One contact form means privacy law applies

If your website has a contact form, you are collecting personal information. For most businesses in Canada, that brings you under PIPEDA, the federal privacy law for the private sector.

PIPEDA applies to businesses in every province except Quebec, Alberta and British Columbia, each of which has its own private-sector privacy law. Being a small business doesn't exempt you from these rules. When the Office of the Privacy Commissioner reviewed its complaints in 2017, more than a third of the PIPEDA complaints it had closed involved small businesses.

The minimum steps for a small business

• Name someone who is responsible for privacy, which in a small business is often the owner.
• Publish a privacy policy that explains what you collect, why you collect it, who you share it with, and how people can see or correct their information.
• Collect only what you need, since a contact form rarely requires more than a name, an email address and a message.
• Protect the information you keep, and decide where form submissions are stored and for how long.
• Obtain meaningful consent, and make it easy for people to withdraw it.
• Know what to do after a breach, since organizations have been required since November 2018 to report breaches that create a real risk of significant harm to the Privacy Commissioner and to notify the people affected.

Email sign-ups fall under a second law

If you send marketing emails, Canada's anti-spam legislation, known as CASL, applies as well. You need express or implied consent before you send, every message must identify your business, and every message must include a working unsubscribe link. Unsubscribe requests must be honoured within 10 business days. The simplest approach is to add an unticked checkbox to your sign-up form that people tick themselves.

Avoid copied templates

A privacy policy copied from an American website often cites laws that don't apply in Canada and describes data practices you don't follow. A short, accurate policy written for your own site is better than a long one that is wrong.

A worked example

Consider a home renovation company whose quote form asks for a name, an email address, a phone number, a home address and photos of the room to be renovated. All of that is personal information, and some of it, such as photos of the inside of someone's home, is sensitive. A good privacy policy for this business would explain what the form collects and why, and state that the photos are used only to prepare the quote. It would also say how long enquiries are kept before they are deleted, list who can see them, and describe how a customer can ask for their information to be removed.

PIPEDA's ten principles

The Office of the Privacy Commissioner organizes PIPEDA around ten fair information principles.

1. Accountability means that someone in the business is responsible for privacy.
2. Identifying purposes means explaining why you collect information.
3. Consent means obtaining meaningful permission.
4. Limiting collection means collecting only what you need.
5. Limiting use, disclosure and retention means using information only for its stated purpose and not keeping it indefinitely.
6. Accuracy means keeping information correct and up to date.
7. Safeguards means protecting the information you hold.
8. Openness means making your practices easy to find and understand.
9. Individual access means letting people see the information you hold about them.
10. Challenging compliance means giving people a way to raise concerns.

What to include in your privacy policy

• Who you are, and how to contact the person responsible for privacy.
• What you collect through your website, forms and analytics tools.
• Why you collect it and how you use it.
• Who you share it with, such as your email provider or booking software.
• How long you keep it.
• How people can access, correct or delete their information, or withdraw their consent.

Cookies and analytics

Analytics tools such as Google Analytics set cookies to measure visits. Explain this in your policy and use a simple cookie notice, so that visitors know what is happening and can decline where appropriate.

Frequently asked questions

I run the business alone. Do I still need a privacy officer?

In that case, you are the privacy officer. Include your name or role and a contact email address in your privacy policy.

Can I email business contacts without express consent?

CASL allows implied consent in some specific situations, such as after a recent purchase, or when someone has published their email address without stating that they don't want messages and your message relates to their role. Express consent is the safer option, and it doesn't expire unless the person unsubscribes.

What counts as a privacy breach?

A breach is any loss of, unauthorized access to, or disclosure of personal information. Examples include a stolen laptop that holds customer files and an email sent to the wrong distribution list. Breaches that create a real risk of significant harm must be reported.

Do I need a cookie notice if I don't use analytics?

If your site sets no cookies beyond those it needs to function, there may be little to disclose. Most sites do use analytics, embedded maps or videos that set cookies, however, so check before you assume that yours doesn't.

This article offers general guidance rather than legal advice. For questions specific to your business, consult a lawyer.

Key takeaways

• A single contact form brings most Canadian businesses under PIPEDA.
• Name a privacy contact, publish an accurate policy and collect only what you need.
• Marketing emails also fall under CASL, so obtain consent, identify yourself and honour unsubscribe requests within 10 business days.
• Write your own policy based on your actual practices rather than copying a foreign template.