|
Information Sheet No. 1: Non-Profit Organizations
This document is also available in
 format.
Introduction
On January 1, 2004, non-profit organizations in Alberta became subject to
Alberta’s Personal
Information Protection Act (PIPA). The Act contains
a provision that limits the application of the Act to only certain personal
information held by some non-profit organizations. This information sheet
explains section 56,
and what it means for non-profit organizations.
What is a non-profit organization?
PIPA defines a non-profit organization in
section 56(1)(b).
For the purposes of the Act, a non-profit organizations is an organization that is:
- incorporated under the Societies Act,
- incorporated under the Agricultural Societies Act, or
- registered under Part 9 of the Companies Act.
Other organizations may operate on a not-for-profit basis, but the provisions
in section 56 only
apply to the organizations listed above. For other non-profit
organizations, the entire Act applies to the personal information of their
employees, volunteers, clients and donors.
What is a commercial activity?
Non-profit organizations (as defined in the Act) will be covered to the
extent that personal information is collected, used or disclosed during a
commercial activity. This is the same extent that the federal
Personal
Information Protection and Electronic Documents Act (PIPEDA) would apply, if
Alberta had not brought in its own legislation. PIPEDA applies to personal
information associated with a commercial activity.
The term commercial activity arises from PIPEDA. There has been little
interpretation of the term "commercial activity" by the courts or
Canadian privacy commissioners. The following provides some direction on how the
term may be interpreted, but the information is subject to revision as
Commissioners’ decisions are made.
The Act defines "commercial activity" for the purpose of
section 56
regarding non-profit organizations, as
(i) any transaction, act or conduct, or
(ii) any regular course of conduct,
that is of a commercial character, and without restricting the generality
of the foregoing, includes the following:
(iii) the selling, bartering or leasing of membership lists or of donor or
other fund-raising lists;
(iv) the operation of a private school or an early childhood services
program as defined in the School Act;
(v) the operation of a private college as defined in the Colleges Act."
(section 56(1)(a)).
A non-profit organization that is generally not commercial in nature will
nonetheless be subject to PIPA for a commercial transaction involving the sale
of personal information within Alberta.
Examples may include:
- The sale of merchandise within the province by catalogue or Internet sale,
where personal information of an individual is collected (e.g. name,
address, credit card number).
- Collecting names and address of individuals who register in a conference
or training session.
- Selling a membership or donor list to an organization within the province.
Examples of activities that may not be considered to be a commercial activity
include:
- Donations made to a non-profit organization where no product or service is
exchanged.
- An individual signing up for a free newsletter (the personal information
could only be subsequently sold in accordance with PIPA).
- An individual using the free services of the non-profit organization.
- Payment of a membership fee to a community league.
In a recent
Ontario Superior Court of Justice decision, the judge accepted the federal
Privacy Commissioner’s guideline that collecting membership fees, organizing
club activities, compiling a list of members’ names and mailing out newsletters
are not commercial activities. This meant that PIPEDA did not apply to
these activities of a society in Ontario (see
Rodgers v. Calvert, Doc. No. 03-BN-6556, September 8, 2004 (Ont. Sup.
Ct.)).
Factors to determine commercial activity
In determining whether a transaction is a commercial activity for the
purposes of PIPA, the following factors, when considered together, may be
helpful in assessing the commercial nature. Non-profit organizations themselves
determine whether the activity is a commercial activity.
- Is the activity conducted for the purpose of fund-raising for charitable
purposes (rather than to raise funds for regular operations or
non-charitable purposes)?
- Is the activity financially supported by the activities of the
organization or operated on a cost recovery basis (rather than intended to
make a profit to be used to support other activities)?
- Is the activity one that tends to be provided only by the government or
non-profit sector (rather than by private sector businesses)?
- Is the primary purpose of the activity to provide a public benefit (rather
than benefit individual participants or clients)?
- Does the activity involve consideration by one party (rather than
consideration for both parties)?
Examples applying the factors
The following examples may help to illustrate how the factors may be used to
decide whether an activity is a commercial activity.
Example 1: A service group sells $25 raffle tickets to purchase a special wheelchair for
a child in their community. Personal information is collected on the ticket to
contact the winner.
Consider the factors:
- The activity is conducted to raise funds for a charitable purpose.
