Start with the application section, not the exception. PIPEDA section 4(1)(b) reaches employee personal information only where the employer operates “a federal work, undertaking or business”. For a bank or an airline, section 7.2 governs the personnel files in your data room. For an ordinary Ontario target it does not, and nothing provincial replaces it.
Key takeaways
SECTION 01 OF 10
Section 7.2(1) lets “organizations that are parties to a prospective business transaction” “use and disclose personal information without the knowledge or consent of the individual”. Its mechanics are worked through in the sibling piece on customer data.
What gets missed is structural. It opens “In addition to the circumstances set out in subsections 7(2) and (3)”: a carve-out from a consent requirement PIPEDA imposes. The question about a personnel file is therefore not whether section 7.2 covers it, but whether PIPEDA reaches it.
SECTION 02 OF 10
Section 4(1) applies Part 1 to personal information that “the organization collects, uses or discloses in the course of commercial activities”, or that “is about an employee of, or an applicant for employment with, the organization and that the organization collects, uses or discloses in connection with the operation of a federal work, undertaking or business”.
The Privacy Commissioner reads it that way: “PIPEDA only applies to personal information of employees of, and applicants for employment with, federal works, undertakings or businesses.” That is the Commissioner’s position, which the same page calls “not binding legal interpretations, but rather, are intended as a guide for compliance with PIPEDA.”
SECTION 03 OF 10
Section 2(1) defines the term as “any work, undertaking or business that is within the legislative authority of Parliament”, listing examples that include aircraft, radio broadcasting and “a bank or an authorized foreign bank”.
The OPC draws the consequence: “PIPEDA also applies to the personal information of employees of federally-regulated businesses.” That is its own summary, not statutory text. Personnel files sit inside PIPEDA at an interprovincial trucking firm, a telecom or a chartered lender; at a manufacturer or a professional practice they do not.
SECTION 04 OF 10
Alberta starts at the other end. Its Personal Information Protection Act, section 4(1): “Except as provided in this Act and subject to the regulations, this Act applies to every organization and in respect of all personal information.” No commercial-activity filter, no employee carve-out. Its “personal employee information” is information reasonably required for “establishing, managing or terminating an employment or volunteer-work relationship”.
Section 22 carries the deal: parties may, “during the period leading up to and including the completion… of the business transaction, collect, use and disclose personal information about individuals without the consent of the individuals”. Employees are never named because section 4 caught them. Subsection (4) makes a party whose deal collapses “either destroy the information or turn it over to the party that disclosed” it.
SECTION 05 OF 10
BC defines “employee personal information” as information “collected, used or disclosed solely for the purposes reasonably required to establish, manage or terminate an employment relationship”. Section 20(2) is the most explicit transaction rule of the four: “An organization may disclose personal information about its employees, customers, directors, officers or shareholders without their consent, to a prospective party”.
Section 20(3)(b) then limits post-closing disclosure to information “that relates directly to the part of the organization or its business assets that is covered by the business transaction”, and section 20(7) bars disclosure “for purposes of a business transaction that does not involve substantial assets of the organization other than this personal information.”
SECTION 06 OF 10
Quebec is not organised around commercial activity either. Section 1 sets “particular rules with respect to personal information relating to other persons which a person collects, holds, uses or communicates to third persons in the course of carrying on an enterprise”.
Section 18.4: “Where the communication of personal information is necessary for concluding a commercial transaction… the person may communicate such information, without the consent of the person concerned, to the other party to the transaction.” A prior agreement must bind the recipient “to use the information only for concluding the commercial transaction”. Section 1 excludes from Divisions II and III “personal information concerning the performance of duties within an enterprise”, so an organisation chart is a different object from a personnel file.
SECTION 07 OF 10
Section 26(2)(b) lets the Governor in Council “exempt the organization, activity or class from the application of this Part” for information “that occurs within that province”, where substantially similar provincial law applies. Three general orders exist — Alberta, British Columbia and Quebec — each exempting “An organization, other than a federal work, undertaking or business”.
