Strata Corporations and Your Data Privacy Rights

Date
12.03.2015
Strata Corporations and Your Data Privacy Rights hero image
BC law places obligations and restrictions on how strata corporations can use personal information about residents. Strata lawyer Neil Mangan explains

In British Columbia, strata corporations are considered “private organizations” and are subject of the Personal Information Protection Act, SBC 2003, c.63. Often referred to as PIPA, this legislation places obligations, limits and restrictions on how strata corporations can collect, manage and disclose personal information about residents and visitors.

Failing to comply with PIPA may be the most common mistake the strata corporations make. Given the complex nature of privacy law and the need for volunteer strata councils to balance useful access to information with individual privacy rights, this isn’t surprising.

Basic Strata Corporation Obligations

Under PIPA, “personal information” includes any information that may identify a person, although contact information and work product is excluded. Based on this broad definition, strata corporations collect, use and manage a wealth of personal information about owners, tenants and occupants.

Every strata corporation in British Columbia is responsible for personal information under its control, including personal information held by property managers.[1]

There are two key obligations:

1) Designate a privacy officer

In order to centralize responsibility for the management of personal information, PIPA requires that every strata corporation designate a privacy officer and make that person’s name, title and contract particulars available to the public. Generally, the privacy officer will be a strata council member appointed by strata council at its first meeting after its annual general meeting.

2) Develop and implement a privacy policy

Section 5 of PIPA states that organizations must develop and follow privacy policies necessary to meet their obligations. The policies must include a process to deal with complaints arising under PIPA and must be made available to the public.

When developing and implementing privacy policies, strata corporations should prepare a list of all information they collect that may be used to identify individuals. When preparing this list, strata corporations must pay particular attention to any building access, security or surveillance systems that track entry and exit from the building and any common areas. Once this list is compiled, the strata corporation should review the purpose of each type of information collected and set out policies for the use, disclosure and protection of that information.

Is Consent is Required?

Under PIPA, strata corporations may collect and use certain types of personal information without obtaining consent. Other types of information require implicit or explicit consent. Often, strata corporations will need to pass specific bylaws and post signs in order to comply with consent requirements under PIPA.

Where a strata corporation uses electronic building access, security or surveillance systems, it should obtain legal advice regarding the kind of consent required to use these systems and when any information collected may be disclosed to third parties.

If any information collected through building access, security or surveillance systems is used to enforce bylaws and rules, a strata corporation must obtain legal advice about whether such use is lawful and any special obligations the strata corporation may have to retain and provide this information to persons accused of breaching bylaws and rules.

What if a Strata Corporation Doesn’t Comply with PIPA?

PIPA gives members of the public broad rights to access and review personal information collected by strata corporations. Where an owner, occupant, tenant or visitor believes that a strata corporation hasn’t complied with its obligations under PIPA, that person may file a complaint with the strata corporation. The strata corporation has an obligation to promptly respond to the complaint.

If a complainant isn’t satisfied with the strata corporation’s response, or doesn’t receive a response, the complaint can be forwarded to the Office of the Information and Privacy Commissioner for British Columbia. This public body may assign an investigator with the authority to issue compliance orders. A strata corporation may also be held liable for any actual damages suffered by a complainant as a result of non-compliance with PIPA.

For additional information on how to improve strata corporation governance and other strata property topics, visit my free online strata law guide at www.stratalaw.ca. Finally, always remember that this article provides general reference information, not legal advice. Always obtain legal advice from a strata lawyer.

[1] Personal Information Protection Act, SBC 2003, c.63 (“PIPA”) sets out the basic responsibilities of organizations at s.4.

Loading...

Want to get the most out of The Guide?

Stacked ring illustration
Loading...