- The activity is intended to generate a profit to support the activity of
purchasing the wheelchair.
- The activity is normally provided by the government or non-profit
sectors.
- The activity benefits the public (rather than the organization) and the
outcome of the activity benefits an individual.
- The activity involves consideration by one party, i.e. a donation in the
hope of winning a prize.
Conclusion: On balance, the activity is not a commercial activity, as the
factors weigh towards an affirmative answer to the questions.
Example 2: A non-profit society offers addictions counseling. Fees are charged on an
hourly basis comparable to the private sector. Notes containing personal
information are created during the counseling sessions.
- The activity is not a fund-raising activity for charitable purposes.
- The activity is intended to make a profit for the organization.
- The activity is regularly provided by private sector businesses.
- The activity benefits the client.
- Consideration is two-way, in that the organization receives a fee, and
the client receives a service.
Conclusion: The activity is a commercial activity, and the personal
information would be subject to PIPA.
Implications
Certain categories of personal information will not be subject to PIPA,
meaning that the Act will not apply.
The personal information includes such categories of records as:
- Employment records of employees, volunteers, and board members,
including resumes, criminal reference checks, payroll and benefit information.
- Counseling records or other client records where no fee was charged for
the service.
- Personal information collected as part of a membership process.
- Personal information collected during fund-raising activities.
Non-profit organizations will continue to develop their own policies and
practices around protecting and disclosing personal information. Individuals
will not have a legal right of access to personal information about themselves.
Activities where personal information collected will be subject to the Act
include:
- Any sale, barter, or leasing of membership, donor, or fund-raising
lists.
- Any sale, barter or leasing of personal information.
- Counseling records or other client records where a fee was charged for
the service.
- Personal information collected in the course of a commercial activity,
where the intent of the activity is to make a profit. An example would be a
courses offered in competition with the private sector.
Records subject to the FOIP Act
PIPA will not apply to records created by a non-profit organization that
offers a service under contract to a public body under the Freedom
of Information and Protection of Privacy (FOIP) Act, such as a
government department or agency (e.g. Children’s Services, a Child and
Family Service Agency, AADAC), a regional health authority or a municipality.
In such cases, the contract from the public body should say that the public
body retains control of the records, and the FOIP Act will continue to
apply to those records.
Checklist
Non-profit organizations can review the following checklist to prepare for
the Personal Information Protection Act.
- Is the organization incorporated under the Societies Act or the
Agricultural Societies Act, or registered under Part 9 of the Companies
Act?
If not, then the entire Act applies to the organization’s activities.
- Do the activities undertaken by the organization involve the collection,
use or disclosure of personal information within Alberta?
- Do the activities involving the collection, use or disclosure of
personal information meet the definition of a commercial activity?
If the answer to all three questions is yes, then the organization will need
to comply with the Personal Information Protection Act for the personal
information affected by a commercial activity.
Will PIPEDA apply?
An Alberta organization may be subject to PIPEDA for a transaction, where
personal information is collected, used or disclosed across a border as part of
a commercial activity. This is the case whether the organization is a business
or a non-profit organization.
A Guide for Businesses and
Organizations on the Personal Information Protection Act provides an overview
of the Act with examples and tips for incorporating good privacy practices in the
work place.
Other resources
Frequently Asked Questions for Non-profit Organizations
provides answers to some of the more common questions regarding how
PIPA applies to non-profit organizations.
A Guide for Businesses and Organizations on the Personal Information
Protection Act provides an overview of the Act with examples and tips
for incorporating good privacy practices in the work place.
The Personal Information Protection Act, A Summary for Organizations
summarizes of the key obligations of organizations.
Getting Ready for PIPA is a quick reference for organizations
preparing for the Act.
Publications are available on-line from:
Access and Privacy
Service Alberta
www.pipa.alberta.ca
The web site of the Office of the Information and Privacy Commissioner
also contains resources, at www.oipc.ab.ca.
About this document
This Information Sheet was prepared to assist organizations implement the
Personal Information Protection Act that came into effect on January 1,
2004. This document is an administrative tool intended to assist in
understanding the Act. It is not intended as, nor is a substitute for, legal
advice. For the exact wording and interpretation of the Act, please read the Act
in its entirety. This Information Sheet is not binding on the Office of the
Information and Privacy Commissioner of Alberta.
|
