The federal government has finally introduced the long awaited and much needed amendments to PIPEDA, the private sector privacy legislation that applies to federally regulated operations, and also provincially regulated operations in some capacities in all provinces except BC, Alberta and Quebec.

The proposed amendments are in response to the 2007 report that followed the mandatory statutory review of PIPEDA.

Key among the proposed amendments - which were introduced on May 25, 2010 and contained in Bill C29 (An Act to Amend Personal Information Protection and Electronic Documents Act) - are:

• the removal of "business contact information" from the purview of PIPEDA;
• the ability to disclose and use personal information in connection with a "prospective business transaction" (such as a sale of a business, merger and amalgamation, etc.) without the knowledge or consent of the individual; and
• the ability to collect, use and disclose "employee personal information" without consent (albeit notice is required).

While these provisions would be new to PIPEDA, they are not new to private sector privacy legislation in Canada, as both the BC and Alberta statutes have contained similar provisions from their inception.

Notably, the PIPEDA amendments also introduce a requirement for organizations to notify the Privacy Commissioner where there has been a material breach of security safeguards in relation to personal information. The May 1, 2010 amendments to Alberta's private sector privacy legislation also introduced breach notification provisions.

There does not appear to be any indication yet when Bill C29 will be passed, or come into force.

David T.S. Fraser has prepared a good overview  of the proposed amendments ("Overview of Proposed PIPEDA Amendments") for slaw.ca. Two lawyers at Davies Ward Phillips & Vineberg LLP have also prepared an overview which can be found here.