Terms of Engagement for Business Advisory Consultation

Please review the following terms carefully and note that your organization’s (Organization) engagement with the Business Advisory Directorate (Directorate) of the Office of the Privacy Commissioner of Canada (OPC) will be governed by them:

1. The Organization’s participation is voluntary, and any compliance advice provided by the OPC during the course or as a result of the Business Advisory consultation or proactive engagement (activity) will not be binding on the Organization.
2. Business Advisory activities are conducted in good faith, and to uphold the same, the Organization undertakes to provide, to the extent possible under the circumstances, complete and relevant information; remain accountable for, and demonstrate commitment to compliance. The Organization also understands that any material omission and/or misrepresentation shall invalidate any advice provided by the OPC in the context of this Business Advisory activity.
3. The OPC will not endorse, provide advance rulings or waive its investigative or other rights and authorities under the Personal Information Protection and Electronic Documents Act (PIPEDA)^{Footnote 1}. Where the Organization engages meaningfully and in good faith, and takes steps to implement the compliance advice provided by the OPC, it will however have a measure of certainty and qualified assurance. For clarity, the advice and related facts will be treated as relevant evidence if the same Organization is subsequently the subject of an investigation involving the same facts.
4. The Organization may, if it engages in good faith and meaningfully, and subject to such further terms or conditions as may be specified in that regard by the Directorate in the context of this advisory activity, promote its engagement with the OPC and its adoption of the privacy compliance advice provided by the Directorate.
5. The Organization undertakes to inform the Directorate without delay if it is, or at any time during the course of this Business Advisory activity, becomes the subject of an investigation or other compliance action under PIPEDA or similar actions of any provincial, territorial or international privacy or data protection authority. If the OPC receives a complaint against the Organization during the course of this activity, the Directorate may terminate the same to avoid any overlap with the investigation.
6. The information provided to the Directorate will normally be used only to formulate and provide advice and guidance to the Organization on how to frame its initiatives and practices in order to achieve and enhance compliance with PIPEDA. However, if the Directorate learns of willful, serious, or systemic non-compliance during the course of this advisory activity, it may terminate the activity and place the Organization on notice of referral to the OPC’s Compliance Sector, for its enforcement consideration. In that case, the information obtained by the Directorate may be shared to the extent necessary, and the information so shared may be assessed as relevant evidence.
7. The confidentiality provisions of PIPEDA apply to Business Advisory activities, and the Organization understands that the OPC may, where it is in the public interest, make public any information that comes to its knowledge during this activity. Furthermore, PIPEDA also allows for the disclosure of information to the OPC’s domestic and international counterparts, in accordance with the applicable information sharing agreements.
8. The Organization understands and acknowledges that the OPC may be required, under the Access to Information Act (ATIA)^{Footnote 2} and/or the Privacy Act (PA)^{Footnote 3}, to disclose information obtained during this activity, and that there could be exemptions that could be available to the Organization and may apply to such information, such as exceptions for third-party information specified in section 20 of the ATIA.
9. The Organization will be responsible for its continuing obligation to comply with PIPEDA, including monitoring and appropriately adjusting to any subsequent legal framework developments, and understands that any advice provided by the Directorate during this activity, or an element thereof, can be superseded by legislative changes, judicial determinations and/or later regulatory interpretations and/or investigative findings.
10. The Organization understands that the Directorate may specify such further terms or conditions during the course of this activity as may be appropriate in the context, and the Organization shall, subject to its acceptance of such further terms, adhere to the same in good faith.

If you have any questions, please bring them to the attention of the Directorate.