PIPEDA and the shared brokerage inbox: the privacy risk nobody actually assigned.

It's almost always a speed decision, not a policy one. A new hire needs to see client emails on day one, a shared login already exists, and setting up individual access with proper permissions feels like a task for later. Later rarely comes, and the login outlives several staff changes.

The documents flowing through that inbox — income statements, bank statements, SIN-bearing tax documents, credit reports — are exactly the category PIPEDA treats as sensitive personal information requiring proportionate safeguards, which makes the shared-login shortcut a bigger exposure than it looks.

Two of PIPEDA's ten fair information principles are directly relevant. Accountability means an organization remains responsible for personal information under its control, including who inside the organization can see it. Safeguards means protecting personal information with security appropriate to its sensitivity — financial and identity documents sit at the higher end of that scale.

Where a shared login usually falls short of both principles: there's no way to say who actually accessed a given client's file at a given time, and access isn't limited to people who currently need it — it's limited to people who ever had the password. Alberta, British Columbia, and Quebec each have their own private-sector privacy law deemed substantially similar to PIPEDA, so the specific statute governing a purely intra-provincial brokerage may be provincial rather than federal — but the standard for access control and safeguards is comparable across all of them, and PIPEDA still applies to any information that crosses a provincial or international border.

Three failure patterns show up repeatedly:

• →A former employee's access is never revoked, because revoking “the inbox” means changing a password everyone still uses, which nobody wants to be the one to break.
• →Forwarding rules quietly set up by a past staff member continue routing client documents to a personal address long after they've left.
• →When something does go wrong — a document sent to the wrong client, a file accessed by someone with no reason to be in it — there's no access log to determine what actually happened, which turns a containable incident into an open question.

Individual logins with role-based access, not a shared password. Every major email and CRM platform used by Canadian brokerages supports this at no meaningful extra cost or friction — the barrier is almost always inertia, not technical limitation.

Pair it with two habits: an offboarding checklist that revokes access the day someone leaves, not whenever someone remembers to, and a quarterly access review that asks a simple question — does everyone who currently has access still need it?

PIPEDA's mandatory breach reporting rule requires notifying the Privacy Commissioner and affected individuals as soon as feasible when a breach creates a real risk of significant harm — considering the sensitivity of the information and the likelihood of misuse. But the record-keeping duty is broader than the reporting duty: every breach of security safeguards must be logged, whether or not it clears the reporting threshold, and those records must be kept for a minimum of 2 years and produced to the Commissioner on request.

That's the requirement a shared, unlogged inbox makes almost impossible to meet honestly — you can't document who accessed what when there's no individual access trail to begin with.