the disclosure. The agreement was a standard mutual NDA: a non-disclosure covenant, a permitted-purpose clause, and a duty to return or destroy materials on written request. That qualifier was the defect.
Because the group is a federal work, undertaking or business, employee information was in scope too — and personnel files hold medical and financial details about people who do not yet know the business is for sale.
Of the 214 employee files, 41 held plainly sensitive information; of the 41,000 customer records, roughly 3,100 belonged to sole proprietors, so the “business contact” framing did not apply.
Remediation cost $46,000 and eleven days: folders closed, an amending agreement executed, a redaction pass across all 214 files, and the room rebuilt with role, hire date, salary band and notice entitlement but no identifiers. Eleven key employees were disclosed unredacted only at confirmatory diligence.
Why PIPEDA reaches the employee files at all: s.4(1)(a) of Personal Information Protection and Electronic Documents Act applies the Part to information handled in the course of commercial activities, and s.4(1)(b) extends it to information “about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business” — a term s.2(1) defines to include “a railway, canal, telegraph or other work or undertaking that connects a province with another province, or that extends beyond the limits of a province” (s.2(1)). Interprovincial trucking sits inside that. For a purely intra-provincial business the employee files would be outside PIPEDA — which changes the governing law, not the sensitivity.
Section 7.2(1) is the permission the deal was relying on without knowing it: “organizations that are parties to a prospective business transaction may use and disclose personal information without the knowledge or consent of the individual if” two things hold. First, an agreement requiring the recipient (i) “to use and disclose that information solely for purposes related to the transaction”; (ii) “to protect that information by security safeguards appropriate to the sensitivity of the information”; and (iii) “if the transaction does not proceed, to return that information to the organization that disclosed it, or destroy it, within a reasonable time”. Second, that the information is necessary to the decision and to completion.
Read the three covenants as a conjunctive test, because that is how they are written. This NDA had (i) in substance and (ii) arguably. It did not have (iii): a duty to return or destroy on written request is not a duty to return or destroy if the transaction does not proceed. One missing covenant means the exception is not engaged — and then the disclosure needed knowledge or consent, which nobody had obtained from 214 people.
Two further subsections are routinely overlooked. Section 7.2(3): “An organization shall comply with the terms of any agreement into which it enters under paragraph (1)(a) or (2)(a).” And s.7.2(2)(c) survives closing — the completed-transaction permission requires that “one of the parties notifies the individual, within a reasonable time after the transaction is completed”. That belongs on the closing checklist.
Section 7.2(4) marks the outer boundary: subsections (1) and (2) “do not apply to a business transaction of which the primary purpose or result is the purchase, sale or other acquisition or disposition, or lease, of personal information”. A deal for a customer database dressed up as a deal for a business gets nothing from this section.
The provincial variations are not cosmetic. Alberta’s Personal Information Protection Act covers the same ground at s.22 and defines a business transaction more broadly — including “the taking of a security interest in respect of, an organization” or a portion of one. Granting security is inside the Alberta definition and absent from PIPEDA s.7.2, and s.22(4) makes destruction or return on a failed transaction a statutory duty rather than a contractual one.
Quebec differs again. Section 18.4 of the Act respecting the protection of personal information in the private sector permits communication only under a prior agreement stipulating four undertakings, including “to destroy the information if the commercial transaction is not concluded”. Its “commercial transaction” extends to “the obtaining of a loan or any other form of financing by the enterprise or of a security taken to guarantee any of its obligations”, and the notification duty falls on the recipient: “Within a reasonable time after the commercial transaction is concluded, that party must notify the person concerned that it now holds personal information concerning him because of the transaction.”
One correction, because it gets repeated. Quebec does not require a privacy impact assessment before communicating personal information in a business transaction — s.18.4 requires an agreement. The assessment duty sits in s.3.3 and attaches to a different thing: an enterprise “must conduct a privacy impact assessment for any project to acquire, develop or overhaul an information system or electronic service delivery system”. An acquisition can trigger s.3.3 through the systems acquired; the transaction itself does not.
Counsel caught it in week two, reviewing the NDA against the disclosure schedule. The HR folder closed that afternoon, an amending agreement in the terms of s.7.2(1)(a) was signed within four days, and the rebuild went live on day eleven.
The deal closed and s.7.2(2)(c) notice went out three weeks later. Compare a data room leak that reached a competitor — a different failure with a different statute behind it, where the harm came from who saw the information rather than from whether there was any authority to disclose it. See also what a buyer should refuse to sign in an NDA.
The three covenants in s.7.2(1)(a) are a paragraph of drafting. Without them, had the deal died with the files still in the buyer’s environment, the seller would have had no contractual route to compel deletion and no statutory permission for having sent them — the shape in which a Commissioner complaint arrives.
The tell is a data room index with a folder called “Personnel Files” and an NDA that never uses the words “personal information”. A confidentiality agreement is not a s.7.2 agreement; only one engages the exception.
A 30-minute call is enough to tell you whether AI pays for itself here.
Canadian small-business transaction data is not published anywhere, so most valuations in this country quote an American benchmark. The Deavo–Treadstone Acquisition Index is a daily record of Canadian listings built to replace that: asking-price distributions by province and city are published now, and days on market, departure rates and asking-to-sale spreads follow as the series lengthens. Leave an email and we will tell you as each measure lands.
No pitch, no listings. One email when the first report lands.
