Alberta and BC PIPA: The Provincial Privacy Acts

Alberta and British Columbia each have their own private-sector privacy statute, both called the Personal Information Protection Act (PIPA), and both apply instead of the federal PIPEDA to most businesses operating inside that province.

What Alberta PIPA and BC PIPA Are

Alberta's Personal Information Protection Act (PIPA, SA 2003, c P-6.5) and British Columbia's Personal Information Protection Act (PIPA, SBC 2003, c 63) are near-identically named but separately enacted provincial statutes. Each regulates how private-sector organizations collect, use, and disclose personal information about individuals in the course of commercial activity within that province.

Both laws were reviewed by the federal government and formally declared "substantially similar" to the federal Personal Information Protection and Electronic Documents Act (PIPEDA). That designation is not a formality. Under PIPEDA's own terms, once a province's private-sector law is declared substantially similar, PIPEDA steps back and the provincial law applies instead to organizations and transactions that stay entirely within that province.

Only three provinces have a substantially similar private-sector law of this kind: Alberta, British Columbia, and Quebec (Quebec's is Law 25, covered separately). Every other province and territory falls back to PIPEDA for private-sector privacy.

Why "Substantially Similar" Doesn't Mean PIPEDA Disappears

PIPEDA does not vanish inside Alberta or BC. It continues to apply in two situations that provincial PIPA cannot reach:

• Federally regulated works and undertakings. Banks, airlines, telecommunications carriers, interprovincial and international transportation companies, and broadcasters are regulated by PIPEDA everywhere in Canada, including inside Alberta and BC, regardless of the provincial law.
• Interprovincial and international transfers. When personal information moves across a provincial or national border as part of a commercial transaction, PIPEDA can still apply to that cross-border flow even if the organization is otherwise governed by a provincial PIPA at home.

So a retailer with stores only in Calgary is governed by Alberta PIPA for its Alberta customers, but if it ships data to a processor in Ontario or the United States, PIPEDA principles can attach to that transfer. This layered structure is the single most misunderstood part of Canadian privacy law, and it is worth double-checking before assuming "my business is in Alberta, so PIPEDA never applies to me."

Consent Under the Provincial PIPAs

Both Alberta PIPA and BC PIPA build their consent framework around the same core idea as PIPEDA: an organization generally needs an individual's knowledge and consent to collect, use, or disclose personal information about them, and the required form of consent scales with the sensitivity of the information.

Both statutes also recognize deemed consent, sometimes described in practice as opt-out consent. Where an organization gives clear notice of a purpose and provides a reasonable opportunity to decline, and the individual does not opt out, consent can be deemed to have been given for less sensitive collection, use, or disclosure. Consent can also be express (written or verbal, affirmatively given) or implied from the individual's conduct, again scaled to sensitivity and context. Both PIPAs additionally list specific circumstances where an organization may collect, use, or disclose personal information without consent at all, such as legal or regulatory requirements, emergencies involving life, health, or safety, and certain investigations.

Neither Alberta nor BC PIPA treats consent as an all-or-nothing gate. The practical test in both provinces is whether a reasonable person would consider the collection, use, or disclosure appropriate in the circumstances, given the purpose disclosed and the form of consent obtained.

Employee Personal Information: The Real Difference From PIPEDA

This is where the two provincial PIPAs genuinely diverge from the federal scheme. PIPEDA, as a general rule, only reaches the employee personal information of organizations that are themselves federally regulated works or undertakings. A private employer in Alberta that is not federally regulated is not, as a rule, subject to PIPEDA at all for its employee records.

Alberta PIPA and BC PIPA fill that gap directly. Both statutes expressly define and regulate "employee personal information" and permit an organization to collect, use, and disclose it without the individual's consent where the purpose is reasonable for the purposes of establishing, managing, or terminating an employment relationship. In exchange for that lighter consent requirement, both PIPAs require the employer to give the employee (or a prospective employee) notice that it will be collecting, using, or disclosing their personal information for those purposes, and the purposes for which that will happen.

The practical effect: an Alberta or BC employer has a clearer, purpose-built path to handle payroll records, performance reviews, disciplinary files, and workplace monitoring data than an employer relying on PIPEDA alone in a province without an equivalent employee-information provision. It does not mean employee information can be used for anything an employer wants; it still has to be for a reasonable employment-related purpose, and workplace surveillance still has to be reasonable in scope, which is the subject of a related page on this cluster.

Access Rights

Individuals in both provinces have a right, subject to specific exceptions, to request access to the personal information an organization holds about them, to be told how it has been and is being used, and to request correction of inaccurate or incomplete information. Organizations must respond within a set statutory timeline, and the two provinces differ: Alberta allows 45 days, while British Columbia allows 30 days under section 29(1) of its PIPA. Both periods can be extended in defined circumstances, and a minimal fee can be charged in some cases. This mirrors the individual-access principle in PIPEDA's Schedule 1, but each PIPA sets its own exceptions, such as information subject to solicitor-client privilege, information that would reveal another person's personal information, or information collected for an investigation.