Ontario has an order too, and its scope is the tell. Under the Health Information Custodians Exemption Order a custodian is “exempt from the application of Part 1 of the Personal Information Protection and Electronic Documents Act” for information handled inside Ontario. Nothing broader was made, because there is no broader Ontario statute to be similar to. The OPC maps it the same way, placing Ontario only among provinces that “have also adopted substantially similar legislation regarding the collection, use, and disclosure of personal health information.” Patient records: the PHIPA article.
SECTION 08 OF 10
Not nothing, just not a privacy statute. The buyer becomes employer of record and inherits duties directly: Employment Standards Act, 2000 section 15(1) requires that “An employer shall record the following information with respect to each employee”, with retention periods in section 15(5). Section 41.1.1(1) adds that an employer which “employs 25 or more employees shall, before March 1 of that year, ensure it has a written policy in place… with respect to electronic monitoring of employees.”
The real exposure is tortious. In Jones v. Tsige the Court of Appeal for Ontario recognised intrusion upon seclusion: “the defendant must have invaded, without lawful justification, the plaintiff’s private affairs or concerns”, and the subject matter is “financial or health records, sexual practices and orientation, employment, diary or private correspondence”. Absent pecuniary loss, “I would fix the range at up to $20,000.” See the privacy torts, the employee-privacy patchwork and the employee’s view.
SECTION 09 OF 10
Read section 7.2(1) for what it authorises: parties “may use and disclose personal information without the knowledge or consent of the individual”. Its opening words tie it to “subsections 7(2) and (3)” — use and disclosure — not to section 7(1), which carries no business-transaction ground.
Alberta and BC drafted around this: Alberta’s section 22(3)(a) says “collect, use and disclose”, and BC’s section 20(4) lets a prospective party “collect and use personal information without the consent of the employees, customers, directors, officers and shareholders”. PIPEDA is narrower on its face, and I could not source a Commissioner finding or a judgment resolving what that means for a buyer receiving a federal seller’s files. Treat it as open. The nearest ground, section 7(1)(b.2), reaches information “produced by the individual in the course of their employment, business or profession”: work product, not a performance review.
SECTION 10 OF 10
Notice diverges. PIPEDA section 7.2(2)(c) requires that “one of the parties notifies the individual, within a reasonable time after the transaction is completed… that their personal information has been disclosed under subsection (1)”. BC section 20(3)(c) requires that “the employees, customers, directors, officers and shareholders whose personal information is disclosed are notified”. Quebec section 18.4 requires notice “Within a reasonable time after the commercial transaction is concluded”. Alberta’s section 22 has no equivalent — read subsections (1) to (6) and it is simply absent. One pan-Canadian notice template is mandatory in three regimes and over-inclusive in the fourth.
The data-room practice is the same everywhere, Ontario included. Stage it: headcount, service bands and classifications first; named files only once the deal is real and only for staff the buyer will keep. Bind the recipient in writing first, mirroring the statutory conditions — purpose limitation, safeguards “appropriate to the sensitivity of the information”, and return or destruction on a failed deal. The records still have to move at closing.
Two boundaries. This page covers PIPEDA, Alberta, British Columbia, Quebec and Ontario’s missing statute, not the other provinces or the territories, whose positions I did not fetch. And a federally regulated employer stays inside PIPEDA everywhere, including in those three provinces. Continuity of employment is separate: staff on a business sale.
No. PIPEDA s.4(1) reaches employee personal information only where the employer operates a federal work, undertaking or business, such as a bank or an airline. For an ordinary Ontario target it does not, and nothing provincial replaces it.
All three apply generally to personal information with no commercial-activity filter, so employee information is caught from the outset rather than through an exception. Each also has its own business-transaction provision, and they differ on post-closing notice and on the buyer’s right to collect the information before closing.
Not a privacy statute but ordinary employment and tort law. The buyer becomes employer of record under the Employment Standards Act, 2000, and mishandling the files can expose the buyer to the tort of intrusion upon seclusion recognized in Jones v. Tsige, with damages up to $20,000 absent pecuniary loss.
Sources
