Provincial privacy rules for campaign data: PIPEDA vs Quebec Law 25 vs Alberta PIPA

Situation: one contest, three provincial records

A Toronto retailer is preparing a subscriber contest for people in Ontario, Quebec, and Alberta. Before launch, the team follows the campaign information from signup through deletion, checks permission and notices, and rehearses a possible email-platform compromise.

The exercise makes each province part of the operating plan, rather than assuming one national list has one set of rules.

The team first creates a record for each person's province and asks whether the retailer is federally regulated. It does not treat the sender address as the deciding clue: coverage can overlap, and the subscriber's province is usually more important. A rules register gives staff a place to keep the checks together.

The retailer also recognizes that this contest is one example of a broader problem. A Halifax business emailing people in Montreal, Calgary, and Vancouver faces different consent tests, as can a Toronto agency working with client lists in those places. A US business licensed to operate and marketing in Canada faces another compliance rulebook, with controls, records, reporting procedures, and vendor oversight to manage.

Check 1: Which privacy regime fits each subscriber?

The first check assigns a likely privacy regime to each record. PIPEDA covers private-sector organizations in provinces without a substantially similar private-sector law, and federally regulated sectors across Canada, including banks, telecommunications companies, and airlines.

The team verifies whether the retailer is federally regulated instead of treating its Ontario address as the answer.

For Quebec records, the team notes that Law 25 modernized the private-sector statute, added higher administrative penalties and breach-reporting duties, and requires privacy by default. The law applies to enterprises doing business in Quebec, which may include national retailers and SaaS vendors with Quebec customers. The team keeps Quebec records visible as a distinct case in its document controls.

Alberta PIPA applies to provincially regulated private-sector organizations in Alberta and generally requires opt-in consent, subject to limited exceptions. It also requires breach reporting to Alberta's Office of the Information and Privacy Commissioner. British Columbia has a substantially similar private-sector law, while Ontario, the Prairies, Atlantic Canada, and the territories rely on PIPEDA for most private-sector activity; several provinces also have health-specific statutes.

The team's jurisdiction notes distinguish the person's province from the business's location. PIPEDA continues to matter for federally regulated sectors and private-sector activity in provinces without a substantially similar statute. Those distinctions give the retailer a starting point for each record, not permission to overlook the consent, notice, retention, access, or incident duties that follow.

Check 2: Does the permission support this email?

The team compares each record's permission with the applicable privacy rules and the separate anti-spam test.

PIPEDA may allow express or implied consent in defined circumstances; Quebec and Alberta generally call for opt-in permission for marketing. A single consent entry cannot establish that every privacy and anti-spam obligation has been met.

For PIPEDA, the team checks whether the person understood and agreed to the relevant use. Whether consent can be express or implied depends on sensitivity and what a reasonable person would expect. For marketing email, meaningful permission needs plain language, a clear purpose, and an easy way to withdraw; the team compares those requirements with the signup notice.

Quebec Law 25 requires consent to be clear, free, and informed. Marketing permission should be requested separately from other terms, so placing it inside general terms of service is a weak basis. Privacy settings must be at their most protective level by default. The retailer checks its signup flow for both the separate request and that default setting.

Alberta PIPA generally requires express consent to collect, use, or disclose personal information unless an exception applies. Implied-consent cases are narrow, such as someone volunteering information for an obvious purpose. A purchased marketing list does not fit that example, so the retailer records affirmative permission rather than treating a list purchase as consent.

The team also checks Canada's anti-spam legislation, which operates alongside privacy law and is enforced by the CRTC. CASL requires consent for commercial electronic messages, and passing a PIPEDA test does not establish CASL compliance. The review checklist helps staff keep the two assessments distinct.

The team treats implied-consent periods mainly as a CASL concept. A business relationship may allow a period of implied consent for messages, while privacy statutes continue to govern the personal information itself. For each list entry, staff record the consent basis, permission date, and record source so they can explain how permission was obtained if a regulator asks.

Check 3: Can staff explain the record and its lifecycle?

The retailer compares its public privacy notice with the planned contest practices. Across the three regimes, the notice should explain the information collected, its purpose, how long it is kept, and how a person can contact the organization or make a complaint.

