Under PIPEDA, personal information is any factual or subjective information, recorded or not, about an identifiable individual — a definition broad enough to cover a buyer’s stated move-in timeline as much as their income or ID number, and it applies the moment you handle it in the course of a commercial activity.
The Office of the Privacy Commissioner’s own examples run wide: age, name, ID numbers, income, ethnic origin, or blood type; opinions, evaluations, comments, social status, or disciplinary actions; employee files, credit records, loan records, medical records; and intentions, for example to acquire goods or services, or to change jobs. The Act’s own text keeps the definition short by design — personal information means information about an identifiable individual — and the plain-language examples exist to show how far that one line actually reaches.
PIPEDA applies once information is collected, used or disclosed in the course of a commercial activity, defined as any transaction or regular course of conduct of a commercial character — a solo agent’s trade in real estate is squarely commercial activity, full stop. One provincial wrinkle: Alberta, British Columbia and Quebec each have their own substantially similar private-sector privacy law, and organizations there are generally exempt from PIPEDA for information handled within that province. PIPEDA still governs anything that crosses a provincial or international line — a BC agent using a US-hosted CRM, or referring a file to a colleague in another province, is back under PIPEDA for that specific handling even though BC has its own law.
A prospective seller tells you, off the record, that they are going through a separation and need to close quickly. There is no name, ID number or address in that sentence, but it is information about an identifiable individual — your identified client — capturing a circumstantial, subjective fact about them, so it is personal information under the Act’s broad definition all the same. It is also exactly the kind of sensitive detail that would need the client’s express consent (see meaningful consent) before you ever repeated it to a lender or a cooperating agent.
See also: meaningful consent under PIPEDA and real risk of significant harm.
A 30-minute call is enough to tell you whether AI pays for itself here.
