Alberta's Personal Information Protection Act (PIPA)

The Information and Privacy Commissioner (The Commissioner), appointed under the Alberta Freedom of Information and Protection of Privacy Act, is the primary authority responsible for monitoring the administration of the PIPA to ensure that its purposes are achieved;

Organizations may only collect, use, and disclose personal information for reasonable purposes;

Organizations must respond to any data subject requests within 45-days of receiving the request, provided the response time for a request to access, or a request for information, may be extended in accordance with the provisions of the PIPA;

Within a reasonable time after an organization no longer reasonably requires personal information, the organization must destroy all records containing such information or render the information non-identifiable, ensuring the relevant individuals cannot be identified;

The Commissioner may authorize an organization to disregard a data subject request made if it would require unreasonable efforts on the part of the organization, amount to an abuse of the right to make such requests, or is deemed "frivolous or vexatious";

Any prosecution for offenses under PIPA may be commenced within two years after the offense was allegedly committed, but not afterward;

If found in breach of the PIPA, an individual may face a fine of up to CAD 10,000, while an organization may face a fine of up to CAD 100,000.