[co-author: Jing Xu - Articling Student]

The OIPC has issued recent guidance for private sector organizations operating in British Columbia, which include provincially or federally incorporated companies that conduct business in the province and are subject to the Personal Information Protection Act (BC) (PIPA).

The OIPC recommends that private sector organizations prepare a privacy impact assessment (PIA) in order to be proactive when it comes to "ensuring that the initiatives they have planned comply with PIPA". In short, a PIA can help an organization identify and manage the risk associated with the collection, storage, use and disclosure of personal information. In connection with this recommendation, the OIPC has published: (1) a template for the PIA that contains sample language and instructions for how to conduct a PIA; and (2) a guidance document that "adds depth to the sample language and instruction offered in the template".

PIAs are not a legal requirement for private sector organizations under PIPA. However, the OIPC views the completion of PIAs as a best practice for all organizations that collect, use, disclose and dispose of personal information, and an exercise that can "demonstrate due diligence and accountability in meeting a commitment to protect privacy".

The guidance document includes the following categories of issues for an organization to consider and address in the PIA:

• What personal information they collect and whether the information is necessary to provide the product or service;
• The type of consent obtained and the scope of consent with respect to the use and disclosure of the information;
• Whether the actual use and disclosure of the personal information exceeds the limits of the consent;
• Where and how is the information stored; who can access the information and whether they need to access the information;
• Whether the organization destroys information once it is no longer needed; and
• What safeguards (physical, operational and technological) are in place to protect the information and whether they are sufficient.

The guidance document further provides a framework for a risk mitigation analysis, which involves documenting risks to the organization, the probability of them occurring, the potential impact on the organization and affected individuals and what the organization intends to do to reduce the risk.