PIPEDA, BC PIPA, and property data: privacy basics for real estate teams

Canada’s federal private-sector privacy law is PIPEDA — the Personal Information Protection and Electronic Documents Act — overseen by the Office of the Privacy Commissioner of Canada. British Columbia has its own private-sector law, the Personal Information Protection Act (BC PIPA), overseen by the Office of the Information and Privacy Commissioner for British Columbia.

Broadly: BC PIPA governs how BC organizations handle personal information within the province, while PIPEDA applies to federally regulated businesses and to personal information that crosses provincial or national borders in commercial activity. Many BC real estate firms live day to day under BC PIPA while still encountering PIPEDA when data flows interprovincially. Which law applies to which of your activities is a question for counsel — the operating disciplines below serve you under both.

More than most industries, real estate operations accumulate personal information as a by-product of normal work: tenant and resident records, lease and payment histories, identification documents collected for anti-money-laundering purposes, buyer and seller contact files, employee HR records, and homeowner warranty and service histories.

Two implications follow. First, “we are not a data company” is not a defence — the obligations attach to the information, not the business model. Second, some of this data is collected because another law requires it (FINTRAC identification, for example), which makes purpose and retention easier to articulate — but does not remove the duty to safeguard it.

Both regimes are built on fair-information principles. The ones that generate real operational work: accountability (someone is designated as responsible for privacy); identifying purposes and consent (know why you collect each category, and collect it openly); limiting collection, use, and retention (gather what the purpose needs, use it for that purpose, and do not keep it forever); safeguards (protections proportionate to sensitivity); and individual access (people can ask what you hold about them and request corrections).

Translated into a property firm’s reality: role-based access so a leasing coordinator does not see employee HR files; retention schedules so identification documents do not accumulate indefinitely in shared drives; and a named person who owns privacy questions instead of an inbox nobody reads.

PIPEDA requires organizations to report breaches of security safeguards that create a real risk of significant harm to the Privacy Commissioner, to notify affected individuals, and to keep records of all breaches. These duties have been in force since 2018.

BC’s regime has its own expectations and has been the subject of ongoing reform discussion — check the OIPC BC’s current guidance rather than assuming the federal rules map across. Either way, the operational requirement is identical: a written incident plan, a way to know what data was touched, and contact paths decided before you need them at speed.

The unglamorous controls do most of the work: permission models that follow roles rather than convenience; audit trails on sensitive records so access is attributable; deliberate retention and deletion instead of indefinite accumulation; and contracts with vendors and processors that address how they handle your data.

Platforms can make this easier by structuring records, scoping access by role and tenant, and logging who touched what — OpSphere is designed around tenant-scoped, role-gated records with audit trails. But privacy compliance is a program, not a product: your designated privacy lead, your policies, and the official guidance from the OPC and OIPC BC define the standard.