The record also needs enough detail to connect the person, permission, purpose, and deletion plan.

PIPEDA expects an accessible policy in understandable language, including purposes, retention, complaint routes, and a named privacy officer or contact point. Quebec Law 25 calls for a clear policy describing purposes and information categories, and advance notice before technology is used to identify or profile a person.

Quebec also requires the person responsible for protecting personal information to be identified by title in a published notice. Alberta PIPA requires a policy available on request that explains purposes and how to contact the privacy officer. It also requires notice to an individual when information is collected directly or through an agent.

The team checks that each entry can connect the individual with the consent basis, collection purpose, and planned deletion. Its policy calendar template keeps responsible owners and review dates visible. The record carries operational detail, while the public notice explains practices and contact routes; the retailer checks that the two do not contradict each other.

These shared fields help address the substance of all three regimes but do not remove local notice duties. Quebec and Alberta expect the person to see the purpose and contact details; PIPEDA calls for meaningful consent and an honest policy. The team also keeps statute reading notes with the relevant legal references.

Retention is another check. PIPEDA limits storage to the time needed for the purpose. Quebec Law 25 requires a retention schedule and, in some cases, its publication. Alberta expects information to be destroyed or anonymized once its purpose ends. A record from 2016 with no activity therefore needs review rather than automatic indefinite storage.

The retailer sets retention by record type instead of applying one period to everything. PIPEDA breach records must be kept for 24 months. CASL consent records must remain for three years after a message is sent. For inactive subscribers, a typical period is 24 months, within a range of 12 to 24 months depending on the stated purpose.

Staff also test whether they can retrieve one person's complete record after an access request. PIPEDA provides 30 days to respond, with limited extensions; Quebec Law 25 provides 30 days; Alberta PIPA provides 45 days. A written policy alone is not enough if campaign staff cannot find the underlying information when someone asks.

Check 4: Can the incident response be run by province?

Before launch, the retailer rehearses a possible compromise of the email platform. The exercise is hypothetical, not a report of an actual breach. Staff check who assesses risk, which regulator is contacted for each province, how affected people receive notice, and where incident details are entered in the organization's records.

Under PIPEDA, a breach of security safeguards must be reported to the Office of the Privacy Commissioner when it creates a real risk of significant harm. Affected individuals must also be notified at that threshold. The organization must retain records of every breach, reportable or not, for 24 months; the mere occurrence of an incident is not the whole test.

For Quebec, Law 25 requires notice to the Commission d'acces a l'information and affected individuals when a breach presents a risk of serious injury. It also requires an incident register and, in some cases, notice to other organizations able to help reduce the risk. The retailer records this assessment separately from the federal threshold.

Alberta PIPA requires a report to the Commissioner without unreasonable delay when a breach creates a real risk of significant harm. Individuals must be notified when there is a real risk of significant harm to them. Alberta also requires incident records, so the retailer's process captures breaches and near misses.

The reporting clocks are not interchangeable. Under PIPEDA, the regulator report and notice to affected people must be made as soon as feasible after the organization determines that the real-risk threshold is met. Alberta calls for reporting without unreasonable delay after its threshold is reached, so the incident plan records which timing applies.

Quebec requires notice with diligence, which the Commission reads as without delay; the statute sets no fixed number of days. The team does not wait for a complete forensic report before contacting the regulator. It reports what is known and supplements the information as its assessment develops.

Marketing platforms may hold consent records, opens, clicks, and sometimes purchase history, making them a possible breach source. The organization, not necessarily its email service provider, may have the notice duty. The retailer checks that its agreement says who contacts whom and within what window, then includes those details in its incident plan.

Check 5: Where does each record travel?

The data map follows each subscriber record through collection, use, storage, transfer, and deletion. For every entry, the retailer records the person's province, consent basis, systems and people involved, and purpose of each use. This lets staff apply requirements record by record instead of relying on one database-wide assumption.

As a working rule, protection generally follows the person's province of residence, not the sender's address. A Vancouver company emailing a Montreal subscriber should expect Quebec Law 25 to apply to that person's information. A Calgary company emailing an Ontario subscriber is generally in PIPEDA territory for that record.

