What Landlords Need to Know About Changes to PIPEDA

When leasing commercial property to a tenant, large amounts of information are collected, used and disclosed, which makes sense. As a landlord, it is important for you to know who your tenants are so that you can enter into a relationship with the right business while also ensuring your property is protected.

From a tenant perspective, however, there is an expectation for privacy when it comes to their business and their work space. 

That is where the Personal Information Protection and Electronic Documents Act, better known as PIPEDA, comes in. 

PIPEDA outlines how Canadian businesses must use and manage personal information while conducting business activities. In terms of the landlord/tenant connection, PIPEDA helps mediate the information sharing relationship. It allows landlords to collect the information they need to make a smart decision, while ensuring that the tenant’s privacy is maintained.

Under PIPEDA, you as a landlord or property manager are required to:

1. Receive consent to collect, use or disclose personal information.
2. Identify the reason you are collecting information and request only the minimal information needed. As a benchmark, this means you should only ask for information that a reasonable person would consider pertinent for your purposes.
3. Allow the tenant access to the information you have obtained on them.
4. Allow the tenant to challenge the information gathered on them.
5. Use collected information solely for the purposes for which it was gathered.

Recently, a revision was made to PIPEDA that requires all organizations to report data breaches posing “real risk of significant harm”. These breaches must be reported to both the affected individual, i.e. your tenant, and the Office of the Privacy Commissioner.

In addition, you must also maintain records of the breach for a two full years. Failure to do so could result in fines of up to $100,000 per affected individual.

While safeguarding information about your tenant was always a requirement of PIPEDA, under Principle 7, it is now more important than ever for landlords to ensure their tenants’ and prospective tenants’ data is protected to avoid having to report breaches, which was previously voluntary.

This may mean using a locked cabinet, restricting access to the office, equipping your business with security systems, strengthening passwords and firewalls, training staff on the handling and storing of personal information, enhancing internal policies and introducing security clearances.

15 Privacy Tips for Landlords

To help ensure that you meet the requirements of PIPEDA when investigating your prospective tenants and reviewing your renewal tenants, here are 15 tips for commercial landlords.

1. Collect only the information you need – i.e. a SIN is not typically required.
2. While there are no specified time periods for which information can be held, retain only the most pertinent information.
3. Obtain written permission to do a credit check on your commercial tenant.
4. Keep track of the information you have collected, where it is stored, how you use it and how it was disposed of.
5. Train staff and implement policies to ensure everyone knows their roles as they pertain to PIPEDA.
6. Limit access to personal information.
7. Take appropriate actions when an employee accesses information without authorization.
8. Dispose of personal information appropriately.
9. Be upfront about the information you are collecting and how it is being used.
10. Implement a privacy policy that communicates your data processes – what is being collected, how you are using it, who you will be sharing it with and how you will dispose of it.
11. Protect devices which store personal information.
12. Secure personal information whether it is in digital or hard copy format.
13. Allow tenants access to their information in a timely manner.
14. Have a clearly defined process for allowing tenants to challenge the information you have and ask questions about their privacy as it pertains to the information you have collected.
15. Ensure your rental applications and leases are updated to meet the requirements of PIPEDA.

At Quality Credit Reporting, our screening services are fully compliant with PIPEDA as well as Provincial Human Rights and Credit Reporting Legislation. Informed consent is obtained prior to starting any investigation on a prospective tenant and all of our commercial tenant credit applications, completed by the tenant, include a clause which authorizes us to gather subsequent credit data through the duration of the lease and upon renewal.

For more information on PIPEDA and your rights as a landlord, or to obtain a credit report that meets all legislative requirements, contact us today.