Home : Feature Article


Protection of Personal Information - Privacy Guidelines
for BC's Development Industry

By Larry Munn                                         April 20, 2004 

Members of BC's real estate industry are now at least vaguely aware that they are subject to sweeping privacy laws which came into force earlier this year. Many developers, landlords and employers have scrambled to comply by using a patchwork of policies and consents copied from competitors' websites and other sources, but still have an uneasy feeling that they remain offside. Clark Wilson LLP partner Larry Munn has worked with the Urban Development Institute and its members to produce easy to use Guidelines for BC's Development Industry. The very informative Introduction to those Guidelines has been reproduced below. The complete Guidelines were presented at UDI's breakfast seminar on April 27th and are available through Clark Wilson LLP using this order form or by sending an email to cjy@cwilson.com.

(UDI Members are invited to to see the Powerpoint presentation form Larry's seminar in the members only area at the UDI website.)

 
On January 1, 2004, the Personal Information Protection Act came into force. It requires that all businesses and organizations in British Columbia have policies for collecting, using, disclosing and protecting personal information.
 

How the New Act Affects Real Estate Development Companies

The new Act presents unique challenges for real estate development companies. Personal information is an important part of several aspects of a real estate development company’s business. Primarily, the new Act will affect real estate developers when they act in the following capacities:

  1. as a marketer to prospective buyers of strata lots;

  2. as a strata council until a strata corporation’s first annual general meeting;

  3. as a landlord in residential tenancies;

  4. as a landlord in commercial tenancies; and

  5. as an employer.

There may be circumstances where a real estate development company collects personal information that does not fall into any of the above categories. In such cases, real estate development companies should follow the general principles or consult with legal counsel.

The real estate developer as a marketer collects personal information from prospective buyers of strata units, and uses that information to market the units in a development. The real estate developer may want to use the information collected about individuals while marketing one development to market a new development. In such situations, the real estate developer must be aware of the requirements regarding consent to use information for new purposes and consent to disclose personal information to other corporations in a group of companies.

The real estate developer as strata council must collect the personal information specified in the Strata Property Act. Further, the real estate developer may collect information from strata buyers which is not required by the Strata Property Act. While it is not likely to be common for a real estate developer to be faced with access requests during the limited time it acts as the strata council, it should be prepared to deal with them.

The real estate developer as landlord in residential tenancies collects a significant amount of personal information, including contact information, financial information, references and emergency contacts.

A real estate developer as a landlord in a commercial tenancy will not be exposed to the new Act as often as in its other capacities. Business contact information, such as a person’s name, title, business address, business telephone number, business fax and business email is not subject to the new Act. However, if the real estate developer collects personal information, it will be subject to the new Act. Such information may include emergency contact information and information related to personal guarantees.

The real estate developer as employer must be aware of the special rules relating to employees. As an employer, the real estate developer does not need an employee’s consent to collect "employee personal information", defined as information needed to establish, manage or terminate the employment relationship. However, the employee must be given notice before the collection occurs. The employee’s consent is necessary to collect personal information other than employee personal information such as names of children or vehicle information (unless it is required for work). The information must be safeguarded and employees may make access requests.
 

Overview of the Key Concepts

There are three key concepts to keep in mind when seeking to comply with the new Act.

First, real estate development companies must obtain consent before they collect, use or disclose personal information. A consent is only valid if the individual understands the purposes for which he or she is providing the personal information and expressly consents to its collection, use and disclosure for those purposes. Consent should be in writing whenever possible. There are exceptions to the consent principle, particularly when information is required by law. The exceptions are addressed in these Guidelines. However, real estate development companies should develop a policy of openness so far as personal information is concerned. Individuals are entitled to know what is being done with their personal information.

Secondly, if they have not already done so, real estate development companies should ensure that they have proper systems in place to ensure that all the personal information in their possession is protected. For example, proper locks, filing cabinets and shredding machines may be required. Information stored on computer databases must also be secured. Personal information that no longer serves a valid business purpose and is no longer required by law should be destroyed.

