The Office of the Privacy Commissioner of Canada (“OPC”) has released an interpretation guide with respect to the concept of “commercial activity” in the Personal Information Protection and Electronic Documents Act (Canada) (“PIPEDA”).
“Commercial activity” is a key concept under PIPEDA. The private sector privacy obligations under PIPEDA apply to to every organization in respect of personal information that the organization “collects, uses or discloses in the course of commercial activities”.
So, what is a “commercial activity”? PIPEDA provides that commercial activity includes “any particular transaction, act or conduct or any regular course of conduct that is of a commercial character, including the selling, bartering or leasing of donor, membership or other fundraising lists.” What is a transaction, act or conduct that is of a “commercial character”? A good litmus test is to ask whether you are receiving monetary or non-monetary consideration for your activities or whether you are providing a service to an organization engaged in commercial activity? If so, you may be involved in “commercial activity”.
The OPC provides illustrative examples. A doctor is engaged in a commercial activity when he or she conducts a medical examination on behalf of an insurance company for the purpose of processing a benefits claim. A non-profit organization is engaged in a commercial activity when administering entrance exams as a service to its members. An on-line social network is engaged in commercial activity when it uses personal information to enhance user experience in order to succeed as a commercial enterprise.