Frequently Asked Questions for Non-Profit Organizations

This document is also available in format.

It will be updated periodically as other questions are raised regarding the Personal Information Protection Act (PIPA). Please note that this document is not a substitute for legal advice.

Related document: Information Sheet 1: Non-Profit Organizations

1. We are a non-profit organization. Are we subject to the Personal Information Protection Act (PIPA)?

All Alberta organizations are subject to the Act. However, the Act applies on a limited basis to certain non-profit organizations. This is the case for organizations established under the Societies Act, the Agricultural Societies Act, or organizations registered under part 9 of the Companies Act. For these organizations, the Act only applies to personal information that is collected, used or disclosed as part of a commercial activity.

2. What about other organizations that operate on a not-for-profit basis?

PIPA applies to all personal information held by organizations that do not meet the definition in the Act of a non-profit organization in section 56(1)(b). This includes churches and organizations incorporated by statute or under the Religious Lands Societies Act.

3. What is a commercial activity?

A commercial activity includes any transaction or any regular course of conduct that is of a commercial character. It includes the selling, bartering or leasing of donor, membership or other fund-raising lists. A commercial activity also includes the operation of a private school or early childhood service program under the School Act and a private college under the Post-secondary Learning Act.

4. How do we know what is a commercial activity?

Ultimately Alberta’s Information and Privacy Commissioner will determine what is a commercial activity when Orders and Investigation Reports are issued in response to a complaint under the Act. The same term is used in the federal Personal Information Protection and Electronic Documents Act and the federal Privacy Commissioner’s findings may be persuasive, but not binding in Alberta.

Access and Privacy’s Information Sheet 1: Non-Profit Organizations discusses some factors that a non-profit organization may wish to use in assessing whether an activity is a commercial activity.

5. Is fund-raising a commercial activity?

Access and Privacy is taking the position that fund-raising is not a commercial activity. In 2007, an adjudicator with the Office of the Information and Privacy Commissioner found that the fund-raising activities undertaken by a Society for charitable purposes were not a commercial activity (Order P2007-007).

6. Our organization offers training and classes to children for a fee. Is this a commercial activity?

This may depend on the nature of the fee. If the fee was set at a level that recovers only part of the cost of the activity, recovers cost or is marginally above cost, then the activity would likely not fall in the category of a commercial activity. If the fee was set at a level competitive with similar courses offered by private sector companies, then the activity would be regarded as a commercial activity.

7. Is joining an organization a commercial activity? Do we need to provide a notice on our membership application form?

Joining an organization by paying a membership fee may not fit the definition of a commercial activity. This may be the case if payment of the fee covers basic services such as membership and receipt of a newsletter.

If joining the organization is not a commercial activity, then no notice is required to be given when collecting personal information. It may, however, still be a best practice to provide notice if personal information is routinely disclosed or members may not be aware of how their personal information may be used and disclosed by the organization.

8. What else might be a commercial activity?

The Office of the Information and Privacy Commissioner found that selling tickets for a children’s theatre event was a commercial activity (P2006-CS-011).

Selling merchandise within the province by catalogue or Internet sale, where personal information of an individual is collected would be considered a commercial activity. Normally a name, address, and credit card information would be collected. Consent is needed to collect this information, and the obligations under the Act to safeguard the information would apply.

Running a conference, seminar or training session may also be a commercial activity. Names, addresses and other personal information may be collected as part of the registration process.

Some clubs, such as golf clubs and athletic clubs, may be engaged in commercial activities that are subject to the Act (Order P2006-008).

Selling or trading a membership or donor list to an organization within the province is a commercial activity.

Where a non-profit organization hires a contractor to perform a commercial activity on its behalf, the non-profit organization will have some responsibility for ensuring that the contractor provides those services in compliance with PIPA (P2007-IR-001).

9. Our non-profit organization has some activities that are commercial activities and some that are not. Does PIPA apply to all personal information held by our organization?

No. PIPA applies to the collection, use and disclosure of the personal information for the commercial activity only.

10. I work for a non-profit organization. Can I obtain a copy of my personnel file?

The personal information of employees and volunteers of a non-profit organization is not subject to the Act. Employees cannot make a request under the Act to obtain their personal information from their employer, if the employer is a non-profit organization. Organizations can continue to follow their current practices for providing personal information to their employees and volunteers.

11. Can a non-profit organization post names of its members on its website?

If the collection of the members’ names was not part of a commercial activity, then PIPA does not apply. The organization can decide whether or not to publish members' names according to its own policies.

12. Our organization trades membership lists with organizations with similar interests in Alberta. The information is used to promote conferences and other events that may be of interest to our members. Can we still do this?

Bartering a membership list is a commercial activity. The disclosure by the Alberta organization would be subject to the Act. Consent would be needed to exchange members’ personal information in this way.

13. Our organization trades membership lists with our counterpart in Ontario. The information is used to promote the Ontario conference to our members. Can we still do this?

Bartering a membership list is a commercial activity. Since the list is being exchanged with an organization across a border, the disclosure by the Alberta organization would be subject to the federal Personal Information Protection and Electronic Documents Act which governs inter-provincial data flows of a commercial nature. If this is the case, consent would be needed to exchange members’ information in this way.

14. Can a non-profit organization include personal information of its members in its newsletter or on its website? The news could be birthdays, anniversaries, awards, or sporting achievements.

The organization would start by assessing whether the personal information was collected as a result of a commercial activity. Normally this will not be the case. The Act would not apply to the disclosure of personal information in the newsletter or on the website. The organization can decide what to publish according to its own policies. A best practice may be to inform members of the purposes that the organization will use or disclose their personal information.

15. What will happen if an individual makes a privacy complaint about our non-profit organization to the Information and Privacy Commissioner?

If the Commissioner’s office receives a privacy complaint, one of the first considerations is whether the organization is a non-profit organization as defined by the Act, and whether the handling of personal information was related to a commercial activity. The Commissioner would only have the jurisdiction and legislative authority to investigate the complaint if the personal information under dispute was related to a commercial activity.

16. Can a non-profit organization voluntarily comply with PIPA?

An organization can decide to follow PIPA and obtain consent when collecting, using and disclosing personal information as a good business practice. However, the Information and Privacy Commissioner would not be able to investigate a complaint regarding the organization’s handling of personal information if the activity was not a commercial activity.

17. Our organization receives funding from a provincial government agency. Are we subject to the FOIP Act?

The FOIP Act applies to public bodies as defined by that Act. Non-profit organizations are not public bodies subject to the FOIP act.

If a non-profit organization delivers services under contract to a public body, such as Alberta Children and Youth Services, the public body will require the organization to handle personal information in compliance with the FOIP Act. The information generated under the contract will remain in the control of the public body. It will not be subject to PIPA.

18. Where can I obtain more information?

Information and resources are added to the Private Sector Privacy website (pipa.alberta.ca) as they become available. Check the What’s New section regularly to find out what has been added to the site.

Produced by:

Access and Privacy
Service Alberta
Phone: 780-644-PIPA (7472)
Toll free dial 310-0000
E-mail: pspinfo@gov.ab.ca
Website: pipa.alberta.ca

The Office of the Information and Privacy Commissioner can be contacted at:

Phone: 403-297-2728
Toll free dial 1-888-878-4044
E-mail: generalinfo@oipc.ab.ca
Website: www.oipc.ab.ca