What is the dual purpose that PIPEDA Part 1 is designed to balance?
Based on: PIPEDA s. 3 Purpose
Ontario Private Investigator Test · Privacy (PIPEDA)
PIPEDA for Ontario Private Investigators 2026: Consent and the Investigation Exception
A private investigator in Ontario handles personal information as a commercial activity, so the federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies. PIPEDA balances an individual's right to privacy against an organization's need to collect, use or disclose personal information for purposes a reasonable person would consider appropriate, under s. 3. Section 5(3) sets that reasonable-person standard, and s. 7 provides the narrow exceptions that let an investigator act without knowledge or consent.
Practice
Free practice questions
A private investigation firm conducts surveillance on behalf of corporate clients as a commercial activity. Under PIPEDA Part 1, which statement about its application to this firm is correct?
Based on: PIPEDA s. 4 Application
An individual keeps a personal journal recording observations about a neighbour's daily routine for their own reference. How does PIPEDA Part 1 treat this activity?
Based on: PIPEDA s. 4 Application
A journalist collects personal information about a public figure solely for an investigative news article. Under PIPEDA Part 1, is the news organization covered?
Based on: PIPEDA s. 4 Application
Under PIPEDA, which of the following would be classified as "personal information"?
Based on: PIPEDA s. 2 Definitions
Under PIPEDA, what is meant by "business contact information"?
Based on: PIPEDA s. 2 Definitions
A private investigator's report is stored as a videotape recording. Under PIPEDA's definition, does a videotape qualify as a "record"?
Based on: PIPEDA s. 2 Definitions
Under PIPEDA, what standard governs whether an organization's purpose for collecting personal information is permissible?
Based on: PIPEDA s. 5(3) Appropriate purposes
Under PIPEDA, what must be true for an individual's consent to personal information collection to be considered valid?
Based on: PIPEDA s. 6.1 Valid consent
During an investigation, a private investigation agency discovers information giving it reasonable grounds to believe a law of Canada has been contravened. Under PIPEDA, may the agency use that personal information without the individual's knowledge or consent?
Based on: PIPEDA s. 7 Without knowledge or consent
When PIPEDA applies to your work
Section 4 draws the boundary of the Act. PIPEDA Part 1 applies to every organization in respect of personal information that it collects, uses or discloses in the course of commercial activities, which squarely includes a private investigation firm conducting surveillance for corporate clients. The section also carves out what it does not cover. It does not apply to an individual in respect of personal information collected, used or disclosed for personal or domestic purposes, so a person keeping a private journal about a neighbour is outside the Act. It also does not apply to an organization in respect of personal information collected, used or disclosed for journalistic, artistic or literary purposes only. The definitions in s. 2 matter here too: personal information is information about an identifiable individual, business contact information is defined and treated separately, and a record includes any videotape, so a surveillance video is a record under the Act.
Appropriate purposes and valid consent
PIPEDA does not let an organization collect whatever it likes. Section 5(3) provides that an organization may collect, use or disclose personal information only for purposes that a reasonable person would consider appropriate in the circumstances. Consent is the default basis for handling personal information, and s. 6.1 defines when it is valid: the consent of an individual is only valid if it is reasonable to expect that an individual to whom the organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting. Layered on top of consent are the ten fair information principles in Schedule 1. The first, Accountability in clause 4.1, states that an organization is responsible for personal information under its control and must designate one or more individuals who are accountable for the organization's compliance with the principles.
- PIPEDA applies to personal information handled in the course of commercial activities, per s. 4.
- Purposes must be ones a reasonable person would consider appropriate, per s. 5(3).
- Valid consent requires the individual could understand the nature, purpose and consequences, per s. 6.1.
- The organization must designate someone accountable for compliance, per Schedule 1 clause 4.1.
The investigation exceptions a PI relies on
Section 7 is the heart of private investigation practice, because it allows action without knowledge or consent in defined situations. An organization may use personal information without knowledge or consent if it has reasonable grounds to believe the information could be useful in investigating a contravention of the laws of Canada, a province, or a foreign jurisdiction, and it uses the information for that investigative purpose. Section 7 also permits disclosure to another organization without knowledge or consent where it is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws of Canada or a province, and where obtaining consent would compromise the investigation. That last condition is the practical key: if seeking consent from the subject would tip them off and defeat the inquiry, the exception is available. These exceptions are narrow and purpose-bound, so the test often checks that you tie the action to a genuine investigation rather than to convenience.
Access, the principles and the limits
Individuals have rights against the organizations that hold their information. Under ss. 8 and 9, on written request an organization must inform the individual of the existence, use and disclosure of their personal information and give access to it. There are limits. The organization must not give access where doing so would likely reveal personal information about a third party, and if that third-party information is severable, the organization must sever it before giving access. Recognised grounds for refusing access include information protected by solicitor-client privilege and disclosure that would reveal confidential commercial information. The remaining Schedule 1 principles fill in the rest of the framework, from Identifying Purposes in clause 4.2 and Consent in clause 4.3 through Limiting Collection, Use, Disclosure and Retention, Accuracy, Safeguards, Openness, Individual Access, and finally Challenging Compliance in clause 4.10. Together they form the ten principles the test expects a private investigator to recognise.
| Activity | PIPEDA Part 1 applies? | Why |
|---|---|---|
| PI firm's commercial surveillance for clients | Yes | Commercial activity, s. 4 |
| Individual's personal journal on a neighbour | No | Personal or domestic purpose, s. 4 |
| News organization's investigative article | No | Journalistic, artistic or literary only, s. 4 |
| Using info to investigate a legal contravention | Yes, but no consent needed | Investigation exception, s. 7 |
| Disclosing to another org where consent would tip off target | Yes, but no consent needed | Investigation exception, s. 7 |
FAQ
Frequently asked questions
Does PIPEDA apply to private investigators in Ontario?
Yes. A private investigation firm in Ontario collects and uses personal information in the course of commercial activities, so PIPEDA Part 1 applies under s. 4. The same section excludes information handled for purely personal or domestic purposes, and information handled for journalistic, artistic or literary purposes only, but neither exclusion covers a commercial PI firm.
Can an Ontario PI collect information without consent under PIPEDA?
Sometimes. Under PIPEDA s. 7, an organization may use personal information without knowledge or consent if it has reasonable grounds to believe the information could be useful in investigating a contravention of the laws of Canada, a province, or a foreign jurisdiction, and uses it for that purpose. Disclosure to another organization is also allowed where obtaining consent would compromise the investigation.
What makes consent valid under PIPEDA?
Under PIPEDA s. 6.1, consent is valid only if it is reasonable to expect that the individual to whom the organization's activities are directed would understand the nature, purpose and consequences of the collection, use or disclosure they are consenting to. Section 5(3) adds that any purpose must be one a reasonable person would consider appropriate in the circumstances.
Is a surveillance video personal information under PIPEDA?
It can be. Under PIPEDA s. 2, a record includes any videotape and other documentary material regardless of physical form, and personal information is information about an identifiable individual. A surveillance recording of an identifiable person is therefore a record containing personal information, and handling it is governed by the Act when done in the course of commercial activities.