Oversight: Two Offices That Can Actually Issue Orders

Each province has its own Office of the Information and Privacy Commissioner (OIPC): the OIPC of Alberta and the OIPC of British Columbia. Both offices handle privacy complaints and investigations under their respective PIPA, and both also oversee freedom-of-information requests to public bodies under separate legislation.

The structurally important difference from the federal scheme is enforcement power. The federal Privacy Commissioner investigates PIPEDA complaints and issues findings and recommendations, but historically cannot itself impose a binding order; it must apply to the Federal Court for an enforceable order. The Alberta and BC commissioners, by contrast, can issue binding orders directly against an organization following an inquiry, for example ordering it to stop a collection practice, destroy information, or grant access. That order-making power is a meaningful enforcement advantage the provincial regime has that the federal one lacks.

Breach Notification: Alberta Requires It, BC Does Not

Alberta was the first jurisdiction in Canada to require mandatory breach notification in the private sector. Under section 34.1 of Alberta PIPA, an organization that has personal information under its control must notify the Alberta Commissioner without unreasonable delay of any incident involving loss of, or unauthorized access to or disclosure of, that information where a reasonable person would consider there exists a real risk of significant harm to an individual as a result. The Commissioner can, in turn, require the organization to notify the affected individuals directly. Failing to report a qualifying breach is itself an offence under the Act.

British Columbia's PIPA has no equivalent mandatory breach notification requirement for private-sector organizations. The BC OIPC recommends voluntary notification as a best practice and has publicly called for the law to be amended to add a mandatory requirement, similar to what already exists in Alberta and federally under PIPEDA, but as it stands, a BC-regulated business is not legally required to report a breach to the Commissioner or to affected individuals under PIPA itself. (BC's public-sector law, FIPPA, is a separate statute that gained its own mandatory breach reporting for government bodies in 2023; it does not apply to private businesses governed by PIPA.)

That asymmetry matters in practice: an organization operating in both provinces needs two different breach playbooks, not one.

The 2013 Supreme Court Ruling: Alberta PIPA and the Picket Line

In Alberta (Information and Privacy Commissioner) v United Food and Commercial Workers, Local 401, 2013 SCC 62, the Supreme Court of Canada considered a union that had videotaped and photographed individuals crossing a picket line during a lawful, lengthy strike, with signage warning that the images might be posted online. Several of the people recorded complained to the Alberta Commissioner, and an adjudicator found the union had contravened PIPA.

The Supreme Court disagreed with applying PIPA that broadly. It held that Alberta's PIPA, as written, unjustifiably limited the union's freedom of expression under section 2(b) of the Charter by restricting its ability to collect, use, and disclose personal information for the purpose of legitimate, expressive labour-relations activity, including publicizing conduct during a strike. The Court declared the relevant provisions of PIPA unconstitutional but suspended that declaration for 12 months to give the Alberta legislature time to amend the Act rather than leaving the province without a private-sector privacy law at all.

Alberta subsequently amended PIPA to add exceptions addressing this gap, including provisions recognizing that personal information may be collected, used, or disclosed for purposes related to informing the public about matters of legitimate public or labour-relations concern. The case remains the leading authority on the boundary between provincial privacy legislation and Charter-protected expression in Canada, and it is a useful reminder that a privacy statute's reach over recording and publication is not unlimited even where the underlying collection would otherwise require consent.

Alberta PIPA vs BC PIPA vs PIPEDA

How This Connects to Recording and Surveillance Law

Alberta PIPA and BC PIPA govern what a business does with personal information once it exists. They are separate from the criminal law question of whether making a recording in the first place is lawful. Canada is a one-party consent country: under the Criminal Code, recording a private conversation you are personally a party to is lawful nationwide, a rule explained fully on Canada's national recording-law page. But once that recording is made, what a business does with it (storing it, using it for a workplace investigation, disclosing it) is exactly the kind of activity Alberta PIPA and BC PIPA regulate for organizations inside those provinces. Workplace video and audio monitoring specifically is covered in more depth on Workplace Surveillance in Canada.

For organizations weighing whether PIPEDA or a provincial PIPA applies to their operations, see the companion explainer on PIPEDA, and for the strictest Canadian regime, see Quebec's Law 25. All three sit alongside the broader Canada legal hub on this site.

Disclaimer: This page is general legal information about Alberta's and British Columbia's Personal Information Protection Acts, not legal advice. Privacy obligations depend on an organization's specific activities and sector; consult the Office of the Information and Privacy Commissioner of Alberta, the Office of the Information and Privacy Commissioner for British Columbia, or a qualified privacy lawyer for advice on a specific situation.