A Montreal company emailing an Alberta subscriber should meet Alberta PIPA terms for that record. Where a province has a substantially similar law, it governs provincially regulated organizations operating there. PIPEDA still applies to federally regulated sectors and to private-sector activity in provinces without their own substantially similar statute.

Cross-border transfer review is another part of the map. Quebec Law 25 requires a privacy impact assessment before personal information is transferred outside Quebec in some circumstances and expects comparable protection. PIPEDA keeps organizations accountable for information transferred to a third party, including a processor, and expects protection through contract or other means.

The map also records whether the contest uses profiling, automated decision-making, or AI-driven segmentation. Regulators have explicitly attended to these technologies, and privacy guidance from the Office of the Privacy Commissioner on AI and technology can inform campaign data governance. A model scoring subscribers or predicting churn needs a stated purpose and, in Quebec, clear notice.

For this contest, the map connects the lifecycle with the applicable provincial treatment: Ontario records need meaningful contest terms, Quebec records need clear separate consent and a published privacy contact, and Alberta records need opt-in permission with notice of purpose. The brief should state consent basis, province coverage, and retention before creative work begins.

The email review also checks that a standard marketing message footer contains a privacy-policy link, an identification line, and an unsubscribe path. These elements support CASL as well as privacy review. When the process changes, staff update the case-study file instead of relying on a stale copy of the original brief.

Check 6: What must be settled before a vendor receives data?

Campaign information commonly sits with email platforms, CRMs, analytics tools, and agencies. All three regimes leave the originating organization accountable for personal information sent to a processor. The retailer therefore checks contract terms before transfer and keeps its vendor inventory beside the data map.

Quebec Law 25 expects a written mandate before personal information is transferred to a service provider and limits the transfer to the stated purpose. Alberta PIPA expects reasonable security arrangements and breach-notification duties to flow through. PIPEDA expects comparable protection through contractual means when another party handles the information.

Sub-processors can create a gap in the map and notice. If an email platform uses a third-party delivery network in another country, the retailer needs to know about and disclose that transfer. It asks for the current sub-processor list and change-notice period, then checks both against the data map and privacy notice.

An agency managing a list for the retailer is a processor, while the retailer remains accountable. Their agreement should state who owns the list, who may export it, and what happens when the engagement ends. Keeping vendor details with document control records helps staff spot missing breach-notice terms.

Outcome: the launch plan has three treatments and one map

The retailer's checks leave it with three consent treatments and a single map that shows where each applies. For future campaigns, the brief records province coverage, consent basis, and retention before creative work begins. A compliance calendar can assign review dates and make those obligations visible to the campaign team.

The retailer reads the comparison by column when adding a data source and by row when reviewing an incident; either direction can expose a different weakness. Staff revisit it when a platform changes its data practices, since a new sub-processor or AI feature can change what needs checking. A scheduled review tool can make those checks visible.

Rules carried into the next campaign

The scenario leaves the retailer with a repeatable sequence: map each person's province, test privacy consent separately from CASL, keep a usable record, set justified retention, and document vendor duties.

Ontario has no general private-sector privacy statute, so PIPEDA applies to most private-sector organizations there; federally regulated Ontario businesses are covered by PIPEDA as well.

For Alberta marketing, implied consent is generally not a sound basis for purchased or rented lists. Alberta PIPA makes express consent the rule, with narrow exceptions that do not cover those lists. Quebec subscribers need a separate privacy-consent test even when CASL consent exists, because anti-spam and personal-information requirements remain distinct.

If a breach affects subscribers in three provinces, the organization assesses each regime separately, contacts every regulator whose threshold is met, and notifies affected people where required. One incident may involve federal, Quebec, and Alberta regulators. The reporting records should preserve the separate assessments rather than treating the event as one undifferentiated decision.

Inactive subscriber information should remain only as long as its stated purpose requires. Set a period for each record type, automate deletion, and document the schedule because retention needs justification. If a subscriber moves, recheck the province at collection and use, then update the consent terms applicable to that record.

The data map and vendor terms give the team a consistent place to record decisions and demonstrate controls when requirements overlap. They do not replace separate checks for consent, notice, retention, access, and breaches. The retailer keeps the relevant obligations and evidence together for the next campaign review.