Thirdly, real estate development companies must be prepared to respond to requests from individuals for correction of and access to their own personal information. Under the Act, upon request, organizations must provide an individual’s personal information, the ways in which it is being used and the names of individuals and organizations to whom the information has been disclosed. However, individuals may only access their own information and not personal information of others. Certain information may be edited from any request, but a response must be provided within 30 days. Real estate development companies that do not have well organized files and carefully documented procedures may face difficulties when access requests are made.

The Personal Information Protection Act allows dissatisfied individuals to complain to British Columbia’s Privacy Commissioner should they have concerns regarding how an organization is handling their personal information. The Commissioner has the power to conduct investigations and inquiries. It is expected that the Commissioner will work with organizations to ensure that they understand the new Act and the importance of personal information. Nevertheless, the Act also allows an individual, in certain situations, to bring a court action for damages, a scenario that every real estate developer will want to avoid.
 

Applicability of the Federal Privacy Legislation

There is also a federal statute, the Personal Information and Electronic Documents Act, which applies to federally regulated organizations, such as banks and airlines, and to commercial organizations that operate in a province which does not have privacy legislation. The federal legislation also applies to the disclosure of personal information across provincial or national borders for a commercial purpose. Real estate development companies that have operations outside of British Columbia will want to consider the impact of the federal legislation; although compliance with the British Columbia legislation, for the most part, constitutes compliance with the federal legislation. These Guidelines focus on the British Columbia Act.

It is worth noting that that both British Columbia’s Personal Information Protection Act and the federal statue are built around ten "fair information principles":

  1. Accountability;

  2. Identifying Purposes;

  3. Consent;

  4. Limiting Collection;

  5. Limiting Use, Disclosure and Retention;

  6. Accuracy;

  7. Safeguards;

  8. Openness;

  9. Individual Access; and

  10. Challenging Compliance.

These principles will not be discussed in detail in these Guidelines. Real estate developers who would like more detail are welcome to consult Clark Wilson LLP’s website (www.cwilson.com) for a paper outlining the basic issues.
 

How to Use these Guidelines

The Guidelines begin by addressing three main areas pertaining to the protection of personal information:

  1. accountability;

  2. information management; and

  3. transparency.

Under each of those headings, the Guidelines set out general principles that apply to any organization handling personal information as a part of its business, although they are written with reference to real estate development companies.

Next, the Guidelines apply the general principles to the various capacities in which a real estate developer collects personal information, namely:

  1. as a marketer to prospective buyers of strata properties;

  2. as a strata council until a strata corporation’s first annual meeting;
     
  3. as a landlord for residential tenancies;
     
  4. as a landlord for commercial tenancies; and
     
  5. as an employer.

These applications of the general principles will also be of use to property managers, especially the discussions relating to stratas and residential and commercial tenancies.

When using these Guidelines, real estate development companies should identify the general principles that apply to the personal information and the capacity they are acting in relation to the collection, use or disclosure of the personal information. For instance, a real estate developer may be faced with an access request by an employee. The real estate developer should refer to the sections on access requests under Part 4 – General Principles: Transparency, and the sections on employees under Part 9 – Employees. Similarly, a real estate developer concerned with the wording of a registration form for prospective buyers would want to refer to Part 3 – General Principles: Information Management, and Part 5 – Prospective Buyers.

These Guidelines also include several schedules setting out precedents which real estate developers will want to refer to and modify for use in their own business.

Conclusion

We encourage members of the development industry to abandon that patchwork of policies and consents copied from competitor’s websites, and gain confidence that your privacy practices comply with the requirements of the Personal Information Protection Act. These Guidelines clearly explain the privacy issues that affect BC’s development industry and provide useful examples of policies, consents and purpose statements for developers, landlords, and employers.

BC’s real estate development industry can order the complete Guidelines through Clark Wilson LLP using this order form or by sending an email to cjy@cwilson.com.

- Larry Munn  
 

BCRELinks.com is a reference service developed by the Commercial Real Estate group at Clark Wilson LLP. The information and links posted to this website should not be treated by readers as legal advice and ought not be relied upon without further, detailed legal counsel being sought.



© 2004, Clark Wilson LLP. All Rights Reserved.